Federal rules under 42 CFR Part 2 generally bar a substance use disorder treatment program from sharing a patient’s identifying information without written consent, but the regulations spell out a defined set of exemptions for disclosing substance use disorder patient records without that consent. Those exemptions cover medical emergencies, qualifying scientific research, audits and program evaluations, de-identified public health reporting, disclosures compelled by a Part 2 court order, mandated child abuse reports, and reports of crimes committed on program premises. Each exemption has its own conditions, and most come with limits on how the information can be used afterward.
What Records the Exemptions Apply To
The rules govern “Part 2 programs,” which are providers that offer diagnosis, treatment, or referral for substance use disorders and receive some form of federal assistance. Federal assistance is defined broadly enough to include tax-exempt status, so many nonprofit treatment providers are covered even without direct federal funding.1HHS.gov. Fact Sheet 42 CFR Part 2 Final Rule
Protected information is not limited to a diagnosis. It includes anything that could identify someone as having a substance use disorder or as receiving services from a Part 2 program, from names and Social Security numbers to photographs, fingerprints, or contextual details that a reasonably knowledgeable person could piece together. Former patients are covered as well as current ones.2eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
Medical Emergencies
When a patient faces an immediate health threat and prior written consent is not possible, a Part 2 program may share identifying information with medical personnel. The disclosure has to be limited to what is necessary to handle the emergency itself. A separate emergency scenario covers natural disasters or similar events where a state or federal authority has declared a temporary emergency and the program is closed and unable to operate or obtain consent.3eCFR. 42 CFR 2.51 – Medical Emergencies
The program has to document the disclosure right after it happens. That record needs to include the name and affiliation of the medical personnel who received the information, who at the program made the disclosure, the date and time, and the nature of the emergency.3eCFR. 42 CFR 2.51 – Medical Emergencies
Scientific Research
Records can be used for scientific research without patient consent, but the researcher has to meet specific requirements. The program’s director or chief executive must verify that the researcher falls into at least one qualifying category: a HIPAA-covered entity with proper patient authorization or a waiver of authorization, a researcher subject to HHS human subjects protections who has documented compliance or an exemption, or a researcher subject to FDA human subjects protections with similar documentation.4eCFR. 42 CFR 2.52 – Scientific Research
Researchers who receive Part 2 records are fully bound by the confidentiality rules. They cannot redisclose patient identifying information except back to the source, they must resist any judicial effort to obtain the records, and they may only include the data in research reports in aggregate form that prevents individual identification.4eCFR. 42 CFR 2.52 – Scientific Research
Audits and Program Evaluation
Government agencies and third-party payers responsible for funding or overseeing Part 2 programs can access records without patient consent for audits and evaluations. These disclosures cover activities like assessing program performance, reviewing compliance, and conducting utilization reviews. Records obtained this way cannot be used to investigate or prosecute patients without either the patient’s written consent or a specific court order.2eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
Public Health Reporting
A Part 2 program may share records with public health authorities without patient consent, but only if the information has been de-identified using the standards from the HIPAA Privacy Rule. In practice, that means stripping out enough identifiers that there is no reasonable basis to believe the information could identify a specific patient. This exception lets public health agencies track trends at a population level without exposing individual treatment records.5eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records – Section 2.54
Court-Ordered Disclosures
A regular subpoena is not enough. The program needs a court order specifically issued under Part 2’s procedures before it can share protected information, and even then the order alone only authorizes the disclosure. A subpoena or similar compulsory process is still required separately to actually compel the program to hand over the records.6eCFR. 42 CFR 2.61 – Legal Effect of Order
Orders for Non-Criminal Purposes
Before issuing an order for a non-criminal purpose, a court has to find good cause by weighing two factors: whether the information is available through other means, and whether the public interest outweighs the potential harm to the patient, the treatment relationship, and the program’s ability to serve other patients. The patient and the record-holder must get adequate notice and an opportunity to respond before the court rules, and any hearing has to be conducted privately to protect patient identity.7eCFR. 42 CFR 2.64 – Procedures and Criteria for Orders Authorizing Uses and Disclosures for Noncriminal Purposes
The order itself has to limit disclosure to only the parts of the record that are essential, restrict access to only the people whose need justified the order, and include protective measures such as sealing the proceeding from public view.7eCFR. 42 CFR 2.64 – Procedures and Criteria for Orders Authorizing Uses and Disclosures for Noncriminal Purposes
Orders to Criminally Investigate or Prosecute the Patient
The bar is considerably higher when someone wants Part 2 records to criminally investigate or prosecute the patient. A court can only authorize this kind of disclosure if it finds all of the following:
- The crime must be extremely serious, meaning it caused or directly threatens loss of life or serious bodily injury. The regulation gives examples including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, and child abuse.
- There must be a reasonable likelihood that the records will reveal information of substantial value to the investigation.
- Other ways of getting the same information must be unavailable or ineffective.
- The public interest must outweigh the potential harm to the patient, the treatment relationship, and the program’s ability to serve others.
- If law enforcement is the applicant, the record-holder must have had the opportunity to be represented by independent counsel.
Child Abuse Reports and Crimes on Program Premises
Part 2 does not block compliance with state mandatory reporting laws for suspected child abuse or neglect. Program staff who are required reporters under state law can and should make those reports. The original treatment records maintained by the program, however, remain protected. Those records cannot be used in any civil or criminal proceedings that grow out of the report unless the patient consents or a court issues an order under Part 2’s procedures.9eCFR. 42 CFR 2.12 – Applicability
When a patient commits a crime on the program’s property or against program staff, or threatens to do so, program personnel may report the incident to law enforcement. The exception is tightly limited. The report can include the circumstances of the incident, the person’s name and address, their last known whereabouts, and the fact that the individual is a patient. It cannot include clinical details about the patient’s diagnosis, treatment history, or prognosis.9eCFR. 42 CFR 2.12 – Applicability
Consent Is Still the Default
Outside these exemptions, disclosure requires the patient’s written consent, and consent for use in civil, criminal, administrative, or legislative proceedings against the patient has to be on its own separate form rather than bundled with a general treatment consent. Substance use disorder counseling notes also require their own separate consent.1HHS.gov. Fact Sheet 42 CFR Part 2 Final Rule Every disclosure made with consent must be accompanied by a written notice explaining the federal confidentiality protections and the limits on further use, warning recipients that the records cannot be used in legal proceedings against the patient without separate authorization.10eCFR. 42 CFR 2.32 – Notice and Copy of Consent to Accompany Disclosure