Policy Prism AI

Confidentiality of Substance Use Disorder Patient Records

Federal

Confidentiality of Substance Use Disorder Patient Records

38 provisions · Centers for Medicare & Medicaid Services

Provisions

Citable source units

42 CFR § 2.1Authority PreemptionConfidentiality Disclosure

Statutory authority for confidentiality of substance use disorder patient records.

This provision identifies the statutory authority for the Secretary to prescribe regulations regarding the confidentiality of substance use disorder patient records.

Group

Definitions Scope Authority

Category

Authority Preemption

Domain

Records

Topics

Statutory authority, Substance use disorder records, Confidentiality regulations

Read provision
42 CFR § 2.11Definitions ContextMedical Records

Definitions.

For purposes of the regulations in this part:

Group

Definitions Scope Authority

Category

Definitions Context

Domain

Records

Topics

Substance use disorder records, Patient record confidentiality, Part 2 program definitions

Read provision
42 CFR § 2.12Confidentiality DisclosureDefinitions Context

Applicability.

This provision defines the scope, applicability, and exceptions for federal confidentiality requirements regarding substance use disorder patient records.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Behavioral Health

Topics

Substance use disorder records, Confidentiality of patient records, Part 2 program applicability

Read provision
42 CFR § 2.13Confidentiality DisclosureMedical Records

Confidentiality restrictions and safeguards.

This provision mandates strict confidentiality for substance use disorder patient records and limits disclosures to those necessary for the intended purpose.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Substance use disorder records, Patient confidentiality, Disclosure restrictions

Read provision
42 CFR § 2.14Confidentiality DisclosureConsent Advance Directives

Minor patients.

This provision defines the requirements for obtaining consent for the disclosure of substance use disorder records for minor patients based on state law.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Minor patient consent, Substance use disorder records, Disclosure authorization

Read provision
42 CFR § 2.15Confidentiality DisclosureConsent Advance Directives

Patients who lack capacity and deceased patients.

This provision outlines the procedures for obtaining consent for the disclosure of substance use disorder records for patients who lack capacity or are deceased.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Incapacitated patient consent, Deceased patient records, Personal representative

Read provision
42 CFR § 2.16HIPAA Privacy SecurityDocumentation Retention

Security for records and notification of breaches.

This provision requires programs to implement formal policies to protect substance use disorder patient records and mandates compliance with breach notification requirements.

Group

Health It Privacy Security

Category

HIPAA Privacy Security

Domain

Records

Topics

Record security, Breach notification, Electronic record protection

Read provision
42 CFR § 2.17General OperationsPatient Rights

Undercover agents and informants.

This provision restricts the employment or enrollment of undercover agents and informants in substance use disorder programs to protect patient confidentiality.

Group

Hospital Operations

Category

General Operations

Domain

Behavioral Health

Topics

Undercover agents, Informant restrictions, Program security

Read provision
42 CFR § 2.18Patient RightsConfidentiality Disclosure

Restrictions on the use of identification cards.

This provision prohibits requiring patients to carry identification cards that disclose their substance use disorder status while away from the program premises.

Group

Patient Rights Safety

Category

Patient Rights

Domain

Patient Rights

Topics

Identification cards, Patient privacy, Substance use disorder stigma

Read provision
42 CFR § 2.19Documentation RetentionConfidentiality Disclosure

Disposition of records by discontinued programs.

This provision establishes requirements for the secure retention, transfer, or destruction of patient records when a substance use disorder program discontinues operations.

Group

Records Health Information

Category

Documentation Retention

Domain

Records

Topics

Record disposition, Discontinued program records, Record retention

Read provision
42 CFR § 2.2Definitions ContextConfidentiality Disclosure

Purpose and effect.

This provision outlines the purpose and scope of federal regulations governing the confidentiality and disclosure of substance use disorder patient records.

Group

Definitions Scope Authority

Category

Definitions Context

Domain

Records

Topics

Substance use disorder records, Confidentiality purpose, Disclosure restrictions

Read provision
42 CFR § 2.20Authority PreemptionConfidentiality Disclosure

Relationship to state laws.

This provision clarifies the preemption relationship between federal substance use disorder record confidentiality regulations and state laws.

Group

Definitions Scope Authority

Category

Authority Preemption

Domain

Records

Topics

State law preemption, Substance use disorder records, Disclosure requirements

Read provision
42 CFR § 2.21Research Privacy ConfidentialityConfidentiality Disclosure

Relationship to federal statutes protecting research subjects against compulsory disclosure of their identity.

This provision describes the interaction between substance use disorder record confidentiality rules and federal research privilege statutes regarding compulsory disclosure.

Group

Research Human Subjects

Category

Research Privacy Confidentiality

Domain

Records

Topics

Research subject privacy, Substance use disorder records, Compulsory disclosure

Read provision
42 CFR § 2.22Confidentiality DisclosurePatient Rights

Notice to patients of Federal confidentiality requirements.

This provision mandates that substance use disorder treatment programs provide patients with a formal notice of their privacy practices, legal duties, and patient rights regarding the confidentiality of their records.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Behavioral Health

Topics

Substance use disorder privacy notice, Patient privacy rights, Confidentiality disclosure requirements

Read provision
42 CFR § 2.23Health Information AccessConfidentiality Disclosure

Patient access and restrictions on use and disclosure.

This provision outlines the patient's right to access their own substance use disorder records and the limitations on using such information for criminal investigations.

Group

Records Health Information

Category

Health Information Access

Domain

Behavioral Health

Topics

Patient record access, Substance use disorder records, Patient right to inspect records

Read provision
42 CFR § 2.24Health Information AccessHIPAA Privacy Security

Requirements for intermediaries.

Upon request, an intermediary must provide to patients who have consented to the disclosure of their records using a general designation, pursuant to § 2.31(a)(4)(ii)(B), a list of persons to which their records have been disclosed pursu...

Group

Records Health Information

Category

Health Information Access

Domain

Records

Topics

Patient record disclosure, Intermediary disclosure accounting, Patient access to records

Read provision
42 CFR § 2.25Medical RecordsHIPAA Privacy Security

Accounting of disclosures.

This provision mandates that part 2 programs provide patients with an accounting of disclosures of their substance use disorder records upon request.

Group

Records Health Information

Category

Medical Records

Domain

Behavioral Health

Topics

Accounting of disclosures, Substance use disorder records, Electronic health record disclosure

Read provision
42 CFR § 2.26HIPAA Privacy SecurityConfidentiality Disclosure

Right to request privacy protection for records.

This provision establishes the patient's right to request restrictions on the use and disclosure of their substance use disorder records for treatment, payment, or health care operations.

Group

Health It Privacy Security

Category

HIPAA Privacy Security

Domain

Behavioral Health

Topics

Privacy protection request, Restriction on disclosure, Substance use disorder records

Read provision
42 CFR § 2.3Compliance ProgramsHIPAA Privacy Security

Civil and criminal penalties for violations.

This provision details the civil and criminal penalties for violating federal confidentiality rules regarding substance use disorder patient records.

Group

Governance Quality Compliance

Category

Compliance Programs

Domain

Behavioral Health

Topics

Regulatory penalties, Substance use disorder record confidentiality, Enforcement of privacy rules

Read provision
42 CFR § 2.31Confidentiality DisclosureMedical Records

Consent requirements.

This provision specifies the required elements for written consent for the use or disclosure of substance use disorder patient records.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Behavioral Health

Topics

Patient consent requirements, Substance use disorder records, Written consent elements

Read provision
42 CFR § 2.32Confidentiality DisclosureMedical Records

Notice and copy of consent to accompany disclosure.

This provision requires that any disclosure of substance use disorder records made with patient consent must be accompanied by a specific written notice and a copy of the consent.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Behavioral Health

Topics

Disclosure notice requirements, Substance use disorder records, Redisclosure prohibition

Read provision
42 CFR § 2.33Confidentiality DisclosureHIPAA Privacy Security

Uses and disclosures permitted with written consent.

This provision outlines the requirements for using and disclosing substance use disorder patient records when valid written consent is obtained.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Patient record disclosure, Written consent requirements, Substance use disorder records

Read provision
42 CFR § 2.34Confidentiality DisclosureBehavioral Health

Uses and Disclosures to prevent multiple enrollments.

This provision specifies the conditions under which patient records may be disclosed to central registries or treatment programs to prevent multiple enrollments in substance use disorder programs.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Behavioral Health

Topics

Multiple enrollment prevention, Substance use disorder treatment, Patient record sharing

Read provision
42 CFR § 2.35Confidentiality DisclosurePatient Rights

Disclosures to elements of the criminal justice system which have referred patients.

This provision establishes the requirements for disclosing substance use disorder patient records to criminal justice entities that have mandated treatment as a condition of release.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Behavioral Health

Topics

Criminal justice referrals, Patient record disclosure, Consent for disclosure

Read provision
42 CFR § 2.36Confidentiality DisclosurePharmacy Medication

Disclosures to prescription drug monitoring programs.

This provision permits the reporting of substance use disorder medication data to state prescription drug monitoring programs when required by state law, provided patient consent is obtained.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Pharmacy

Topics

Prescription drug monitoring programs, Substance use disorder medication, Patient record disclosure

Read provision
42 CFR § 2.4Compliance ProgramsConfidentiality Disclosure

Complaints of noncompliance.

This provision mandates that programs establish a process for receiving complaints regarding privacy noncompliance and prohibits retaliation against patients for exercising their rights.

Group

Governance Quality Compliance

Category

Compliance Programs

Domain

Governance Quality

Topics

Noncompliance complaints, Patient rights, Retaliation protection

Read provision
42 CFR § 2.51Confidentiality DisclosureEmergency Services

Medical emergencies.

This provision allows for the disclosure of patient identifying information to medical personnel during bona fide medical emergencies when prior consent cannot be obtained.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Emergency

Topics

Medical emergency disclosure, Emergency patient care, Substance use disorder records

Read provision
42 CFR § 2.52Human Subjects ProtectionsResearch Privacy Confidentiality

Scientific research.

This provision establishes the requirements for the use and disclosure of patient identifying information for scientific research, including researcher obligations, IRB approval for data linkages, and data security and retention standards.

Group

Research Human Subjects

Category

Human Subjects Protections

Domain

Records

Topics

Scientific research data disclosure, Substance use disorder record confidentiality, Researcher data security requirements

Read provision
42 CFR § 2.53Confidentiality DisclosureHIPAA Privacy Security

Management audits, financial audits, and program evaluation.

This provision establishes the requirements for disclosing patient identifying information from substance use disorder records for the purpose of conducting management audits, financial audits, and program evaluations.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Substance use disorder record disclosure, Audit and evaluation disclosure, Patient record confidentiality

Read provision
42 CFR § 2.54Confidentiality DisclosurePublic Health Reporting

Disclosures for public health.

Part 2 programs may disclose de-identified patient records to public health authorities without patient consent.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Public health disclosure, De Identified records, Substance use disorder records

Read provision
42 CFR § 2.61Confidentiality Disclosure

Legal effect of order.

Court orders under Part 2 authorize but do not compel the disclosure of patient records, which requires a separate subpoena or legal mandate.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Court orders, Subpoena response, Patient record disclosure

Read provision
42 CFR § 2.62Confidentiality DisclosureResearch Privacy Confidentiality

Order not applicable to records disclosed without consent to researchers, auditors, and evaluators.

Court orders cannot authorize the use of records disclosed to researchers or auditors for criminal investigation or prosecution of patients.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Research record protection, Audit record protection, Criminal investigation limitations

Read provision
42 CFR § 2.63Confidentiality DisclosureAbuse Neglect Reporting

Confidential communications.

Court orders may only authorize disclosure of confidential communications in specific cases involving threats to life, serious crimes, or patient-initiated testimony.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Confidential communications, Disclosure criteria, Serious crime reporting

Read provision
42 CFR § 2.64Confidentiality Disclosure

Procedures and criteria for orders authorizing uses and disclosures for noncriminal purposes.

Court orders for noncriminal disclosures require good cause, notice, and specific measures to protect patient identity and confidentiality.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Noncriminal disclosure, Court order procedures, Good cause criteria

Read provision
42 CFR § 2.65Confidentiality Disclosure

Procedures and criteria for orders authorizing use and disclosure of records to criminally investigate or prosecute patients.

Court orders for criminal investigation of patients require strict criteria, including evidence of serious crime and the exhaustion of other investigative methods.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Criminal investigation, Patient record disclosure, Court order criteria

Read provision
42 CFR § 2.66Confidentiality DisclosureDefinitions Context

Procedures and criteria for orders authorizing use and disclosure of records to investigate or prosecute a part 2 program or the person holding the records.

This provision establishes the legal procedures, criteria, and limitations for investigative agencies to obtain court orders for the disclosure of substance use disorder patient records in criminal or administrative investigations.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Records

Topics

Substance use disorder records, Court order disclosure, Investigative agency access

Read provision
42 CFR § 2.67Confidentiality DisclosureGeneral Operations

Orders authorizing the use of undercover agents and informants to investigate employees or agents of a part 2 program in connection with a criminal matter.

This provision outlines the criteria and procedural requirements for obtaining a court order to place undercover agents or informants within a substance use disorder program to investigate suspected criminal activity.

Group

Records Health Information

Category

Confidentiality Disclosure

Domain

Behavioral Health

Topics

Undercover agent placement, Criminal investigation, Substance use disorder program

Read provision
42 CFR § 2.68Public Health ReportingIncident Reporting

Report to the Secretary.

This provision requires investigative agencies to report annually to the Secretary on the number of court order applications, denials, and instances of record handling related to substance use disorder programs.

Group

Health It Privacy Security

Category

Public Health Reporting

Domain

Records

Topics

Investigative agency reporting, Annual reporting requirements, Substance use disorder records

Read provision