Privacy Law Library

Confidentiality of Substance Use Disorder Patient Records

42 CFR Part 2

Health

Part 2 makes records identifying a patient as having a substance use disorder diagnosis or treatment in a federally assisted program confidential, allowing disclosure mainly with patient consent or under narrow exceptions and court orders. The 2024 final rule (effective April 16, 2024; compliance Feb. 16, 2026) aligned Part 2 with HIPAA, allowing a single consent for treatment, payment, and operations and adding breach notification and HIPAA-style penalties.

Where
Federal
Citation
42 U.S.C. 290dd-2; 42 CFR Part 2
Status
In force
In force since
1970-12-31
Last amended
2024-09-17
Enforced by
HHS Office for Civil Rights (civil enforcement program began Feb. 16, 2026); DOJ for criminal violations
People can sue
No
Penalties
Violations are subject to the HIPAA civil and criminal penalty provisions of 42 U.S.C. 1320d-5 and 1320d-6 (CARES Act amendment).
Applies to
  • Federally assisted substance use disorder treatment programs ('Part 2 programs')
  • Lawful holders and recipients of Part 2 records, including HIPAA covered entities and business associates that receive them

What a privacy notice must say

  • Give patients notice of their federal confidentiality rights and the program's practices.42 CFR 2.22

Practices it requires

  • Use or disclose Part 2 records only with written patient consent containing required elements, or under a listed exception.42 U.S.C. 290dd-2(b); 42 CFR 2.31, 2.33
  • Patients may give a single consent for all future uses and disclosures for treatment, payment, and health care operations.42 CFR 2.33

Security duties

  • Maintain formal policies and procedures to protect Part 2 records against unauthorized use and disclosure.42 CFR 2.16(a)

Breach duties

  • Apply HIPAA breach notification requirements to breaches of Part 2 records.42 CFR 2.16; 42 U.S.C. 290dd-2(j)

Other duties

  • Records may not be used in civil, criminal, administrative or legislative proceedings against the patient without consent or a qualifying court order.42 U.S.C. 290dd-2(c); 42 CFR 2.61-2.67

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: effective_date is the enactment date of the original confidentiality provision (Pub. L. 91-616, Dec. 31, 1970); its separate effective date was not checked | OCR civil enforcement start date (Feb. 16, 2026) is from secondary reporting; HHS pages returned 403 | 42 U.S.C. 290dd-2(j) breach cross-reference and 42 CFR 2.22, 2.33, 2.61-2.67 were cited from part structure without close reading

Research reference, not legal advice.