United StatesConfidentiality of Substance Use Disorder Patient Records
42 CFR Part 2, as amended by the 2024 final rule (89 FR 12472)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Security
As of .
What it requires
- Use or disclose a record that identifies a patient as having or having had a substance use disorder only as 42 CFR Part 2 permits, limited to the information necessary for the purpose, and never in a civil, criminal, administrative or legislative proceeding unless the Part permits it (sections 2.12(a) and 2.13(a)).
- Obtain a written consent that carries the elements in section 2.31(a) before a use or disclosure that needs one, and send each consented disclosure with the written statement of the Federal confidentiality rules, because a general authorization for release of information does not permit further use or redisclosure (sections 2.31 and 2.32).
- Keep formal policies and procedures that protect patient identifying information, and handle a breach of unsecured records as a Health Insurance Portability and Accountability Act (HIPAA) covered entity would (section 2.16).
These lines are LexLint's reading of the law's text, as of .
What this law does
42 CFR Part 2 restricts the use and disclosure of records that would identify a patient as having or having had a substance use disorder and that contain substance use disorder information obtained by a federally assisted program that holds itself out as providing substance use disorder diagnosis, treatment or referral for treatment.
A lawful holder, meaning a person who received the records under a written consent with an accompanying notice of disclosure or under one of the exceptions to the consent requirements, is bound by the Part as well. The records may be used or disclosed only as the Part permits, limited to the information necessary for the purpose, and may not otherwise be used or disclosed in any civil, criminal, administrative or legislative proceeding by a Federal, state or local authority.
A written consent must include the patient's name, the person or class of persons authorized to make the disclosure, the recipient or class of recipients, a description of the information and a description of each purpose. Each disclosure made with the patient's written consent must be accompanied by one of two written statements of the Federal confidentiality rules.
A general authorization for the release of medical or other information is not sufficient to permit further use or redisclosure of the record. A part 2 program or other lawful holder must have formal policies and procedures to protect patient identifying information, and the Health Insurance Portability and Accountability Act (HIPAA) breach provisions apply to a part 2 program for breaches of unsecured records in the same manner as they apply to a covered entity.
A person who violates the statute is subject to the applicable penalties under sections 1176 and 1177 of the Social Security Act.
When LexLint raises it
When your app profile says your app handles health records.