Does Title 42 CFR Part 2 Confidentiality of SUD Patient Records Apply to You?

People with alcohol or drug use disorders do not always seek treatment for their substance use disorders because of fear: fear of the social and legal consequences if family, friends, neighbors, employers, co-workers, law enforcement, and even medical personnel learn of their substance abuse.

Protecting that privacy and encouraging treatment for substance use disorders (SUD) is the purpose of Title 42 of the Code of Federal Regulations (CFR) Part 2: Confidentiality of Substance Use Disorder Patient Records (Part 2).

More often referred to as 42 CFR Part 2, the regulations went into effect in the 1970s but have been updated several times, most recently in 2020.

What Does Title 42 CFR Part 2 Do?

Patients with SUD should not be more vulnerable to the consequences of their substance abuse just because they sought treatment. That is the intent of 42 CFR Part 2.

Specifically, the regulations prevent providers of federally assisted SUD treatment plans from sharing or disclosing a patient's protected records about past and substance use without written permission from the patient, except in limited circumstances.

(The 2020 Final Rule modified that permission to allow a Part 2 Program provider to share information about a patient's SUD with a non-Part 2 provider with oral consent alone. It also allows a non-Part 2 provider to share the information if informed by the patient directly.)

People with substance use disorders fear that this information could cause:

• Loss of reputation, friendships, and relationships
• Loss of employment
• Loss of child custody or visitation rights
• Eviction
• Worse medical care
• Arrest and incarceration

Even with written permission, an individual or organization cannot share it with anyone else, even other non-SUD medical personnel within the same mixed-use facility. Additional written permission is required.

Without such protection, they believe they could face arrest and imprisonment even if their only crimes were purchasing and using drugs. That is a strong disincentive to seek treatment.

Who Does Title 42 CFR Part 2 Apply To? 

Not all SUD treatment programs or providers must comply with 42 CFR Part 2's privacy and confidentiality regulations, but most do. Its provisions specifically apply only to providers and programs that both:

• Provide alcohol or drug abuse diagnosis, treatment, or referral for treatment
• Are federally assisted (through funding, tax-exempt status, authorization to dispense controlled substances for SUD treatment, or otherwise registered, certified, or licensed by the federal government)
• This also applies if it's a mixed-use medical facility with a unit or staff mainly dedicated to SUD treatment
• The same may apply to a private for-profit program that receives no federal assistance of any kind if state law requires that it comply with 42 CFR Part 2

How is CFR 42 Part 2 Different from HIPAA?

Both the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and 42 CFR Part 2 protect patient privacy, but the 42 CFR Part 2 predates HIPAA and is mostly stricter.

HIPAA includes broadly defined exceptions for covered entities—health plans, health care clearinghouses (such as billing services), and health care providers—for treatment, payment, and health care operations (TPO). That includes other of the patient's medical personnel even if they provide another type of (non-SUD) treatment.

Although these disclosures usually are limited to the minimum necessary, the covered entities define that minimum. Disclosure to a covered entity's business associates is also allowed.

On the other hand, 42 CFR Part 2 prohibits sharing a patient's substance abuse and treatment information—even from the patient's other physicians, even if in the same mixed-use facility—without written consent except in very limited circumstances such as:

• A medical emergency
• Records are exchanged internally within or between the Armed Forces and the Department of Veterans Affairs (VA).
• Limited disclosure to law enforcement to report crimes or threats on the program premises or against program personnel 
• Limited disclosure to law enforcement with a court order to investigate or prosecute for an "extremely serious crime" that causes or directly threatens the loss of life or serious bodily injury (homicide, rape, child abuse or neglect, assault with a deadly weapon, kidnapping, armed robbery)
• Limited disclosure to law enforcement with a court order to investigate or prosecute a Part 2 Program or its personnel

While 42 CFR Part 2 is stricter in most ways, HIPAA's covered entities include non-federally assisted programs and providers.

If there is a conflict between 42 CFR Part 2 and HIPAA, follow the stricter rule.

Has COVID-19 Changed CFR 42 Part 2?

The Coronavirus Aid, Relief, and Economic Security (CARES) Act has proposed changes to 42 CFR Part 2 to be more consistent with HIPAA. These changes mainly allow disclosures for treatment, payment, and health care operations.

The changes, originally expected to go into effect in March 2021, were delayed in April 2021 by the Substance Abuse and Mental Health Administration (SAMHSA) until its next Part 2 rule change. Previous rule changes occurred in 2017, 2018, and 2020, but as of March 2022, SAMHSA hadn't enacted the changes.

More directly, COVID-19 increased the use of telehealth, along with online peer fellowship support meetings. The greater reliance on telehealth has made keeping patients' information private more challenging. Healthcare providers have needed to make sure their customer relationship management (CRM) software and related IT services, suites, and practices are secure as well as both HIPAA and 42 CFR Part 2 compliant.

Why Keep SUD Info from Patients' Healthcare Providers?

Some healthcare providers argue they need this information to properly diagnose and treat patients, regardless of the negative consequences of disclosing a patient's substance use disorder.

For example, without the SUD diagnosis, they might prescribe or administer opioids to a patient with an opioid use disorder or a medication with a dangerous drug interaction. It is not always practical to obtain the patient's permission, written or oral, even in all non-emergency situations.

Still, there can be what might be considered good reasons to confine the knowledge to as few people as possible.

Many, especially old school physicians, still see SUD as a moral failing only, not potentially a chronic medical condition such as diabetes, hypertension, or asthma and so may not give the patient potentially beneficial care if they know about their SUD.

For instance, many physicians consider the use of medication—assisted treatment or narcotic replacement therapy—especially methadone and buprenorphine (Suboxone)—to be exchanging one addiction for another. Some even object to the use of the opioid overdose reversal drug naloxone (Narcan) because it makes it easier to continue opioid abuse, even though some generally-trusted sources believe these protocols to be proper.

Consequently, while potential confusion in these areas is not an absolute reason for making SUD information available to all medical personnel, an argument can be made that broad confidentiality and privacy protection can be justified.