42 CFR Part 2 Confidentiality of Substance Use Disorder Patient Records

Learn about 42 CFR Part 2, a federal law governing confidentiality for people seeking treatment for substance use disorders from federally assisted programs.

Federal privacy laws and regulations exist to protect patients’ personal health information. These policies guide healthcare professionals, health IT vendors, and insurance companies to maintain information security and patient confidentiality.

If you or a family member seeks treatment for a substance use disorder, or you are a professional who works with this population, it is important to understand a federal statute called Confidentiality of Alcohol and Drug Abuse Patient Records, 42 Code of Federal Regulations (CFR) 2, also known as 42 CFR Part 2.

The federal statute governs confidentiality for people seeking treatment for substance use disorders from federally assisted programs.

This law generally requires a federally assisted substance use program to have a patient’s consent before releasing information to others. It encourages people to seek treatment and reassures patient privacy.

Proposed Revisions and the Notice of Proposed Rulemaking (NPRM)

The U.S. healthcare system has changed significantly since 42 CFR Part 2 was last substantially updated in 1987. Over the last 25 years, changes to health care include:

• New models of integrated care for supporting patient care
• An electronic infrastructure for managing and exchanging patient data
• The expansion of prescription drug monitoring programs
• A new focus on measuring performance in healthcare systems

In February 2016, the Department of Health and Human Services (HHS) published proposed revisions to 42 CFR Part 2. The proposed rule, Confidentiality of Substance Use Disorder Patient Records, was published in the Federal Register on Feb. 9, 2016. HHS recognized the need to update these regulations and used this proposal to suggest changes. Public comments were collected until April 11, 2016, and are available on the Regulations.gov Web site.

SAMHSA hosted a webinar to give an overview of the proposed rule (NPRM):

Video: Proposed Rule Updating the Substance Abuse Confidentiality Regulations (42 CFR Part 2)
(19 minutes) (link is external)
Webinar slides – 2016 (PDF | 1.5 MB)

Final Rule

SAMHSA issued a final rule to update and modernize the Confidentiality of Alcohol and Drug Abuse Patient Records (now the Confidentiality of Substance Use Disorder Patient Records) regulations and facilitate information exchange within new health care models while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder. These modifications also help clarify the regulations and reduce unnecessary burden. On March 21, 2017, the final 42 CFR part 2 rule went into effect.

SAMHSA concurrently issued a supplemental notice of proposed rulemaking (SNPRM) that proposes additional clarifications to the part 2 regulations as amended by the final rule. Questions were raised by commenters on the proposed rule that highlighted varying interpretations of the 1987 rule’s restrictions on lawful holders and their contractors and subcontractors’ use and disclosure of part 2-covered data for purposes of carrying out payment, health care operations, and other health care-related activities. Public comments were collected on the SNPRM until February 17, 2017.

SAMHSA hosted and recorded a webinar (73 minutes) (link is external) that gives a broad overview of the Final Rule and the SNPRM available for viewing.

On January 3, 2018, SAMHSA issued a final rule based on the SNPRM.

Listening Sessions

In 2014, SAMHSA hosted a public listening session discussing concerns around 42 CFR Part 2 with stakeholders. Comments received during the listening session are posted on the SAMHSA Web site.

In January 2018, as required by Section 11002 of the 21st Century Cures Act, SAMHSA will hold a public meeting to seek input on how Part 2 impacts patient care, health outcomes, and patient privacy.

Other Resources

SAMHSA has worked closely with the Office of the National Coordinator for Health Information Technology (ONC) to develop guidance documents for behavioral health providers on applying 42 CFR Part 2:

FAQs by SAMHSA & ONC: Applying the Substance Abuse Confidentiality Regulations to Health Information Exchange (HIE) – 2010 (PDF | 381 KB)
Applying the Substance Abuse Confidentiality Regulations 42 CFR Part 2 – 2011 (PDF | 57 KB)
Disclosure of Substance Use Disorder Patient Records: Does Part 2 Apply to Me?
This fact sheet explains a 42 CFR Part 2 Program and how healthcare providers can determine how Part 2 applies to them.
Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data?
This fact sheet describes how 42 CFR Part 2 applies to the electronic exchange of healthcare records with a Part 2 Program.
SAMHSA is in the process of providing updated guidance to reflect changes made in the 2017 and 2018 rules.

In addition to federal regulations, many states have established regulations to protect health information. In these states, the state- or federal-level regulation that is most stringent is the one that applies. For more information on laws and regulations specific to behavioral health, access SAMHSA’s Laws, Regulations, and Guidelines topic.