Disclosure of Substance Use Records With Patient Consent: 50 State Comparison
This comparative map shows requirements for the disclosure of substance abuse patient records with patient consent in all 50 states plus the District of Columbia as compared to 42 CFR Part 2. The map shows if a state has stricter requirements than Part 2 (the state has requirements for consent in addition to those required by Part 2) or incorporates Part 2 by reference, therefore is controlled by Part 2. The map also shows whether a state has fewer requirements for consent than Part 2; where a state's requirements are less strict than Part 2, the Part 2 would supersede the state's requirements. Details of the requirements for disclosures are included in the details below and in the summaries of individual state laws.
Click on a state to see more information on Confidentiality of substance abuse records in that state
- Part 2 Controls
- Part 2 is Incorporated by Reference; Part 2 Controls
- Stricter than Part 2
- Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others
Hide All
| State | State Consent Requirements for Disclosure of Records as Compared with Part 2 | Details |
|---|---|---|
| Alabama | Part 2 is Incorporated by Reference; Part 2 Controls | Ala. Admin. Code r. 580-9-44-.28 Narcotic treatment programs must maintain patient records in compliance with applicable Federal and State Requirements.
Ala. Admin. Code r. 580-9-44-.29 Level I-O Opioid Programs must obtain client consent in accordance with Part 2 prior to disclosing information to a central registry and prior to taking the client’s photograph upon their admission.
Ala. Admin. Code r. 580-2-20-.04 Agencies certified by the Department of Mental Health to provide substance use disorder services must comply with state and federal confidentiality laws, including 42 C.F.R. Part 2.
Ala. Admin. Code r. 540-X-21-.03 Physicians who treat patients for addiction, but are not addiction specialists, must comply with 42 C.F.R. Part 2. |
| Alaska | Part 2 is Incorporated by Reference; Part 2 Controls | 7 AAC 72.540 Permits the Department of Health and Social Service to review the financial and medical records of a patient who has applied for financial assistance and is receiving substance abuse treatment in a federally assisted facility if the Department gives the facility 10 days notice. Clarifies that access to such records is subject to 42 C.F.R. Part 2.
7 AAC 85.200 Requires the Department of Health and Social Services to maintain the confidentiality of information they receive in accordance with 42 C.F.R. Part 2.
7 AAC 166.040 Requires Health Information Exchanges to comply with 42 C.F.R. Part 2 when applicable. |
| Arizona | Part 2 is Incorporated by Reference; Part 2 Controls | A.R.S. § 36-509 Permits health care entities to disclose information contained in records “as permitted” by 42 C.F.R. Part 2. Arizona defines “health care entities as including health care providers, the Department of Health Services, the Arizona health care cost containment system administration, and regional behavioral authorities that have contracts with the administration. |
| Arkansas | Part 2 is Incorporated by Reference; Part 2 Controls | Ark. Admin. Code 016.06.75-246.000 Requires Provider-Led Arkansas Shared Savings Entities to comply with 42 C.F.R. Part 2 when applicable. Ark. Admin. Code 016.04.2-VI Requires Methadone/Laam Treatment Programs to comply with state and federal regulations regarding confidentiality of alcohol and drug abuse information. Identifies 42 C.F.R. Part 2 as an applicable federal regulation. Ark. Admin. Code 016.04.6-4.00 Requires Office of Alcohol and Drug Abuse Prevention grantees and contractors to comply with 42 C.F.R. Part 2. Ark. Admin. Code 016.14.7-4009.0.0 Regulates the use and disclosure of health information by the Arkansas Department of Health Services; clarifies that federal law (42 C.F.R. Part 2) applies when dealing with alcohol or drug information. Ark. Admin. Code 201.00.1 Requires drug and alcohol abuse counselors to comply with 42 C.F.R. Part 2. |
| California | Part 2 Controls | West's Ann.Cal.Health & Safety Code § 11845.5 Permits alcohol and drug treatment program clients to authorize the disclosure of their information. |
| Colorado | Part 2 is Incorporated by Reference; Part 2 Controls | C.R.S.A. § 27-82-109 Requires substance abuse treatment facilities to comply with 42 C.F.R. Part 2.
C.R.S.A. § 27-82-106 Requires approved treatment facilities to notify a person’s family or next of kin of that person’s admission to the extent permissible in accordance with 42 C.F.R. Part 2.
2 CCR 502-1:21.170.3 Requires licensed behavioral health agencies to use release of information forms that comply with 42 C.F.R. Part 2. |
| Connecticut | Part 2 is Incorporated by Reference; Part 2 Controls | C.G.S.A. § 17a-688 Prohibits persons, hospitals, substance abuse treatment facilities, or the Department of Mental Health and Addiction Services from disclosing patient information if the disclosure would violate federal law and regulations (i.e. 42 C.F.R. Part 2). |
| Delaware | Part 2 is Incorporated by Reference; Part 2 Controls | 24 Del.C. § 3042 Prohibits licensed chemical dependency professionals from disclosing patient information unless authorized by 42 C.F.R, Part 2.
16 Del. Admin. Code 6001-7.0 Grants substance abuse treatment patients the right to have their information maintained in compliance with 42 C.F.R. Part 2. |
| District of Columbia | Stricter than Part 2 | DC ST § 7-3006 Classifies information provided to the Addiction Prevention and Recovery Administration (APRA) as confidential; permits clients to authorize disclosure of their information for the purposes of “Chapter 2A of this Chapter”.
29 DCMR § 2400 Requires the Department of Behavioral Health to maintain applicant information in compliance with 42 C.F.R. Part 2 and District laws that regulate the confidentiality of patient information. |
| Florida | Part 2 is Incorporated by Reference; Part 2 Controls | F.S.A. § 397.501 Classifies substance abuse records and information maintained by substance abuse treatment facilities as confidential in accordance with Florida law and federal confidentiality regulations (i.e. 42 C.F.R. Part 2).
Rule 65D-30.004, F.A.C. Requires licensed substance abuse treatment providers to comply with 42 C.F.R. Part 2.
Rule 33-507.401, F.A.C. Classifies records and information maintained by the Florida Department of Corrections that pertains to inmates receiving substance abuse treatment services as confidential in accordance with 42 U.S. Code § 290dd–2 (The authorizing legislation for 42 C.F.R. Part 2). |
| Georgia | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: Ga Comp. R. & Regs. 290-4-9-.05 ; Ga Comp. R. & Regs. 290-4-13-.08 Requires stated funded, operated, or contracted mental health and substance abuse treatment programs to comply with 42 C.F.R. Part 2 when providing substance abuse treatment services.
Part 2 Controls: Ga. Code Ann., § 37-7-166 Permits substance abuse treatment patients to authorize disclosure of their information. |
| Hawaii | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: HRS § 334-5 Makes records and information maintained in accordance with Hawaii’s mental health and substance abuse law confidential in accordance with HIPAA; clarifies that this requirement does not prohibit application of 42 C.F.R. Part 2’s more stringent protections for substance abuse information.
Part 2 Controls: Haw. Admin. Rules (HAR) § 11-175-31Makes information from mental health or substance abuse treatment clients confidential, but provides exceptions for when such information may be disclosed. These exceptions are less rigorous than 42 C.F.R. Part 2, so Part 2 controls. |
| Idaho | Part 2 is Incorporated by Reference; Part 2 Controls | IDAPA 16.05.01.250 ; IDAPA 16.07.17.410 Permits the disclosure of substance abuse treatment records in accordance with 42 C.F.R. Part 2. |
| Illinois | Part 2 is Incorporated by Reference; Part 2 Controls | 20 ILCS 301/30-5 ; 89 Ill. Adm. Code 431.105 ; 77 Ill. Adm. Code 2060.319 Classifies substance abuse records and information as confidential in accordance with 42 C.F.R. Part 2. |
| Indiana | Part 2 is Incorporated by Reference; Part 2 Controls | IC 16-39-1-9 Prohibits disclosure of substance abuse treatment records unless authorized by 42 U.S.C. 290dd-2 (The authorizing legislation for 42 C.F.R. Part 2). |
| Iowa | Part 2 is Incorporated by Reference; Part 2 Controls | I.C.A. § 125.93; Iowa Admin. Code 641-156.3; Iowa Admin. Code 641-157.6; Iowa Admin. Code 641-155.21; Iowa Admin. Code 641-155.35 Requires substance abuse treatment programs to comply with 42 C.F.R. Part 2. |
| Kansas | Stricter than Part 2 | K.S.A. 59-29b79 Permits the head of a substance abuse treatment facility to refuse to disclose portions of a patient’s record if they believe the disclosure would harm the patient’s welfare. |
| Kentucky | Part 2 is Incorporated by Reference; Part 2 Controls | 902 Ky. Admin. Regs. 20:091 Requires community mental health centers to comply with 42 C.F.R. Part 2 to the extent that federal law requires compliance with such part. Grants centers permission to impose more stringent requirements than part 2 requires.
908 Ky. Admin. Regs. 1:320 Requires federally assisted substance abuse agencies to comply with 42 C.F.R. Part 2. |
| Louisiana | Part 2 is Incorporated by Reference; Part 2 Controls | LSA-R.S. 13:3715.1Requires federally assisted substance abuse treatment providers to comply with 42 C.F.R. Part 2.
La. Admin Code. tit. 48, Pt I, § 4949 Requires health care providers to maintain confidentiality of consumer information; permits disclosure in compliance with 42 C.F.R. Part 2. |
| Maine | Part 2 is Incorporated by Reference; Part 2 Controls | 22 M.R.S.A. § 1711-C; 10-144 CMR Ch. 101, Ch. II, § 80 Requires health care practitioners and facilities subject to 42 C.F.R. Part 2 to comply with Part 2’s authorization requirements. |
| Maryland | Part 2 is Incorporated by Reference; Part 2 Controls | MD Code, Health - General, § 8-601; MD Code, Health - General, § 24-906; COMAR 10.47.01.08 Requires substance abuse treatment programs to maintain and disclose records in compliance with 42 C.F.R. Part 2. |
| Massachusetts | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others | Stricter than Part 2: M.G.L.A. 111B § 11 Classifies records of patients receiving detoxification services as confidential; prohibits disclosure absent a court order.
Incorporates by Reference: M.G.L.A. 111E § 18; 104 CMR 27.18; 105 CMR 164.084 Requires facilities that provide drug abuse treatment services to maintain confidential records; authorizes disclosure of these records in accordance with federal law. |
| Michigan | Part 2 Controls | M.C.L.A. 330.1262 Authorizes persons receiving substance use disorder services to consent in writing to the disclosure of their information. |
| Minnesota | Part 2 is Incorporated by Reference; Part 2 Controls | Minnesota Rules, part 9530.6585 Requires licensed chemical dependency programs to maintain records in compliance with 42 C.F.R. Part 2. |
| Mississippi | Part 2 Controls | Miss. Code Ann. § 41-30-33 Authorizes substance abuse treatment facilities to disclose information with consent. |
| Missouri | Part 2 is Incorporated by Reference; Part 2 Controls | 9 Mo. Code of State Regulations 10-7.020 Grants substance use disorder patients the right to have their information maintained confidentially in compliance with federal and state law. |
| Montana | Part 2 Controls | Mont.Admin.R. 37.106.1450 Requires chemical dependency facilities to obtain client consent before disclosing information. |
| Nebraska | Part 2 is Incorporated by Reference; Part 2 Controls | Neb Ct. R. § 6-1208 Requires individuals to sign a consent form that complies with 42 C.F.R. Part 2 prior to participating in a problem-solving court.
Neb. Admin. R. & Regs. Tit. 172, Ch. 15, § 016 Requires licensed alcohol and drug counselors to comply with 42 C.F.R. Part 2. |
| Nevada | Part 2 is Incorporated by Reference; Part 2 Controls | NAC 458.163; NAC 458.272 Requires substance abuse programs to comply with 42 C.F.R. Part 2. |
| New Hampshire | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: N.H. Code Admin. R. He-A 304.18 Requires opioid treatment programs to maintain client information in compliance with 42 C.F.R. Part 2.
Part 2 Controls: N.H. Rev. Stat. § 172:8-a Requires substance use treatment facilities to obtain written consent to in order to disclose patient records. |
| New Jersey | Part 2 is Incorporated by Reference; Part 2 Controls | N.J.S.A. 26:2B-15; N.J.S.A. 26:2G-25 Requires substance use treatment facilities to provide notice of admission to the family, guardian, or emergency contact of a newly admitted person; Requires such notice to comply with 42 C.F.R. Part 2.
N.J.S.A. 45:2D-11; N.J.A.C. 10:161B–16.2; N.J.A.C. 10:161B–18.1 Requires licensed alcohol and drug counselors and substance abuse treatment facilities to comply with 42 C.F.R. Part 2. |
| New Mexico | Part 2 is Incorporated by Reference; Part 2 Controls | N.M. Admin. Code 7.32.8 Requires opioid treatment facilities to comply with 42 C.F.R. Part 2. |
| New York | Part 2 is Incorporated by Reference; Part 2 Controls | 14 NYCRR 815.4 Requires substance abuse providers and programs to comply with 42 C.F.R. Part 2.
NY Mental Hygiene Law § 22.05 Requires chemical dependence programs and facilities to maintain the confidentiality of client records; permits disclosure in accordance with relevant state or federal laws or pursuant to a court order. |
| North Carolina | Part 2 is Incorporated by Reference; Part 2 Controls | N.C.G.S.A. § 122C-52; N.C.G.S.A. § 122C-53; N.C.G.S.A. § 122C-54; 10A NCAC 26B.0102 Prohibits mental health and substance abuse treatment facilities from disclosing confidential information unless in accordance with North Carolina law; Clarifies that disclosure of substance abuse information is subject to 42 C.F.R. Part 2 unless a more restrictive NC rule exists.
21 NCAC 68.0508 Requires licensed substance abuse professionals to comply with 42 C.F.R. Part 2. |
| North Dakota | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: Rule 19, N.D.R.Juv.P. Permits drug and alcohol treatment records that are protected by 42 C.F.R. Part 2 to be disclosed during a juvenile court proceeding if the person who is the subject of the record consents to the disclosure.
Part 2 Controls: NDAC 75-09.1-01-21Requires substance abuse treatment programs to obtain client consent prior to releasing confidential information. |
| Ohio | Part 2 is Incorporated by Reference; Part 2 Controls | OAC 5122-1-04 Requires the Department of Mental Health and Addiction Services to maintain the confidentiality of personal information in compliance with 42 C.F.R. Part 2.
OAC 5122-26-08 Requires mental health and substance abuse providers to comply with applicable federal and state confidentiality laws, including 42 C.F.R. Part 2. |
| Oklahoma | Stricter than Part 2 | 43A Okl.St.Ann. § 1-109 Permits patients to consent to the disclosure of information relating to their substance abuse treatment by providing written authorization; Limits the type of information that a patient may personally access. |
| Oregon | Part 2 is Incorporated by Reference; Part 2 Controls | OAR 309-019-0115; OAR 309-019-0135; OAR 415-057-0030 Requires outpatient behavioral health services providers, opioid treatment programs, and prison based substance abuse programs to comply with 42 C.F.R. Part 2. |
| Pennsylvania | Stricter than Part 2 | 4 Pa. Code § 255.5; 71 P.S. § 1690.108; 29 Pa. Code § 709.28; 55 Pa. Code § 5100.37'; 55 Pa. Code § 5230.17; 28 Pa. Code § 711.93; 28 Pa. Code § 710.23; 28 Pa. Code § 711.83; 28 Pa. Code § 711.72; 28 Pa. Code § 711.62; 28 Pa. Code § 711.53; 28 Pa. Code § 711.43 Requires substance abuse treatment clients to consent to the disclosure of their information; establishes restrictions on the type of information that may be disclosed and the people or entities that may receive the information. |
| Rhode Island | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: 210-RICR- 10-05-1.3 Identifies 42 C.F.R. Part 2 as one of the laws that the Executive Office of Health and Human Services must comply with while administering Rhode Island’s Medicaid Program. Gen.Laws 1956, § 5-69-10 Requires licensed chemical dependency professionals to comply with 42 C.F.R. Part 2.
Part 2 Controls: Gen.Laws 1956, § 5-37.3-4 Classifies health care information as confidential; authorizes disclosure with a patient’s consent. The statute applies to all health care information and is less stringent than 42 C.F.R. Part 2, so Part 2 controls. |
| South Carolina | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: S.C. Code of Regulations R. 61-93.703 Requires substance abuse treatment facilities to maintain records in compliance with state and federal law.
Part 2 Controls: Code 1976 § 44-22-100 Classifies records and information regarding persons receiving mental health or substance abuse treatment as confidential; permits disclosure with patient consent. The provision does not address the form of the consent, so 42 C.F.R. Part 2 controls. |
| South Dakota | Part 2 is Incorporated by Reference; Part 2 Controls | ARSD 67:61:06:02 Grants substance use disorder patients the right to have their information maintained confidentially in compliance with 42 C.F.R. Part 2. |
| Tennessee | Part 2 is Incorporated by Reference; Part 2 Controls | Tenn. Comp. R. & Regs. 0940-05-35-.18; Tenn. Comp. R. & Regs. 0940-05-42-.27 Requires opioid treatment programs to maintain client information in compliance with 42 C.F.R. Part 2. |
| Texas | Part 2 is Incorporated by Reference; Part 2 Controls | 25 TAC § 229.148; 37 TAC § 353.508 Requires narcotic treatment programs and substance abuse treatment facilities to maintain client information in compliance with 42 C.F.R.
37 TAC § 380.9909 Makes substance abuse treatment information regarding youth committed to the Texas Juvenile Justice Department subject to 42 C.F.R. Part 2. |
| Utah | Part 2 is Incorporated by Reference; Part 2 Controls | U.C.A. 1953 § 58-60-509 Prohibits licensed substance abuse counselors from disclosing client information unless the client consents; clarifies that this prohibition does not apply if state or federal laws permit or require disclosure. |
| Vermont | Part 2 is Incorporated by Reference; Part 2 Controls | Vt. Admin. Code 12-5-102:6.0 Requires opioid treatment programs to obtain authorizations to release information for care coordination purposes to the extent permissible pursuant to 42 C.F.R. Part 2; Requires such programs to comply with Part 2 when exchanging information. |
| Virginia | Part 2 is Incorporated by Reference; Part 2 Controls | 12 VAC 35-115-80 Requires providers licensed by the Department of Behavioral Health and Developmental Services to comply with 42 C.F.R. Part 2.
VA Code Ann. § 32.1-127.1:03 Permits health care entities to disclose substance abuse records when permitted by 42 C.F.R. Part 2; defines health care entities as hospitals and nursing homes. |
| Washington | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: IWAC 246-341-0800 Requires agencies that provide court ordered substance use disorder treatment to develop release of information forms that comply with 42 C.F.R. Part 2.
Part 2 Controls: RCWA 70.02.230 Authorizes the Department of Health and Social Services and Washington state health care authority to disclose information within their agency as a means of coordinating mental health or substance abuse treatment; permits these agencies to disclose information with each other and the Department of Children, Youth, and Families in order to coordinate treatment; permits disclosure of information to providers for care coordination and billing purposes; clarifies that such disclosures require authorization if the information regards substance abuse treatment. These requirements are less stringent than 42 C.F.R. Part 2, so Part 2 controls. |
| West Virginia | Part 2 is Incorporated by Reference; Part 2 Controls | W. Va. Code St. R. § 69-11-19 Requires opioid treatment programs to develop policies that guarantee clients the right to confidentiality in accordance with 42 C.F.R. Part 2. |
| Wisconsin | Part 2 is Incorporated by Reference; Part 2 Controls | W.S.A. 51.30; Wis. Adm. Code § DHS 92.04 Requires health care providers that are subject to 42 C.F.R. Part 2 to maintain substance abuse records and information in accordance with Part 2. |
| Wyoming | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: WY Rules and Regulations 048.0054.4 § 2; WY Rules and Regulations 048.0018.5 § 2; WY Rules and Regulations 048.0018.6 § 3; WY Rules and Regulations 048.0018.6 § 4 Requires substance abuse treatment programs to comply with 42 C.F.R. Part 2. WY Rules and Regulations 048.0054.8 § 12 Requires Court Supervised Treatment Programs to obtain information releases from participants in accordance with 42 C.F.R. Part 2
Part 2 Controls: W.S.1977 § 9-2-125 Classifies records regarding persons receiving mental health or substance abuse treatment from a provider under contract with the Department of Health as confidential; authorizes disclosure of these records with patient consent. |
.png)