Disclosure of Substance Use Records Without Patient Consent: 50 State Comparison
This comparative map shows requirements for the disclosure of substance abuse patient records without patient consent in all 50 states plus the District of Columbia as compared to 42 CFR Part 2. The map shows if a state has stricter requirements than Part 2 (the state has requirements for consent in addition to those required by Part 2) or incorporates Part 2 by reference, therefore is controlled by Part 2. The map also shows whether a state has fewer requirements for consent than Part 2; where a state's requirements are less strict than Part 2, the Part 2 would supersede the state's requirements. Some states do not have laws regarding the disclosure of substance use records without patient consent. Details of the requirements for disclosures are included in the details below and in the summaries of individual state laws.
Click on a state to see more information on Confidentiality of substance abuse records in that state
- Part 2 Controls
- Part 2 is Incorporated by Reference; Part 2 Controls
- Stricter than Part 2
- Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others
- No law on point
Hide All
| State | State Consent Requirements for Disclosure of Records as Compared with Part 2 | Details |
|---|---|---|
| Alabama | Part 2 is Incorporated by Reference; Part 2 Controls | Ala. Admin. Code r. 580-9-44-.28 Narcotic treatment programs must maintain patient records in compliance with applicable Federal and State Requirements. Ala. Admin. Code r. 580-2-20-.04 Agencies certified by the Department of Mental Health to provide substance use disorder services must comply with state and federal confidentiality laws, including 42 C.F.R. Part 2. Ala. Admin. Code r. 540-X-21-.03 Physicians who treat patients for addiction, but are not addiction specialists, must comply with 42 C.F.R. Part 2. |
| Alaska | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others | Stricter than Part 2: 7 AAC 85.205 The Department of Health and Social Services may only disclose non identifying aggregate data to the provider that submitted the data, for research purposes, or for oversight and evaluation purposes. These permissible disclosures may include identifying information only if authorized by 42 C.F.R. Part 2. AS § 47.37.210 Permits treatment facilities to disclose patient information for research purposes; or—subject to federal laws or regulations—to judges, agencies, prosecutors, or defendants if the patient is receiving court ordered treatment.
Incorporates by Reference: 7 AAC 166.040 Requires Health Information Exchanges to comply with 42 C.F.R. Part 2 when applicable. |
| Arizona | Part 2 is Incorporated by Reference; Part 2 Controls | A.R.S. § 36-509 Permits health care entities to disclose information contained in records “as permitted” by 42 C.F.R. Part 2. Arizona defines “health care entities as including health care providers, the Department of Health Services, the Arizona health care cost containment system administration, and regional behavioral authorities that have contracts with the administration. |
| Arkansas | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others | Stricter than Part 2: Ark. Admin. Code 016.04.4-28 Permits alcohol and drug abuse treatment programs to release “pertinent medical information” to the providers responsible for an individuals’ care without the consent of the individual and without authorization from the Chief Executive Officer if (1) there is a life threatening situation; or (2) the individual is unable to consent because of their condition or situation.
Incorporates by Reference: Ark. Admin. Code 016.06.75-246.000 Requires Provider-Led Arkansas Shared Savings Entities to comply with 42 C.F.R. Part 2 when applicable. Ark. Admin. Code 016.04.2-VI Requires Methadone/Lama Treatment Programs to comply with state and federal regulations regarding confidentiality of alcohol and drug abuse information. Identifies 42 C.F.R. Part 2 as an applicable federal regulation. Ark. Admin. Code 016.04.6-4.00 Requires Office of Alcohol and Drug Abuse Prevention grantees and contractors to comply with 42 C.F.R. Part 2. Ark. Admin. Code 016.14.7-4009.0.0 Regulates the use and disclosure of health information by the Arkansas Department of Health Services; clarifies that federal law. Ark. Admin. Code 201.00.1 Requires drug and alcohol abuse counselors to comply with 42 C.F.R. Part 2. |
| California | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others | Stricter than Part 2: 15 CAR § 3999.217 Prohibits the disclosure of substance abuse or alcohol treatment records unless disclosure occurs pursuant to a patient’s authorization, a court order, or a search warrant; Provision applies to substance abuse services provided to patients under the care of the California Department of Corrections.
Part 2 Controls: Ann.Cal.Health & Safety Code § 11845.5 Permits disclosure of substance abuse treatment information without consent in a medical emergency, for research and audit purposes, provided that patient-identifying information is not published, and for treatment purposes between providers in the same facility. |
| Colorado | Stricter than Part 2 | C.R.S.A. § 27-81-113; C.R.S.A. § 27-82-109 Classifies alcohol and substance abuse treatment facility records as confidential and privileged to the patient. Permits facility directors to disclose information for research purposes so long as patient identifying information is not published. |
| Connecticut | Part 2 is Incorporated by Reference; Part 2 Controls | C.G.S.A. § 17a-688 Prohibits persons, hospitals, substance abuse treatment facilities, or the Department of Mental Health and Addiction Services from disclosing patient information if the disclosure would violate federal law and regulations (i.e. 42 C.F.R. Part 2); Permits the Commissioner to disclose information for research, evaluation, and audit purposes. |
| Delaware | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others | Stricter than Part 2: 16 Del.C. § 2220 Prohibits substance abuse treatment facilities from dislocating patient records without authorization unless disclosure is necessary during the patient’s transfer to another facility, required by law, or required by a third party payment contract. Prohibits release of records to persons that have “no demonstrable need” for the records.
Incorporates by Reference: 16 Del. Admin. Code 6001-7.0 Grants substance abuse treatment patients the right to have their information maintained in compliance with 42 C.F.R. Part 2. |
| District of Columbia | Stricter than Part 2 | DC ST § 7-3006 Permits the disclosure of information provided to the Addiction Prevention and Recovery Administration (APRA) to medical personnel for diagnosis and treatment purposes; prohibits any other disclosures without patient authorization. 29 DCMR § 2400 Requires the Department of Behavioral Health to maintain applicant information in compliance with 42 C.F.R. Part 2 and District laws that regulate the confidentiality of patient information. |
| Florida | Part 2 is Incorporated by Reference; Part 2 Controls | F.S.A. § 397.501 Classifies substance abuse records and information as maintained by substance abuse treatment facilities confidential in accordance with Florida law and federal confidentiality regulations (i.e. 42 C.F.R. Part 2). Rule 65D-30.004, F.A.C.) Requires licensed substance abuse treatment providers to comply with 42 C.F.R. Part 2. Rule 33-507.401, F.A.C. Classifies records and information maintained by the Florida Department of Corrections that pertains to inmates receiving substance abuse treatment services as confidential in accordance with 42 U.S. Code § 290dd–2 (The authorizing legislation for 42 C.F.R. Part 2). |
| Georgia | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: Ga Comp. R. & Regs. 290-4-9-.05; Ga Comp. R. & Regs. 290-4-13-.08 Requires stated funded, operated, or contracted mental health and substance abuse treatment programs to comply with 42 C.F.R. Part 2 when providing substance abuse treatment services.
Part 2 Controls: Ga. Code Ann., § 37-7-166 Permits disclosure of substance abuse treatment information without consent in a medical emergency, to law enforcement personnel in connection with a crime or threatened crime on the facility premises or against facility personnel, to provider personnel within a facility for treatment purposes, or between facilities when a patient is transferred (note that disclosure between facilities when a patient is transferred is not permitted by 42 C.F.R. Part 2). |
| Hawaii | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: HRS § 334-5 Makes records and information maintained in accordance with Hawaii’s mental health and substance abuse law confidential in accordance with HIPAA; clarifies that this requirement does not prohibit application of 42 C.F.R. Part 2’s more stringent protections for substance abuse information.
Part 2 Controls:
Haw. Admin. Rules (HAR) § 11-175-31 Makes information from mental health or substance abuse treatment clients confidential, but provides exceptions for when such information may be disclosed. These exceptions are less rigorous than 42 C.F.R. Part 2, so Part 2 controls.
|
| Idaho | Stricter than Part 2 | I.C. § 37-3102; IDAPA 16.05.01.250 Prohibits physicians or their employees from reporting or disclosing to law enforcement that a person has requested or undertaken substance abuse treatment. |
| Illinois | Part 2 is Incorporated by Reference; Part 2 Controls | 20 ILCS 301/30-5; 89 Ill. Adm. Code 431.105; 89 Ill. Adm. Code 431.105 Classifies substance abuse records and information as confidential in accordance with 42 C.F.R. Part 2. |
| Indiana | Part 2 is Incorporated by Reference; Part 2 Controls | IC 16-39-1-9 Prohibits disclosure of substance abuse treatment records unless authorized by 42 U.S.C. 290dd-2. |
| Iowa | Stricter than Part 2 | I.C.A. § 125.37 Limits disclosure of substance abuse treatment records without authorization to disclosures for research purposes, disclosures during a medical emergency, and, unless prohibited by federal law, disclosures for care coordination purposes. |
| Kansas | Part 2 Controls | K.S.A. 59-29b79 Authorizes disclosures without consent for emergency treatment purposes, research, audit and evaluation, and to the Kansas bureau of investigation for gun purchase background checks. Note that 42 C.F.R. Part 2 does not permit such firearm purchase disclosures, so Part 2 will control for federally assisted substance abuse treatment providers. |
| Kentucky | Part 2 is Incorporated by Reference; Part 2 Controls | 902 Ky. Admin. Regs. 20:091 Requires community mental health centers to comply with 42 C.F.R. Part 2 to the extent that federal law requires compliance with such part. Grants centers permission to impose more stringent requirements than part 2 requires. 908 Ky. Admin. Regs. 1:320 Requires federally assisted substance abuse agencies to comply with 42 C.F.R. Part 2. |
| Louisiana | Part 2 is Incorporated by Reference; Part 2 Controls | LSA-R.S. 13:3715.1 Requires federally assisted substance abuse treatment providers to comply with 42 C.F.R. Part 2. La. Admin Code. tit. 48, Pt I, § 4949 Requires health care providers to maintain confidentiality of consumer information; permits disclosure in compliance with 42 C.F.R. Part 2. |
| Maine | Stricter than Part 2 | Stricter than Part 2: 5 M.R.S.A. § 20047 Classifies alcohol and substance abuse treatment facility records as confidential and privileged to the patient. Permits facility directors to disclose information for research purposes so long as patient identifying information is not published; Permits methadone treatment records that have been entered into the Controlled Substances Prescription Monitoring Program to be disclosed for emergency treatment purposes.
Incorporates by Reference: 22 M.R.S.A. § 1711-C; 10-144 CMR Ch. 101, Ch. II, § 80 Requires health care practitioners and facilities subject to 42 C.F.R. Part 2 to comply with Part 2. |
| Maryland | Part 2 is Incorporated by Reference; Part 2 Controls | MD Code, Health - General, § 8-601; MD Code, Health - General, § 24-906; COMAR 10.47.01.08 Requires substance abuse treatment programs to maintain and disclose records in compliance with 42 C.F.R. Part 2. |
| Massachusetts | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others | Stricter than Part 2: M.G.L.A. 111B § 11 Classifies records of patients receiving detoxification services as confidential; prohibits disclosure absent a court order.
Incorporates by Reference: M.G.L.A. 111E § 18; 104 CMR 27.18; 105 CMR 164.084 Requires facilities that provide drug abuse treatment services to maintain confidential records; authorizes disclosure of these records in accordance with federal law. |
| Michigan | Part 2 is Incorporated by Reference; Part 2 Controls | M.C.L.A. 330.1263 Permits disclosure of substance abuse records without consent for emergency treatment, research, or evaluation and auditing purposes. |
| Minnesota | Part 2 is Incorporated by Reference; Part 2 Controls | Minnesota Rules, part 9530.6585 Requires licensed chemical dependency programs to maintain records in compliance with 42 C.F.R. Part 2. |
| Mississippi | Part 2 Controls | Miss. Code Ann. § 41-30-33 Authorizes disclosures without consent for treatment purposes and to a person’s legal counsel if they are subject to a commitment hearing related to their substance use.
These disclosures are impossible under 42 C.F.R. Part 2, so Part 2 controls. |
| Missouri | Part 2 is Incorporated by Reference; Part 2 Controls | 9 Mo. Code of State Regulations 10-7.020 Grants substance use disorder patients the right to have their information maintained confidentially in compliance with federal and state law. |
| Montana | Stricter than Part 2 | MCA 53-24-306 Classifies records regarding chemically dependent or intoxicated persons as confidential; Permits disclosures without authorization for research purposes (MCA 53-24-306). |
| Nebraska | Part 2 is Incorporated by Reference; Part 2 Controls | Neb. Admin. R. & Regs. Tit. 172, Ch. 15, § 016 Requires licensed alcohol and drug counselors to comply with 42 C.F.R. Part 2. |
| Nevada | Part 2 Controls | N.R.S. 458.280 Classifies the registration and records regarding a person placed in civil protective custody at a treatment facility due to public intoxication as confidential; prohibits disclosures without authorization. Provides an exception for research disclosures and disclosures in accordance with other provisions of the Nevada law. These exceptions are less stringent than 42 C.F.R. Part 2, so Part 2 controls. |
| New Hampshire | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: N.H. Code Admin. R. He-A 304.18 Requires opioid treatment programs to maintain client information in compliance with 42 C.F.R. Part 2.
Part 2 Controls: N.H. Rev. Stat. § 172:8-a Permits substance use treatment facilities or programs to disclose patient records without consent for research, statistical, or medical purposes. |
| New Jersey | Part 2 is Incorporated by Reference; Part 2 Controls | N.J.S.A. 45:2D-11; N.J.A.C. 10:161B–16.2; N.J.A.C. 10:161B–18.1 Requires licensed alcohol and drug counselors and substance abuse treatment facilities to comply with 42 C.F.R. Part 2. |
| New Mexico | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others | Stricter than Part 2: N.M.S.A. 1978, § 43-2-11 Prohibits treatment facilities from disclosing records regarding persons that voluntarily seek substance abuse treatment unless they obtain that person’s consent or receive a court order.
Incorporates by Reference: N.M. Admin. Code 7.32.8 Requires opioid treatment facilities to comply with 42 C.F.R. Part 2.
Note: The more stringent provision is limited to detox in accordance with article 2 of title 43. The SUD treatment facilities listed on NM’s website state that disclosures without authorization are ok to report crimes on the premises, during a medical emergency, or to report abuse/neglect. |
| New York | Part 2 is Incorporated by Reference; Part 2 Controls | 14 NYCRR 815.4 Requires substance abuse providers and programs to comply with 42 C.F.R. Part 2. NY Mental Hygiene Law § 22.05 Requires chemical dependence programs and facilities to maintain the confidentiality of client records; permits disclosure in accordance with relevant state or federal laws or pursuant to a court order. |
| North Carolina | Part 2 is Incorporated by Reference; Part 2 Controls | N.C.G.S.A. § 122C-52; N.C.G.S.A. § 122C-53; N.C.G.S.A. § 122C-53; 10A NCAC 26B.0102 Prohibits mental health and substance abuse treatment facilities from disclosing confidential information unless in accordance with North Carolina law; Clarifies that disclosure of substance abuse information is subject to 42 C.F.R. Part 2 unless a more restrictive NC rule exists. |
| North Dakota | No law on point | No Law. |
| Ohio | Part 2 Controls | R.C. § 5119.27 Permits substance abuse facilities to disclose information without consent for the purposes of scientific research, audits, or program evaluation. |
| Oklahoma | Part 2 Controls | 43A Okl.St.Ann. § 1-109 Permits substance use treatment facilities or programs to disclose patient information without consent for the purpose of research, audits/evaluation, reporting of child abuse, and provision of emergency treatment. |
| Oregon | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others | Stricter than Part 2: O.R.S. § 430.399 Prohibits sobering facilities or treatment facilities from disclosing a patient’s records without their consent. Provides a limited exception so that facilities may notify the parents or guardian of a minor or incompetent patient about the patient’s admission. Note that this provision applies only to persons that are brought to a facility after being detained by a police officer for public intoxication.
Incorporates by Reference: OAR 309-019-0115; OAR 309-019-0135; OAR 415-057-0030 Requires outpatient behavioral health services providers, opioid treatment programs, and prison based substance abuse programs to comply with 42 C.F.R. Part 2. |
| Pennsylvania | Stricter than Part 2 | 71 P.S. § 1690.108; 4 Pa. Code § 255.5 Requires patients to consent to the disclosure of their substance use treatment information; provides an exception for disclosures that are necessary to provide emergency medical treatment to the patient. |
| Rhode Island | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others |
Stricter than Part 2: Gen.Laws 1956, § 23-1.10-13 Classifies records of intoxicated persons who are admitted to a treatment facility as confidential and privileged; permits disclosure without consent for research regarding alcoholism provided no identifying information is published. Note that this restriction only applies to persons receiving treatment pursuant to Rhode Island’s laws regarding alcohol abuse.
Incorporates by Reference: 210-RICR- 10-05-1.3 Identifies 42 C.F.R. Part 2 as one of the laws that the Executive Office of Health and Human Services must comply with while administering Rhode Island’s Medicaid Program. Gen.Laws 1956, § 5-69-10 Requires licensed chemical dependency professionals to comply with 42 C.F.R. Part 2.
Part 2 Controls: Gen.Laws 1956, § 5-37.3-4 Classifies health care information as confidential; specifies when providers may disclose information without consent. These circumstances are more permissive than 42 C.F.R. Part 2, so Part 2 controls.
|
| South Carolina | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others | Stricter than Part 2: Code 1976 § 44-22-100 Classifies records and information regarding persons receiving mental health or substance abuse treatment as confidential; permits disclosure for research purposes so long as the project is authorized or conducted by one of South Carolina's health departments and the patient consents; authorizes disclosures to state or federal agencies when necessary to further the welfare of the patient or their family; authorizes disclosures necessary to carry out the provisions of South Carolina's mental health and substance abuse laws.
Incorporates by Reference: S.C. Code of Regulations R. 61-93.703 Requires substance abuse treatment facilities to maintain records in compliance with state and federal law. |
| South Dakota | Part 2 is Incorporated by Reference; Part 2 Controls | ARSD 67:61:06:02 Grants substance use disorder patients the right to have their information maintained confidentially in compliance with 42 C.F.R. Part 2. |
| Tennessee | Some Provisions Stricter than Part 2; Part 2 Incorporated by Reference in Others | Stricter than Part 2: T. C. A. § 33-10-408 Classifies records of intoxicated persons who are admitted to a treatment facility as confidential and privileged; permits disclosure without consent for research regarding alcoholism provided no identifying information is published. Note that this restriction only applies to persons receiving treatment pursuant to Tennessee’s laws regarding alcohol abuse.
Incorporates by Reference: Tenn. Comp. R. & Regs. 0940-05-35-.18; Tenn. Comp. R. & Regs. 0940-05-42-.27 Requires opioid treatment programs to maintain client information in compliance with 42 C.F.R. Part 2. |
| Texas | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: 25 TAC § 229.148; 37 TAC § 353.508 Requires narcotic treatment programs and substance abuse treatment facilities to maintain client information in compliance with 42 C.F.R. Part 2. 37 TAC § 380.9909 Makes substance abuse treatment information regarding youth committed to the Texas Juvenile Justice Department subject to 42 C.F.R. Part 2.
Part 2 Controls: V.T.C.A., Health & Safety Code § 611.004 Specifies the circumstances in which mental health professionals may disclose confidential patient information. These circumstances are less stringent than 42 C.F.R. Part 2, so Part 2 will control. Note that Texas defines patient for the purposes of this chapter as someone seeking substance abuse treatment. |
| Utah | Part 2 is Incorporated by Reference; Part 2 Controls | U.C.A. 1953 § 58-60-509 Prohibits licensed substance abuse counselors from disclosing client information unless the client consents; clarifies that this prohibition does not apply if state or federal laws permit or require disclosure. |
| Vermont | No law on point | No law. |
| Virginia | Part 2 is Incorporated by Reference; Part 2 Controls | 12 VAC 35-115-80 Requires providers licensed by the Department of Behavioral Health and Developmental Services to comply with 42 C.F.R. Part 2. VA Code Ann. § 32.1-127.1:03 Permits health care entities to disclose substance abuse records when permitted by 42 C.F.R. Part 2; defines health care entities as hospitals and nursing homes. |
| Washington | No law on point | No law. |
| West Virginia | Part 2 is Incorporated by Reference; Part 2 Controls | W. Va. Code St. R. § 69-11-19 Requires opioid treatment programs to develop policies that guarantee clients the right to confidentiality in accordance with 42 C.F.R. Part 2. |
| Wisconsin | Part 2 is Incorporated by Reference; Part 2 Controls | W.S.A. 51.30; Wis. Adm. Code § DHS 92.04 Requires health care providers that are subject to 42 C.F.R. Part 2 to maintain substance abuse records and information in accordance with Part 2. |
| Wyoming | Part 2 is Incorporated by Reference; Part 2 Controls | Incorporates by Reference: WY Rules and Regulations 048.0054.4 § 2; WY Rules and Regulations 048.0018.5 § 2; WY Rules and Regulations 048.0018.6 § 3; WY Rules and Regulations 048.0018.6 § 4 Requires substance abuse treatment programs to comply with 42 C.F.R. Part 2.
Part 2 Controls: W.S.1977 § 9-2-125 Classifies records regarding persons receiving mental health or substance abuse treatment from a provider under contract with the Department of Health as confidential; specifies the circumstances in which these records may be disclosed without patient consent. These circumstances are more expansive than 42 C.F.R. Part 2, so Part 2 controls. |
.png)