Skip to Content

42 CFR Part 2

Topics: 
Care Coordination/Care Management
Federal and State Program Integrity
Medical Records Collection, Retention, and Access
Privacy and Confidentiality
Quality Measurement and Reporting
Research
Security of Health Information

Part 2: An Overview

42 CFR Part 2 (commonly referred to as "Part 2") are the federal regulations governing the confidentiality of drug and alcohol abuse treatment and prevention records. The regulations set forth requirements applicable to certain federally assisted substance abuse treatment programs limiting the use and disclosure of substance abuse patient records and identifying information. These regulations were enacted in 1987 by the Secretary of the US Department of Health and Human Services (HHS) as authorized by both the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970 and the Drug Abuse Prevention, Treatment, and Rehabilitation Act of 1972. These Acts and the Part 2 regulations provide comprehensive privacy protections in an effort to encourage people to seek treatment for substance abuse problems.

Part 2 sets forth the limited circumstances in which substance abuse patient information may be used or disclosed, and no uses or disclosures other than those detailed in the regulations are permitted.

  • A complete overview of the entire Part 2 regulatory text is here

Generally, written patient consent is required to disclose the patient's records. A written consent must contain certain elements and be narrowly tailored to limit disclosure to the specific parameters in the consent. There are exceptions to the consent requirement, which permit programs to disclose or use substance abuse patient information:

  • In the course of internal program communications;
  • In a communication with a Qualified Service Organization (an outside organization that provides services to the program, such as dosage preparation or lab analysis);
  • In medical emergencies;
  • In response to a crime against program personnel or on program premises (or threats to commit such a crime);
  • For research activities;
  • For audit and evaluation activities;
  • To report suspected child abuse or neglect;
  • In circumstances involving certain minors or incompetent patients; and
  • In response to a valid court order. 

All of these exceptions have very specific requirements and are limited in scope. 

  • A one-pager Fast Facts on consent requirements for Part 2 is here.
  • A one-pager Myth Buster breaking down the common myth that substance abuse information can never be disclosed without a patient's written consent is here

Types of providers covered by Part 2

Not all programs are subject to Part 2 regulations - only a federally assisted program that holds itself out as providing, and does provide, alcohol or drug abuse treatment, diagnosis, or referral for treatment is subject to Part 2.

Providing substance abuse services. If, for example, a hospital emergency room that does not provide or publicly hold itself out as a provider of substance abuse treatment, diagnosis, or referral, the fact that an emergency room physician refers a patient to the hospital's intensive care unit to treat a drug overdose does not make the Part 2 requirements applicable to the hospital or to that physician. It is both the provision of substance abuse services and the holding oneself out as a provider of such services that is required for Part 2 to apply. 

Federal assistance. Only federally assisted programs are subject to the Part 2 regulations. The definition of a federally assisted program is quite broad and includes programs:

  • Authorized, certified, licensed, or registered by the federal government;
  • Receiving federal funds in any form, including funds that do not directly pay for substance abuse services;
  • Granted tax-exempt status by the IRS;
  • Allowed tax deductions for contributions by the IRS;
  • Authorized to conduct business by the federal government, including programs:
    • Certified as a Medicare provider;
    • Authorized to conduct methadone maintenance treatment;
    • Registered with the DEA;
  • Conducted directly by the federal government.

The definition of a federally assisted program encompasses nearly all substance abuse programs - only those for-profit programs and private practitioners who see only the privately insured or self-paying patients do not fall within the definition of a federally assisted program.

Relationship with other laws

There are other laws governing the privacy of patient identifying information that apply to substance abuse program records. For example, HIPAA is a federal law that sets minimum privacy protections for "covered entities" - health plans, health care clearinghouses, and most providers, and many states have laws governing substance abuse program records. Substance abuse providers subject to Part 2 must comply with all applicable privacy requirements wherever possible - however, if a state or federal law conflicts with a Part 2 requirement (e.g., prohibits a disclosure that Part 2 permits, or vice versa), the provider must comply with whichever law is most restrictive.

  • To learn more about the relationship between Part 2 and HIPAA, read SAMHSA's analysis here.
    • Note that the HIPAA Privacy Rule has been modified since this analysis was published - learn more about those modifications on our HIPAA page by clicking here
  • Comparative maps are available detailing all 50 states' laws related to disclosure of substance abuse patient records without consent (here), written consent requirements (here), and disclosure of records pursuant to a court order (here) as compared with Part 2 requirements

Substance Abuse and Mental Health Services Administration (SAMHSA)

SAMHSA is an agency within HHS that exists to make substance abuse and mental health information, services, and research more accessible to the general public. SAMHSA's resources are directed toward creating and supporting programs, policies, data, contracts, and grants that serve its mission of reducing the impact of substance abuse and mental illness on America's communities. SAMHSA has released several pieces of guidance to assist both providers and patients with navigating privacy concerns in the context of substance abuse treatment.

  • Read the 2010 FAQ on applying Part 2 regulations to Health Information Exchange here.
  • Read the 2011 FAQ on applying Part 2 regulations here.