Skip to Content

42 CFR Part 2

Topics: 
Care Coordination/Care Management
Federal and State Program Integrity
Medical Records Collection, Retention, and Access
Privacy and Confidentiality
Quality Measurement and Reporting
Research
Security of Health Information

Part 2: An Overview

42 CFR Part 2

42 CFR Part 2 (commonly referred to as "Part 2") are the federal regulations governing the confidentiality of drug and alcohol abuse treatment and prevention records. The regulations set forth requirements applicable to certain federally assisted substance abuse treatment programs limiting the use and disclosure of substance abuse patient records and identifying information. These regulations were enacted in 1987 by the Secretary of the US Department of Health and Human Services (HHS) as authorized by both the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970 and the Drug Abuse Prevention, Treatment, and Rehabilitation Act of 1972. These Acts and the Part 2 regulations provide comprehensive privacy protections in an effort to encourage people to seek treatment for substance abuse problems.

Part 2 sets forth the limited circumstances in which substance abuse patient information may be used or disclosed, and no uses or disclosures other than those detailed in the regulations are permitted.

  • A complete overview of the entire Part 2 regulatory text is here
  • A one-pager Fast Facts on consent requirements for Part 2 is here.
  • A one-pager Myth Buster breaking down the common myth that substance abuse information can never be disclosed without a patient's written consent is here

Within the HHS, the agency most closely related to Part 2 is the Substance Abuse and Mental Health Services Administration (SAMHSA). It exists to make substance abuse and mental health information, services, and research more accessible to the general public. SAMHSA's resources are directed toward creating and supporting programs, policies, data, contracts, and grants that serve its mission of reducing the impact of substance abuse and mental illness on America's communities. SAMHSA has released several pieces of guidance to assist both providers and patients with navigating privacy concerns in the context of substance abuse treatment. SAMHSA is the agency that has led the recent updates to Part 2 outlined below.  

 

Relationship with Other Laws

There are other laws governing the privacy of patient identifying information that apply to substance abuse program records. For example, HIPAA is a federal law that sets minimum privacy protections for "covered entities" - health plans, health care clearinghouses, and most providers, and many states have laws governing substance abuse program records. Substance abuse providers subject to Part 2 must comply with all applicable privacy requirements wherever possible - however, if a state or federal law conflicts with a Part 2 requirement (e.g., prohibits a disclosure that Part 2 permits, or vice versa), the provider must comply with whichever law is most restrictive.

In June 2018, the Overdose Prevention and Patient Safety Act (H.R. 6082) was proposed to further align the privacy standards in Part 2 with those in HIPAA. This bill removes the requirement of written patient consent for the disclosure of substance use disorder patient records for a few scenarios as long as they are HIPAA compliant. The hope is that providers will be able to offer better coordinated care after seeing their patients' complete health records, including substance abuse information. The bill passed in a vote in the House on June 20, 2018 and is waiting to be voted on in the Senate.  

  • To learn more about the relationship between Part 2 and HIPAA, read SAMHSA's analysis here.
    • Note that the HIPAA Privacy Rule has been modified since this analysis was published - learn more about those modifications on our HIPAA page by clicking here

 

Updates to Part 2

Since Part 2 was last updated over 30 years ago, many changes have been made to the health care system in the United States, including new models of patient care and the introduction of Health Information Exchanges (HIEs), which have changed the ways patient data is managed and shared. In February 2016, the HHS released a proposed rule to update Part 2 to reflect changes in the health care system. The public was allowed to comment on the rule through April 2016. A copy of the proposed rule can be found here.

The public was allowed to comment on a supplemental notice of proposed rulemaking (SNPRM) through February 2017. The SNPRM can be found here.  Shortly after in March, SAMHSA put the final 42 CFR Part 2 into effect.  Over the next year the SNPRM comments were taken into account before a final version of the rule was released on January 3, 2018, which went into effect on February 2, 2018.  The final rule can be found here. The new rule expands ways in which patient data may be shared, while maintaining many of Part 2’s original patient protections. More detailed information about the updates to Part 2 will be released shortly.