SAMHSA 42 CRF Part 2 Revised Rules
Telehealth and privacy
Tips to keep your telehealth visit private
PHI OnDemand Webinar
PHI OnDemand Webinar Graphic-02-02.png
On-demand webinar about maintaining patient confidentiality when providing medication for opioid use disorder treatment in community health centers

The Challenge

Patient privacy and confidentiality form a crucial component of the patient-doctor treatment relationship, particularly when seeking treatment for mental health or substance use disorders. Multiple federal privacy laws, in addition to state laws, provide privacy protections for mental health and substance use disorder treatment records, while permitting communication of these records to other healthcare providers, patients’ families, and others.

In the face of these overlapping laws, it can be difficult for patients, their families, and health professionals to understand: What exact information can be shared, with whom, and at what times?

Federal privacy laws and regulations, like the Health Insurance Portability and Accountability Act (HIPAA), the federal substance use disorder privacy law and regulations (including 42 CFR Part 2), and the Family Educational Rights and Privacy Act (FERPA), were put in place to protect the information of patients getting or seeking treatment. These privacy laws govern the sharing of patient information with healthcare providers, family members, schools, and other community organizations.

Clear and accurate information about confidentiality is important to ensure that patient privacy is protected and that privacy laws are not erroneously interpreted to prevent disclosure of patient information. Individuals living with mental illness or substance use disorders may not seek care without guarantees of confidentiality and privacy protections. A recent survey completed by SAMHSA found that concerns about privacy and confidentiality among individuals with behavioral health needs is a primary reason for not receiving treatment. Clarifying privacy protections and promoting communication of patient records is critical for improving patients’ access to care and quality of treatment once in care.


The CoE for PHI will develop and increase access to simple, clear, and actionable educational resources, training, and technical assistance for consumers and their families, and individuals at the front-lines of care. The CoE for PHI will also develop resources for state agencies and communities, who need to know how to promote patient care while protecting confidentiality. We will do this by ensuring that professionals have the knowledge, skills, and resources to implement privacy regulation on the job, and that patients and families are aware of their rights and options regarding confidentiality.


  • Increase Access to Expert Training: Provide virtual and face-to-face cluster training, workshops, and training of trainers, for at least 500 health and education professionals and consumers and their families annually.
  • Increase Access to Individualized Technical Assistance: Individualized technical assistance will be available to request through a web-based portal.
  • Increase Access to High-Quality Resources: Establish a national CoE for PHI website that facilitates access to key resources (e.g. training curriculum, implementation guides, fact sheets) that consumers, their families, health professionals, and educators need to improve their knowledge of relevant privacy laws and how they practically apply in their lives and on the job.
  • Strengthen Healthcare Provider Systems: In Year 2, and annually thereafter, convene up to three Virtual Learning Collaboratives that bring together the most motivated and ready provider agencies to work together to improve systems and practices that support accurate and patient-centered implementation of privacy laws in practice.