The federal privacy protections for substance use disorder (SUD) treatment information, 42 USC § 290dd-2 and 42 CFR Part 2 (known collectively as “Part 2”), are the federal privacy protections for substance use disorder (SUD) treatment information. Part 2 offers strict privacy protections to treatment records in order to encourage individuals to seek and remain in treatment, and to promote quality SUD treatment. The privacy protections recognize that SUD treatment records contain sensitive, stigmatized, and criminalized information, and that a disclosure can lead to loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, prosecution, or even incarceration. These potential harms may dissuade individuals from seeking or remaining in treatment for substance use disorders. Unlike HIPAA, which often permits the sharing of certain health information without patient authorization, Part 2 generally requires patients’ written consent to disclose any patient-identifying information.
What Information does Part 2 Protect?
Part 2 protects the privacy and security of information in any form that would directly or indirectly identify a person as having sought or received SUD treatment from a Part 2 program. Part 2-protected information includes name, date of birth, status as a patient in a Part 2 program, diagnosis, treatment or referral records, and prescription information.
Who must follow Part 2?
Part 2 applies to records from “Part 2 programs,” which are substance use disorder treatment programs that are “federally assisted” and meet the definition of a “program” in 42 CFR § 2.11. Not all SUD treatment providers meet the definition of a Part 2 program.
Part 2 also applies to “lawful holders” who have received Part 2-protected records, as well as to “qualified service organizations” that perform certain services or functions on behalf of a Part 2 program.
For more information about Part 2 and when it applies, please visit our Resource Library.