42 CFR Part 2 Confidentiality
42 CFR Part 2 confidentiality is the federal framework governing the use and disclosure of identifiable substance use disorder patient records maintained by federally assisted programs.
Definition
42 CFR Part 2 confidentiality refers to the protections established under Title 42, Part 2 of the Code of Federal Regulations for records that identify an individual as having, having had, or having sought diagnosis, treatment, or referral for treatment of a substance use disorder from a federally assisted program.
The framework limits when Part 2 records may be used, disclosed, or redisclosed and establishes requirements concerning patient consent, notices, safeguards, breach response, legal proceedings, audits, research, medical emergencies, and other specifically permitted activities. Its protections apply according to the source and status of the records rather than solely according to the type of organization currently possessing them.
Structural Components
- Part 2 program: A federally assisted program that provides substance use disorder diagnosis, treatment, or referral for treatment and meets the regulatory conditions for Part 2 applicability.
- Part 2 record: Information created, received, or maintained by a Part 2 program that identifies a patient as having or seeking substance use disorder-related services.
- Patient consent: A written or electronic authorization containing the elements required for a permitted use or disclosure.
- Lawful holder: A person or organization that lawfully receives Part 2 records and becomes subject to applicable restrictions governing those records.
- Permitted disclosures: Uses or disclosures authorized by patient consent or by a regulatory exception, court order, or other recognized legal basis.
- Proceeding restrictions: Limitations on using Part 2 records or testimony derived from them in civil, criminal, administrative, or legislative proceedings against a patient.
- Administrative safeguards: Policies, notices, documentation, access controls, and breach-response measures required to preserve record confidentiality.
Parameters & Conditions
Part 2 applies when the information at issue qualifies as a patient record under the regulation and originates from a federally assisted substance use disorder program. Federal assistance may arise through direct funding, tax status, licensure, registration, authorization to conduct controlled-substance activities, or other forms of federal participation recognized by the regulation.
A qualifying patient consent may authorize future uses and disclosures for treatment, payment, and health care operations when the required elements are present. Certain recipients that are HIPAA covered entities or business associates may redisclose records in accordance with HIPAA after receiving them under an applicable consent, subject to Part 2 restrictions concerning legal proceedings and other protected uses.
Uses and disclosures without patient consent remain limited to circumstances specifically recognized by the regulation, which may include medical emergencies, research, audits and evaluations, reports of suspected child abuse or neglect, qualified service organization activities, and court-authorized disclosures. Each category is governed by its own conditions and does not establish unrestricted access to the records.
Topic Relationships
- Healthcare Cyber Liability — relates to liabilities arising from unauthorized access to or disclosure of healthcare information.
- Data Breach Notification — relates to required responses when protected information is acquired, accessed, used, or disclosed improperly.
- Business Cyber Liability — relates to organizational exposure arising from privacy, security, and information-system incidents.
- Professional Liability Insurance — relates to liability arising from alleged errors, omissions, or failures in professional duties.
- Risk Management — relates to the identification, evaluation, control, and monitoring of operational and legal risks.
- Exclusions — relates to contractual provisions that remove specified circumstances or categories of loss from coverage.
Exceptions, Limitations & Boundaries
42 CFR Part 2 does not automatically apply to every record mentioning substance use, every behavioral-health record, or every healthcare provider that treats a person with a substance use disorder. Applicability depends on whether the record meets the regulatory definition and is connected to a qualifying federally assisted Part 2 program.
Part 2 confidentiality is distinct from the HIPAA Privacy Rule, although the frameworks may apply simultaneously to the same record. Compliance with one framework does not independently establish compliance with the other when both govern the information.
A disclosure permitted by Part 2 is not necessarily mandatory, and another federal or state law may impose additional restrictions. Conversely, a general authorization, subpoena, discovery request, or routine healthcare disclosure does not independently override Part 2 requirements concerning consent, court orders, or the use of records in proceedings against a patient.
The framework governs confidentiality and permissible information handling; it does not define the scope of insurance coverage, determine civil liability, or guarantee that a privacy, cyber, or professional liability policy will respond to a Part 2-related incident.
42 CFR Part 2 Confidentiality: Definitional FAQ
It protects qualifying records that identify an individual as having, having had, or having sought substance use disorder diagnosis, treatment, or referral for treatment from a federally assisted Part 2 program.
No. Part 2 is a separate federal confidentiality framework for qualifying substance use disorder records, while HIPAA governs protected health information held by covered entities and business associates. Both frameworks may apply to the same information.
A Part 2 program is a federally assisted individual or organization that provides substance use disorder diagnosis, treatment, or referral for treatment and satisfies the regulatory conditions for Part 2 coverage.
Yes. Part 2 permits disclosures supported by a written or electronic patient consent that contains the required elements and authorizes the relevant use or disclosure.
Part 2 generally restricts the use of protected records or related testimony in proceedings against a patient unless the patient provides the specifically required consent or a qualifying court order authorizes the use.