42 U.S.C. § 290dd-2: Privacy Rules for Substance Use Records

Federal law gives many substance use disorder (SUD) treatment records special privacy protection. The central statute, 42 U.S.C. § 290dd-2, limits when certain records may be disclosed and how they may be used. Its implementing regulations, known as 42 CFR Part 2, explain the rules for covered programs, patients, and recipients of records. Understanding how Part 2 interacts with HIPAA is important because the two privacy frameworks are related but not interchangeable.

What 42 U.S.C. § 290dd-2 Protects

Section 290dd-2 protects records that identify a person as having or having had a substance use disorder when the records are held by a federally assisted program that provides SUD diagnosis, treatment, or referral for treatment. The statute directs the U.S. Department of Health and Human Services (HHS) to establish regulations governing the confidentiality of these records. Those regulations are found in 42 CFR Part 2.

The protections are not limited to a particular format. They can apply to written charts, electronic health records, billing information, appointment records, and other information that identifies someone as having sought or received SUD services. Whether a record is covered depends on the program and the record, not simply on whether the information mentions alcohol or drugs.

Part 2 generally applies to federally assisted programs that hold themselves out as providing, and provide, SUD diagnosis, treatment, or referral. Federal assistance can take different forms, including federal funding, tax-exempt status, or participation in certain federal programs. The regulation also addresses records received by lawful holders and the conditions on their use and disclosure.

A general medical provider does not automatically become a Part 2 program merely by treating a patient who has an SUD. The specific regulatory definitions and circumstances matter. Some healthcare organizations contain both Part 2 programs and other departments, so internal policies should identify which records and activities are subject to Part 2.

How Part 2 Differs From HIPAA

HIPAA’s Privacy Rule applies to covered healthcare providers, health plans, and healthcare clearinghouses, as well as their business associates in specified circumstances. Part 2 applies to qualifying SUD programs and covered records. A provider may be subject to both frameworks, but HIPAA compliance alone does not establish Part 2 compliance.

HIPAA generally permits certain treatment, payment, and healthcare operations uses and disclosures without an individual authorization, subject to the Privacy Rule’s conditions. Part 2 has historically required specific patient consent for many disclosures and has tightly restricted use of records in legal proceedings. The rules can therefore affect the same information differently depending on who holds it and why it is being used.

Congress amended the statute through the Coronavirus Aid, Relief, and Economic Security (CARES) Act, directing HHS to align aspects of Part 2 more closely with HIPAA while retaining special safeguards. HHS issued a final rule in 2026 revising Part 2. The rule became effective April 16, 2026, with a compliance date of February 16, 2026. Until that compliance date, organizations should follow the requirements applicable to them during the transition and prepare for the revised standards.

When Patient Consent Is Required

Under Part 2, patient consent is a central basis for disclosure. The regulation specifies what a valid consent must contain, including information about the patient, the program or person permitted to disclose, the recipient or recipients, the purpose, the information covered, and the expiration date or event. A consent must also meet applicable signature and revocation requirements.

Part 2 allows a patient to authorize a disclosure to a named person or, under the 2026 rule, to a class of persons or entities for treatment, payment, and healthcare operations. This broader consent option is intended to support care coordination and routine healthcare administration. It does not mean that every recipient may use the records for any purpose: the permitted use is limited by the consent, the regulation, and other applicable law.

A patient may revoke consent in writing, subject to the regulation’s rules and the effect of actions already taken in reliance on the consent. A program should document the consent and any revocation, track its scope and expiration, and ensure that disclosures match the authorization. A broad or vague form should not be treated as permission for unrelated uses.

The 2026 rule also establishes requirements for a separate consent for certain SUD counseling notes, when applicable. These notes are a defined category and are not simply all records created during counseling. Organizations should distinguish such notes from the rest of the medical record and apply the regulatory consent standards before disclosing them.

Key Rules for Redisclosure

Part 2’s redisclosure rules are a major reason these records require careful handling. A recipient generally cannot pass protected records onward unless the patient has provided an appropriate consent or a specific regulatory exception applies. Under the revised rule, a recipient receiving records under a qualifying consent for treatment, payment, and healthcare operations may redisclose them as permitted by the rule and applicable HIPAA requirements, with important restrictions and notices.

Recipients must not assume that access to a record automatically gives them unrestricted authority to share it. Organizations should preserve required notices, make permitted-use limits clear, and train staff not to forward Part 2 information through ordinary channels without checking the applicable authorization and safeguards.

The 2026 changes also align certain requirements for notices of privacy practices and breach notification with HIPAA. Part 2 programs subject to the revised requirements need policies for identifying and responding to impermissible disclosures, notifying affected individuals when required, and meeting applicable reporting obligations. The relevant breach standard and procedures depend on the organization’s role and governing rules.

Disclosures Permitted Without Patient Consent

Part 2 includes limited exceptions that permit disclosure without patient consent. These exceptions are specific and should not be treated as a general waiver of confidentiality. Common examples include:

• Medical emergencies: Information may be disclosed to medical personnel to the extent necessary to meet a bona fide medical emergency when prior consent cannot be obtained.
• Qualified service organizations: A program may share information with a qualifying organization that provides services such as data processing, billing, or laboratory work, subject to a written agreement and Part 2 restrictions.
• Program audits and evaluations: Certain disclosures may be made for authorized audits or evaluations under the regulation’s conditions.
• Research: Disclosures for scientific research may be permitted under specified protections and legal requirements.
• Reports of suspected child abuse or neglect: Part 2 does not bar disclosures to appropriate authorities when required under applicable state law, but the exception is limited to the report and does not open the full treatment record.
• Crimes on program premises or against program personnel: Limited information may be reported under the conditions stated in the regulation.

Programs should verify that an exception applies before disclosing information and should limit the disclosure to what the exception permits. State confidentiality laws may impose additional protections, and other federal rules may also apply.

Court Orders, Subpoenas, and Legal Proceedings

Part 2 places special limits on using SUD records in civil, criminal, administrative, or legislative proceedings against a patient. In general, a subpoena or ordinary court order alone does not authorize disclosure of Part 2 records. A disclosure for a proceeding against a patient typically requires a court order that satisfies Part 2, as well as a subpoena or other legal mandate where required.

To issue a qualifying order, a court must apply the standards in the regulation, including the need for good cause and a balancing of the public interest and the need for disclosure against the potential injury to the patient, the treatment relationship, and the program. The order must be limited to the information essential to the purpose. Part 2 also includes procedures for notice and an opportunity to respond in relevant circumstances.

The 2026 rule permits certain uses of Part 2 records in legal proceedings when the patient has provided the required consent, but it does not eliminate the special protections for records used against a patient. A program receiving a subpoena should not disclose records automatically. It should consult its privacy or legal staff, assess whether Part 2 applies, and seek a valid consent or qualifying court order when necessary.

Patient Rights and Complaints

Patients can ask programs how their SUD records are used and disclosed, review applicable privacy notices, and make choices about consent where the law allows. They may also revoke consent according to the regulation. The exact access, amendment, and accounting rights depend on the applicable Part 2 and HIPAA provisions, the type of record, and the organization’s status.

The 2026 rule gives individuals a right to request restrictions on certain disclosures to health plans for treatment, payment, or healthcare operations when the individual has paid for the service in full out of pocket, consistent with the rule’s requirements. This provision reflects a related HIPAA restriction standard. Organizations should evaluate each request under the applicable regulation rather than assuming all requested restrictions must be accepted.

Patients who believe their information was handled improperly may raise the issue with the program and may file a complaint with HHS under applicable procedures. The revised rule applies HIPAA’s civil enforcement framework to Part 2 violations, including potential civil money penalties. Criminal penalties may also apply under federal law in appropriate cases. Consequences depend on the facts, the applicable compliance date, and enforcement requirements.

Practical Compliance Steps for Programs and Recipients

Organizations that create, receive, or use Part 2 records should take a structured approach to compliance. A practical review can include:

1. Identify covered records and operations. Map Part 2 programs, electronic systems, paper files, affiliated departments, and outside vendors that handle protected records.
2. Review consent forms. Confirm that forms meet current requirements, clearly identify recipients and purposes, address expiration and revocation, and support any intended treatment, payment, or operations disclosures.
3. Update privacy notices and policies. Prepare for the 2026 rule’s requirements by the February 16, 2026 compliance date, including revised notices and breach-response procedures where applicable.
4. Control access and redisclosure. Use role-based access, secure transmission, recipient verification, and procedures for required notices and restrictions.
5. Train staff and vendors. Explain the difference between HIPAA and Part 2, how to recognize protected records, and when to escalate subpoenas, emergency requests, or suspected breaches.
6. Document decisions. Keep records of consents, disclosures, legal review, exception-based disclosures, and incident response.

These steps help reduce accidental disclosures while supporting appropriate care coordination. They are not a substitute for reviewing the regulation, state law, contracts, and the organization’s specific circumstances.

Common Misunderstandings About 42 U.S.C. § 290dd-2

“HIPAA permits it, so Part 2 permits it.” Not necessarily. A disclosure may be allowed under HIPAA but still require consent or another basis under Part 2.

“Any mention of substance use is automatically a Part 2 record.” Coverage depends on the program and record under the statute and regulation. Conversely, records can be protected even when they do not contain detailed treatment notes.

“A subpoena is enough.” Usually not for a Part 2 disclosure in a proceeding against a patient. The program must evaluate the special court-order requirements and other applicable rules.

“The 2026 rule is already the only standard.” The rule is effective, but covered entities have until February 16, 2026, to comply with its requirements. Organizations should confirm which provisions apply during the transition and plan ahead.

Authoritative Sources

The statute is available through the U.S. Code. The detailed confidentiality regulations appear in 42 CFR Part 2. HHS explains the 2026 changes in its Part 2 final rule fact sheet. Because federal and state requirements can change and may apply differently across organizations, these sources should be consulted for current requirements; this article is general information, not legal advice.