This federal regulation establishes confidentiality restrictions governing the use and disclosure of patient records held by Part 2 programs (substance use disorder treatment programs). Operators must ensure that patient records are only used or disclosed as explicitly permitted under 42 CFR Part 2, regardless of who is requesting the information or what justification they assert. Facilities must also carefully manage responses to inquiries about patient presence, ensuring that neither confirmation nor denial of a patient's enrollment reveals their substance use disorder status without proper consent or a court order.
View official source§ 2.13 Confidentiality restrictions and safeguards. (a) General. The patient records subject to the regulations in this part may be used or disclosed only as permitted by the regulations in this part and may not otherwise be used or disclosed in any civil, criminal, administrative, or legislative proceedings conducted by any Federal, state, or local authority. Any use or disclosure made under the regulations in this part must be limited to that information which is necessary to carry out the purpose of the use or disclosure. (b) Unconditional compliance required. The restrictions on use and disclosure in the regulations in this part apply whether or not the part 2 program or other lawful holder of the patient identifying information believes that the person seeking the information already has it, has other means of obtaining it, is a law enforcement agency or official or other government official, has obtained a subpoena, or asserts any other justification for a use or disclosure which is not permitted by the regulations in this part. (c) Acknowledging the presence of patients: Responding to requests. (1) The presence of an identified patient in a health care facility or component of a health care facility that is publicly identified as a place where only substance use disorder diagnosis, treatment, or referral for treatment is provided may be acknowledged only if the patient's written consent is obtained in accordance with subpart C of this part or if an authorizing court order is entered in accordance with subpart E of this part. The regulations permit acknowledgment of the presence of an identified patient in a health care facility or part of a health care facility if the health care facility is not publicly identified as only a substance use disorder diagnosis, treatment, or referral for treatment facility, and if the acknowledgment does not reveal that the patient has a substance use disorder. (2) Any answer to a request for a disclosure of patient records which is not permissible under the regulations in this part must be made in a way that will not affirmatively reveal that an identified individual has been, or is being, diagnosed or treated for a substance use disorder. An inquiring party may be provided a copy of the regulations in this part and advised that they restrict the disclosure of substance use disorder patient records, but may not be told affirmatively that the regulations restrict the disclosure of the records of an identified patient. [82 FR 6115, Jan. 18, 2017, as amended at 85 FR 43037, July 15, 2020; 89 FR 12621, Feb. 16, 2024]