This federal regulation permits Part 2 programs (substance use disorder treatment programs subject to 42 CFR Part 2 confidentiality requirements) to disclose patient records to public health authorities without patient consent, provided the disclosed information has been de-identified in accordance with HIPAA standards so that no individual patient can be identified. Facility operators must ensure both conditions—disclosure to a qualifying public health authority and proper de-identification—are met before releasing any records under this provision.
View official source§ 2.54 Disclosures for public health. A part 2 program may disclose records for public health purposes without patient consent so long as: (a) The disclosure is made to a public health authority as defined in this part; and (b) The content of the information from the record disclosed has been de-identified in accordance with the requirements of 45 CFR 164.514(b) such that there is no reasonable basis to believe that the information can be used to identify a patient. [89 FR 12629, Feb. 16, 2024]