Substance Abuse and Confidentiality: 42 CFR Part 2

Tara Kunkel
Principal Court Management Consultant, National Center for State Courts

Protecting confidentiality is critical in substance abuse treatment and child welfare. Both fields need to guard clients’ rights to privacy and protect against the stigma that might cause clients to avoid treatment. Yet while monitoring cases, child welfare professionals regularly need information related to diagnosis and participation in treatment. Child welfare practitioners should be familiar with the rules and regulations that govern confidentiality and the legal methods of accessing otherwise protected information.

In the substance abuse field, confidentiality is governed by federal law (42 U.S.C. § 290dd-2) and regulations (42 CFR Part 2) that outline under what limited circumstances information about the client’s treatment may be disclosed with and without the client’s consent. Determining when 42 CFR Part 2 is applicable and how to legally access information about substance abuse treatment requires practitioners to work through a series of questions.

What Programs Are Covered by Federal Confidentiality Laws?

42 CFR Part 2 applies to any program that

1) involves substance abuse education, treatment, or prevention and

2) is regulated or assisted by the federal government (42 U.S.C. § 290dd-2; 42 C.F.R. § 2.11-2.12).

What Information Is Protected?

42 CFR Part 2 applies to all records relating to the identity, diagnosis, prognosis, or treatment of any patient in a substance abuse program that is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States.

How Can Protected Information Be Shared?

Information can be shared if written consent is obtained. A written consent form requires ten elements (42 C.F.R. § 2.31(a); 45 C.F.R. § 164.508(c)):

1. the names or general designations of the programs making the disclosure

2. the name of the individual or organization that will receive the disclosure

3. the name of the patient who is the subject of the disclosure

4. the specific purpose or need for the disclosure

5. a description of how much and what kind of information will be disclosed

6. the patient’s right to revoke the consent in writing and the exceptions to the right to revoke or, if the exceptions are included in the program’s notice, a reference to the notice

7. the program’s ability to condition treatment, payment, enrollment, or eligibility of benefits on the patient agreeing to sign the consent, by stating

1) the program may not condition these services on the patient signing the consent, or 2) the consequences for the patient refusing to sign the consent

8. the date, event, or condition upon which the consent expires if not previously revoked

9. the signature of the patient (and/or other authorized person)

10. the date on which the consent is assigned

When used in the criminal-justice setting, expiration of the consent may be conditioned upon the completion of, or termination from, a program instead of a date.

Mandatory Disclosures

42 CFR Part 2 allows for disclosure where the state mandates child-abuse-and neglect reporting (42 C.F.R. § 2.12(c)(6); 45 C.F.R. §164.512(b)(1)(ii)); when cause of death (42 C.F.R. § 2.15(b)) is being reported; or with the existence of a valid court order.

Permitted Disclosures

Programs are permitted to disclose patient-identifying information in cases of medical emergency (45 C.F.R. § 164.506(c); 42 C.F.R. § 2.51); in reporting crimes that occur on program premises or against staff (45 C.F.R. § 164.502(j)(2), 164.512(f)(2); 42 C.F.R. § 2.12 (c)(5)); to entities having administrative control (45 C.F.R. § 164.502(a)(1), 164.506(a), (c); 42 C.F.R. § 2.12 (c)(3)); to qualified service organizations (45 C.F.R. § 160.103, 164.504(e), (c); 42 C.F.R. § 2.12 (c)(4)); and to outside auditors, evaluators, central registries, and researchers (45 C.F.R. § 164.501, 164.506, 164.512; (c); 42 C.F.R. § 2.53 (c)-(d); 42 C.F.R. § 2.52; 45 C.F.R. § 164.512(i)(1)(ii)).