SAMHSA announces changes to substance abuse treatment records in 42 CFR Part 2


doctor and patient

On July 13, 2020, the Substance Abuse and Mental Health Services Administration (SAMHSA) announced changes to the Confidentiality of Substance Use Disorder Patient Records regulation, 42 CFR Part 2, effective August 14, 2020. Department of Health and Human Services Secretary Alex Azar stated that these changes “will help make it easier for Americans to discuss substance use disorders (SUDs) with their doctors, seek treatment, and find the road to recovery.”

SAMHSA clarified that Part 2 continues to protect patients' SUD records created in federally assisted Part 2 programs and that Part 2 still prohibits law enforcement using SUD records in criminal prosecutions against patients without a court order.

Significant changes include:

  • Treatment records from non-Part 2 providers are not covered by Part 2, as long as the records are based on the non-Part 2 provider’s own patient encounters, unless the records include previously received records from Part 2 programs that are incorporated into the records.
  • SUD patients may consent to disclosure of records to an entity (such as the Social Security Administration) without having to name a specific individual to disclose to, allowing patients to apply for benefits and resources more easily.
  • If a SUD patient sends an incidental message to the personal device of a Part 2 employee, the employee can now fulfill Part 2 requirements by deleting the message; confiscation or destruction of the device is no longer required.
  • The definition of “payment and health care operations” has been expanded to clarify when disclosures for that purpose are appropriate.
  • Non-Opioid Treatment Program (OTP) providers can query a central registry to see if patients are already receiving opioid treatment.
  • OTPs may enroll in state prescription monitoring programs to report prescription and dispensing information to the program consistent with state laws.
  • Disclosures for research under Part 2 are permitted by HIPAA covered entities or business associates to individuals or organizations who aren’t HIPAA covered entities or subject to the research common rule.

Below is a chart summarizing the changes that was included in the fact sheet issued by SAMHSA on July 13, 2020.

What Has Changed Under the New Part 2 Rule: The revised rule modifies several major sections of Part 2, as follows:


What Changed?

Why Was This Changed?

Applicability and Re-Disclosure

Treatment records created by non-Part 2 providers based on their own patient encounter(s) are explicitly not covered by Part 2, unless any SUD records previously received from a Part 2 program are incorporated into such records. Segmentation or holding a part of any Part 2 patient record previously received can be used to ensure that new records created by non-Part 2 providers will not become subject to Part 2.

To facilitate coordination of care activities by non-part-2 providers.

Disposition of Records

When an SUD patient sends an incidental message to the personal device of an employee of a Part 2 program, the employee will be able to fulfill the Part 2 requirement for “sanitizing” the device by deleting that message.

To ensure that the personal devices of employees will not need to be confiscated or destroyed, in order to sanitize in compliance with Part 2.

Consent Requirements

An SUD patient may consent to disclosure of the patient’s Part 2 treatment records to an entity (e.g., the Social Security Administration), without naming a specific person as the recipient for the disclosure.

To allow patients to apply for benefits and resources more easily, for example, when using online applications that do not identify a specific person as the recipient for a disclosure of Part 2 records.

Disclosures Permitted w/ Written Consent

Disclosures for the purpose of “payment and health care operations” are permitted with written consent, in connection with an illustrative list of 18 activities that constitute payment and health care operations now specified under the regulatory provision.

In order to resolve lingering confusion under Part 2 about what activities count as “payment and health care operations,” the list of examples has been moved into the regulation text from the preamble, and expanded to include care coordination and case management activities.

Disclosures to Central Registries and PDMPs

Non-OTP (opioid treatment program) and non-central registry treating providers are now eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program.

OTPs are permitted to enroll in a state prescription drug monitoring program (PDMP), and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.

To prevent duplicative enrollments in SUD care, duplicative prescriptions for SUD treatment, and adverse drug events related to SUD treatment.

Medical Emergencies

Declared emergencies resulting from natural disasters (e.g., hurricanes) that disrupt treatment facilities and services are considered a “bona fide medical emergency,” for the purpose of disclosing SUD records without patient consent under Part 2.

To ensure clinically appropriate communications and access to SUD care, in the context of declared emergencies resulting from natural disasters.


Disclosures for research under Part 2 are permitted by a HIPAA-covered entity or business associate to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule (re: Research on Human Subjects).

To facilitate appropriate disclosures for research, by streamlining overlapping requirements under Part 2, the HIPAA Privacy Rule and the Common Rule.

Audit and Evaluation

Clarifies specific situations that fall within the scope of permissible disclosures for audits and/or program evaluation purposes.

To resolve current ambiguity under Part 2 about what activities are covered by the audit and evaluation provision.

Undercover Agents and Informants

Court-ordered placement of an undercover agent or informant within a Part 2 program is extended to a period of 12 months, and courts are authorized to further extend the period of placement through a new court order.

To address law enforcement concerns that the current policy is overly restrictive to some ongoing investigations of Part 2 programs.


Industries & Practices

Media Contact

Subscribe to Receive Updates
Jump to Page

Necessary Cookies

Necessary cookies enable core functionality such as security, network management, and accessibility. You may disable these by changing your browser settings, but this may affect how the website functions.

Analytical Cookies

Analytical cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.