Proposed Changes to 42 CFR Part 2: What You Need to Know

Last month, the Department of Health and Human Services (HHS) proposed reforms that would revise the regulations governing patient records of substance use disorder and treatment that are subject to extra privacy laws. The current federal law, known as 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records regulation), predates the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and protects the confidentiality of patient records created by federally-assisted substance use disorder (SUD) treatment programs.

Initially drafted in 1975, 42 CFR Part 2 was intended to shield patients from bias and stigma associated with substance abuse that may deter patients from pursuing and receiving addiction treatment. Under this law, primary care providers and other non-addiction medicine physicians are restricted from easily accessing and recording information related to SUD. However, the opioid epidemic has created significant clinical and safety challenges for providers that highlight the need for streamlined SUD information that enables coordinated care and enhanced patient safety, which has led to the proposed regulatory changes to 42 CFR Part 2.

The Proposed Changes
The proposed changes, which are permissive, not mandatory, are intended to streamline information sharing as it relates to SUDs while also protecting patient confidentiality of those seeking and receiving treatment. Listed below are key themes in the proposal that affect care coordination, patient access, and research on treatment for substance use disorders.

Care Coordination

  • Provides clarification that recording of information about SUD and its treatment by a non-Part 2 entity (e.g. primary care provider) does not, by itself, render a medical record subject to the restrictions of 42 CFR Part 2.
  • Provides non-addiction treatment specialists (i.e. non-Part 2 providers) access to a central registry to determine whether patients are enrolled in opioid treatment programs and receiving medications. 
  • Encourages opioid treatment facilities to disclose dispensing and prescribing data to PDMPs with patient consent.

Patient Access

  • Enables patients to consent to disclosure to a wide range of entities in one consent.
  • Gives patients the ability to apply for and access federal, state, and local resources and benefits more easily, including Social Security benefits and local sober living or halfway house programs.
  • Allows for disclosure of patient information to another Part 2 program or other SUD treatment provider in a medical emergency, including natural disasters, to reduce burden of disclosure requirements for patients.


  • Allows disclosures of Part 2 patient data by a HIPAA-covered entity to individuals and organizations who are not HIPAA-covered entities nor subject to the Common Rule, which outlines the basic provisions for institutional review boards and informed consent, for the purpose of conducting scientific research. This creates alignment of 42 CFR Part 2 with the Common Rule and the Privacy Rule.
  • Allows patient-identifying information to be disclosed if de-identified information cannot be used for audit or evaluation purposes.

For an in-depth overview of the proposed changes, review this HHS fact sheet. Interested in commenting on the changes? Submit a comment in the Federal Register before October 25 here.

Leave a Comment

Scroll to Top