Page title

SAMHSA finalizes changes to clarify health privacy rules for people who seek substance use disorder treatment

Main page content

Final changes to rule will support payment and healthcare operations activities while protecting the confidentiality of patients.

The Substance Abuse and Mental Health Services Administration (SAMHSA), part of the U.S. Department of Health and Human Services, announces the finalization of proposed changes to the Confidentiality of Substance Use Disorder Patient Records regulation, 42 CFR Part 2.

Part 2 protects the confidentiality of records relating to the identity, diagnosis, prognosis, or treatment of any patient records that are maintained in connection with the performance of any federally assisted program or activity relating to substance use disorder education, prevention, training, treatment, rehabilitation, or research. Under Part 2, a federally assisted substance use disorder program may only release patient identifying information with the individual’s written consent, pursuant to a court order, or under a few limited exceptions.

“This final rule underscores our commitment to ensuring persons with substance use disorders receive integrated and coordinated care,” said Dr. Elinore F. McCance-Katz, the nation’s first Assistant Secretary for Mental Health and Substance Use. “This rule will permit healthcare providers, with patients’ consent, to more easily conduct such activities as quality improvement, claims management, patient safety, training, and program integrity efforts.”

Dr. McCance-Katz said that modernizing Part 2 is one way that SAMHSA strengthens the nation’s efforts to reduce opioid misuse and abuse and to support patients and their families confronting substance use disorders. The rule also reflects an effort to better align Part 2 requirements with those of the Health Insurance Portability and Accountability Act (HIPAA).

Major provisions in today’s rule:

  • The final rule permits additional disclosures of patient identifying information, with patient consent, to facilitate payment and healthcare operations such as claims management, quality assessment, and patient safety activities.
  • The final rule permits additional disclosures of patient identifying information to certain contractors, subcontractors, and legal representatives for the purpose of conducting a Medicare, Medicaid, or CHIP audit or evaluation.
  • The final rule will assist users of electronic health records (EHRs) by permitting use of an abbreviated notice of prohibition on re-disclosure more easily accommodated in EHR text fields.

This rule finalizes changes proposed in a supplemental notice of proposed rulemaking (SNPRM) issued on January 18, 2017 (82 FR 5485). The SNPRM was published at the same time SAMHSA finalized the first major, substantive revisions to Part 2 in nearly 30 years (82 FR 6052).

As required by Section 11002 of the 21st Century Cures Act (P. L. 114-255), SAMHSA plans to hold a public meeting to obtain additional input from stakeholders about the effect of 42 CFR Part 2 on patient privacy, health outcomes, and patient care. The public meeting is tentatively scheduled for January 31, 2018.

Press Announcements: Footer Block

Reporters with questions should send inquiries to media@samhsa.hhs.gov.


The Substance Abuse and Mental Health Services Administration (SAMHSA) is the agency within the U.S. Department of Health and Human Services (HHS) that leads public health efforts to advance the behavioral health of the nation. SAMHSA’s mission is to lead public health and service delivery efforts that promote mental health, prevent substance misuse, and provide treatments and supports to foster recovery while ensuring equitable access and better outcomes.

Last Updated

Last Updated: