Addiction remains stigmatized. In order to safeguard and encourage patient access to care, there are special privacy protections for individuals with substance use disorders (SUDs). This update will cover what you need to know using clinical vignettes.

Clinical Scenario 1a: A 36-year-old man with heroin use disorder presents to your office for pharmacotherapy with buprenorphine. He signs a release of information form allowing you to speak to his primary care physician (PCP), but he doesn’t want his PCP to know he uses heroin. Should you tell the PCP anyway?

Discussion: No. A law called “Title 42 of the Code of Federal Regulations Part 2” (often abbreviated as “Part 2”) limits what you can disclose about patients, assuming you are working in certain settings and hold yourself out as providing SUD diagnosis, treatment, or referral for treatment. Part 2 applies to you if you are working in a federally assisted program (for example, a methadone treatment program) or if you have a DEA license to prescribe buprenorphine (the so-called “Suboxone waiver”). If you work in these circumstances, Part 2 prevents you from releasing information identifying a person as having or having had an SUD unless that person provides specific written or electronic consent allowing the disclosure.

What if you are in private practice and don’t hold yourself out as providing SUD care? In this case, you are bound by HIPAA (Health Insurance Portability and Accountability Act) regulations, which are generally less protective of patient privacy than Part 2 (see Clinical Scenario 1c). HIPAA limits disclosures to only the minimum necessary information (sometimes called “need to know”). However, this rule doesn’t apply to disclosures made by a health care provider for treatment purposes. This can be important if a patient is on buprenorphine and the patient’s PCP is administering benzodiazepines, as patient safety could become an issue.

Clinical Scenario 1b: After some discussion, the patient grants permission to disclose the heroin use disorder to his PCP. What information must be included on the release of information form?

Discussion: Under Part 2, consent must be either written or electronic; it can’t be verbal. Consent forms must include:

1. The patient’s name, signature, and date


2. The names of individuals or entities that are permitted to disclose or receive the patient’s information


3. The amount and kind of information being disclosed


4. The intent of the disclosure


5. The date the consent will expire

The form also needs to be accompanied by a notice of prohibition on “redisclosing” the information to a third party without consent.

Clinical Scenario 1c: The patient refuses to allow his insurance to be billed for pharmacotherapy with buprenorphine. He doesn’t want his carrier or employer to know he has an SUD. Can his insurance be billed anyway under HIPAA?

Discussion: No. While HIPAA permits the release of protected health information without patient authorization for treatment, payment, or health care operations, for patients with SUDs, these types of disclosures could lead to stigma, discrimination, and loss of employment/insurance. As a result, Part 2 prohibits disclosure of SUD records without permission and takes precedence over HIPAA. Unlike HIPAA, Part 2 also offers protections against the seizure of SUD records for legal investigations and for redisclosure, which is the sharing or releasing of health information with a third party without the patient’s consent.

Clinical Scenario 2: You are treating a 26-year-old woman with fentanyl use disorder in a methadone program. During your work with her, the patient admits she is stealing methadone from the clinic. Can this information be disclosed to law enforcement without violating Part 2?

Discussion: Yes, the exceptions to confidentiality include:

1. The disclosure does not identify the patient as having an SUD


2. The disclosure is for consultation among treatment staff


3. The disclosure is to an organization involved in processing, bill collecting, lab analysis, accounting, etc.


4. There is a medical or psychiatric emergency


5. There is suspected child abuse or neglect


6. The patient commits a crime at the treatment program or against its staff


7. The information is used for research, audit, or evaluation purposes


8. A court issues a special order authorizing disclosure (Miller SC, Fiellin DA, Rosenthal RN, Saitz R, eds. ASAM Principles of Addiction Medicine. 6th ed. Philadelphia, PA: Wolters Kluwer, 2018:1717–1723)

Clinical Scenario 3: A 15-year-old girl comes alone to your office, seeking help for alcohol use disorder. She doesn’t want her parents to know. Are you required to tell them?

Discussion: It depends. In 39 states and the District of Columbia, adolescents (starting at ages 12 to 16, depending on the state) have the right to seek SUD treatment without parental permission. In 11 states, either a parent or both a parent and the minor must consent to treatment (Kerwin MLE et al, J Child Adolesc Subst Abuse 2015;24(3):166–176). In those 11 states, if the adolescent seeking treatment refuses to permit communication with the parents, you will face some difficult Catch-22 decisions, since Part 2 prevents you from reaching out to those parents. You’re left with three uncomfortable courses of action: 1. Tell the adolescent you can’t provide treatment; 2. Go ahead and treat without contacting the parents (in which case you would be breaking your state’s law); or 3. Contact the parents anyway for their consent (in which case you’d be breaching Part 2 confidentiality restrictions).

There are two exceptions to Part 2: 1. The minor may lack capacity because of age or a mental or physical condition that impedes rational decision-making; or 2. The adolescent’s situation may pose a substantial threat to the adolescent’s life or physical well-being. In both cases you can legally contact the parent without the patient’s permission.

We’ve only touched briefly on some of the complicated laws governing disclosure. For example, mixed-use practices, general medical facilities, and EHRs add additional complexity. An excellent source for more information is the Substance Abuse and Mental Health Services Administration’s (SAMHSA) website. Other resources used for this update included www.asam.org and www.ecfr.gov.

CATR Verdict: The bottom line is that patients may not seek treatment unless they know their information is confidential, especially if they’re involved in illegal activity. Federal and state regulations protect patients with SUDs by limiting disclosures. These protections are stricter than HIPAA. In most states, adolescents can access treatment independently.