Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? 1 

Disclosure of Substance Use Disorder Patient Records:

How Do I Exchange Part 2 Data? 

Title 42 of the Code of Federal Regulations (CFR) Part 2: Confidentiality of Substance Use 

Disorder Patient Records (Part 2) was first promulgated in 1975 to address concerns about the 

potential use of Substance Use Disorder (SUD) information in non-treatment based settings such as 

administrative or criminal hearings related to the patient. Part 2 is intended to ensure that a patient 

receiving treatment for a SUD in a Part 2 Program does not face adverse consequences in relation to 

issues such as criminal proceedings and domestic proceedings such as those related to child custody, 

divorce or employment. Part 2 protects the confidentiality of SUD patient records by restricting the 

circumstances under which Part 2 Programs or other lawful holders1 can disclose such records. 

Part 2 Programs are federally assisted2

programs.3In general, Part 2 Programs are prohibited from 

disclosing any information that would identify a person as having or having had a SUD unless that 

person provides written consent. Part 2 specifies a set of requirements for consent forms, including but 

not limited to the name of the patient, the names of individuals/entities that are permitted to disclose 

or receive patient identifying information, the amount and kind of the information being disclosed, and 

the purpose of the disclosure (see §2.31).4In addition to Part 2, other privacy laws such as the Health 

Insurance Portability and Accountability Act of 1996 (HIPAA)5have been enacted. HIPAA generally 

permits the disclosure of protected health information for certain purposes without patient 

authorization, including treatment, payment, or health care operations. 

To help stakeholders understand their rights and obligations under Part 2, the Office of the National 

Coordinator for Health Information Technology (ONC) and the Substance Abuse and Mental Health 

Services Administration (SAMHSA) have released two fact sheets illustrating how Part 2 might apply 

in various settings. This fact sheet demonstrates how Part 2 applies to the electronic exchange of 

health 

1

A “lawful holder” is an individual or entity who has received patient identifying information as the result of a part

2-compliant consent or as otherwise permitted under the part 2 statute, regulations, or guidance.

2

“Federally assisted” (defined at § 2.12 (b)) encompasses a broad set of activities, including management by a

federal office or agency, receipt of any federal funding, or registration to dispense controlled substances related to

the treatment of SUDs. Many SUD treatment programs are federally assisted.

3

A “program” (defined at § 2.11) is an individual, entity (other than a general medical facility), or an identified unit

in a general medical facility, that “holds itself out” as providing and provides diagnosis, treatment, or referral for

treatment for a SUD. Medical personnel or other staff in a general medical facility who are identified as providers

whose primary function is to provide diagnosis, treatment, or referral for treatment for a SUD are also Programs.

“Holds itself out” means any activity that would lead one to reasonably conclude that the individual or entity

provides substance use disorder diagnosis, treatment, or referral for treatment.

4

A full description of the requirements of a Part 2 consent form is available at:

https://www.gpo.gov/fdsys/pkg/FR-2017-01-18/pdf/2017-00719.pdf.

5

State laws and regulations may also further restrict the disclosure of substance use disorder patient records.

The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet

is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information

contained herein. 
The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet 

is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information 

contained herein. 

Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? 2 

care records with a Part 2 Program. The fact sheet presents health information exchange scenarios and 

illustrates how Part 2 applies to a theoretical disclosure of patient health information in each scenario.

6

HEALTH INFORMATION EXCHANGE

Electronic health information exchange allows doctors, nurses, pharmacists, other health care providers, 

and patients to appropriately access and securely share an individual’s health information—improving 

the speed, quality, safety, and cost of patient care. Health information exchange can greatly improve the 

completeness of patient records, which in turn contributes to more informed decision-making at the 

point of care. Two common types of health information exchange include directed exchange and querybased exchange. 

DIRECTED EXCHANGE

Directed exchange enables health care providers to securely send/receive patient information—such as 

laboratory orders and results, patient referrals, or discharge summaries— via the internet to/from a 

known and trusted recipient. Common forms of directed exchange include Direct Secure Messaging 

(commonly compared to secure email for healthcare), point-to-point interfaces between systems, and 

web services. 

In the directed exchange scenario, Dr. Washington is an addiction counselor at Memorial Treatment 

Center, a SAMHSA-certified Opioid Treatment Program that provides medication-assisted treatment 

(MAT) for persons diagnosed with an opioid use disorder. One of Dr. Washington’s patients is Thomas. 

6 Note: All scenarios described in this fact sheet involve adult patients. Part 2 includes specific provisions for minor 

patients (see § 2.14) that are not presented in this fact sheet. 
The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet 

is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information 

contained herein. 

Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? 3 

Thomas was recently referred to Memorial Treatment Center by his primary care provider, Dr. Adams. 

After entering Memorial’s treatment program, Thomas noted that he wants Dr. Adams to know about 

his treatment at Memorial Treatment Center. 

To meet the requirements of Part 2, Dr. Washington has Thomas complete a consent form specifying 

that he would like progress notes related to his treatment for SUD sent from Memorial Treatment 

Center to Dr. Adams. After each appointment, Dr. Washington uses his electronic health record (EHR) 

system to create a direct message and send the progress notes to Dr. Adams, who receives the message 

in her EHR system.

QUERY-BASED EXCHANGE

Query-based exchange enables health care providers to search clinical data sources and discover 

information about a patient. Query-based exchange typically involves an intermediary, often known as a 

health information exchange (HIE). The HIE either maintains a centralized data repository that includes 

data from connected systems, or facilitates requests from one system to search another system.

In the query-based exchange scenario, Monument Community Mental Health Center (Monument) 

provides a variety of behavioral health services to patients, including treatment for SUDs. Monument 

describes these services on its website and through advertisements. Dr. Madison is a psychiatrist at 

Monument who specializes in addiction treatment and counseling and provides MAT to patients with a 

SUD. Monument recently joined a local HIE and wants to share patient records with the HIE so that 

other providers can access information about the behavioral health care of their patients.

As a Part 2 Program, Monument would need to meet the requirements of Part 2 before disclosing 

patient records to the HIE. To meet the requirements of Part 2, Monument must either obtain patient 

consent before disclosing Part 2 patient-identifying information to the HIE or execute a Qualified Service 

Organization Agreement (QSOA) with the HIE (see § 2.11 and § 2.12(c)(4)). 

Query-Based Exchange Scenario 1: Written QSOA with an HIE

A qualified service organization is an individual or entity who:

(1) Provides services to a Part 2 Program, such as data processing, bill collecting, dosage

preparation, laboratory analyses, legal, accounting, population health management, medical

staffing, or other professional services, and

(2) Has entered into a written agreement with a Part 2 Program under which the QSO:

(i) Acknowledges that in receiving, storing, processing, or otherwise dealing with any patient

records from the Part 2 Program, it is fully bound by 42 CFR Part 2; and

(ii) If necessary, will resist in judicial proceedings any efforts to obtain access to patientidentifying information related to substance use disorder diagnosis, treatment, or

referral for treatment except as permitted by 42 CFR Part 2.
The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet 

is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information 

contained herein. 

Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? 4 

Monument and the HIE could sign a QSOA acknowledging that the HIE is providing information exchange 

services to Monument and is bound by the requirements of Part 2. Because the HIE is considered a QSO,

Part 2 Programs at Monument would not need patient consent to disclose patient information to the 

HIE. However, providers participating in the HIE would need Thomas’s consent to view his SUD patient 

records. The HIE would be restricted from re-disclosing patient identifying information to participating 

providers without Thomas’s consent.

In the figure above, Thomas grants consent for Dr. Madison to share his SUD records with Dr. Monroe, a 

provider participating in a local HIE. Dr. Madison can send Thomas’s records to the HIE without his 

consent because the HIE has a QSOA with Monument. Dr. Monroe can access Thomas’s SUD records 

through the HIE because he was named on Thomas’s consent form. However, other providers 

participating in the HIE could not access Thomas’s records because they were not listed on the consent 

form.

Query-Based Exchange Scenario 2: Patient Consent Forms

If Monument and the HIE did not sign a QSOA, Dr. Madison could have her patients fill out a consent 

form to disclose their SUD treatment records to other health care providers through the HIE. Health care 

providers listed on the patient’s consent form could access the HIE to view the patient’s records. The 

consent form would need to include the name of the HIE, as well as the (1) name of a specific individual 

and/or organization participating in the HIE, or (2) a general designation of individuals/entities that have 

a treating provider relationship with the patient. The consent form would also have to fulfill all other 

requirements as specified by Part 2.
The information in this fact sheet is not intended to serve as legal advice nor should it substitute for legal counsel. The fact sheet 

is not exhaustive, and readers are encouraged to seek additional technical guidance to supplement the illustrative information 

contained herein. 

Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data? 5 

If a patient used a general designation, the consent form would also have to include a notice stating that 

the patient understands that upon written request, he/she must be provided with a list of entities to 

which his/her information has been disclosed within the past two years. The HIE would be responsible 

for responding to the request within 30 days. For each disclosure, the HIE would have to include the 

name(s) of the entities to which the disclosure was made, the date of the disclosure, and a brief 

description of the patient-identifying information that was disclosed.

Additional Resources

• 42 CFR Part 2 [PDF - 556 KB]

• SAMHSA’s webpage about 42 CFR Part 2