With the United States placing emphasis on fighting The Opioid Crisis, more and more substance abuse treatment centers and care providers are being established in communities across the U.S.  As more patients seek treatment of substance use disorder, there is a growing number of SUD records present in practices’ EHRs.

All medical records requests are not created equal. Some medical records require more sensitive handling due to their greater privacy and confidentiality restrictions, including substance use disorder (SUD) records regulated under 42 Code of Federal Regulations (CFR) Part 2.

Recently, 42 CFR Part 2 has started to be on the radar of many including SAMHSA. The increase in substance use and thus SUD treatment has caused certain records to bear additional scrutiny.  We expect stricter enforcement of Part 2 and its patient confidentiality standards in the future.  DataFile provides comprehensive medical records release and health information management services, including specialized Part 2 handling. Our aim is to provide you with the latest guidance and empower you to make the best decision on the fulfillment of these sensitive records.

Here’s what you need to know:

  • Substance abuse treatment records (also referred to as substance use disorder (SUD) records) are regulated within the Federal Register under section 42 CFR Part 2.  These records are often called “Part 2” records because of where the Substance Abuse Confidentiality Regulations are found within the Code of Federal Regulations.
  • Substance abuse treatment records have a prohibition on redisclosure meaning that the records specifically cannot be disclosed without written patient consent.
  • Typical HIPAA concepts like being able to exchange records without a patient authorization for Treatment / Payment / or Operations (“TPO”) purposes do not apply to these SUD records.
  • Covered Entities (CE) first should explore and understand whether they are subject to 42 CFR Part 2 and its governance under the Substance Abuse and Mental Health Services Administration (SAMHSA).
  • If a CE is designated at Part 2, the next step should be to determine a course of action if substance abuse treatment records reside in their electronic health record (EHR) system.
  • Once the CE evaluates and defines a secure, compliant medical records workflow, the CE or its Business Associate processes and releases these substance abuse treatment records with heightened sensitivity in accordance with HIPAA, 42 CFR Part 2 and other privacy standards.
  • In the case of CEs who either use or are considering a BA for records release, carefully evaluate BAs for specialized Release of Information Part 2 services. Many do not offer the additional workflows and quality assurance required to meet the Part 2 standards and ensure privacy.

The Compliance and Security Team at DataFile has drafted a comprehensive FAQ guide to Part 2 records requests including a deeper look at Part 2 and its history, what guidelines are used to designate a Part 2 provider or clinic, and what processes we recommend in the handling of sensitive Part 2 medical record requests. DataFile has also developed a helpful resource page with templates, articles and more. Explore our Part 2 Resource Library Today>>


DataFile is vigilant in the study and understanding of medical records requests from the federal and state levels. As a trusted Business Associate, we handle both the routine medical records requests and the more complicated, like Part 2 and those involving substance abuse treatment records.  Explore your options for 42 CFR Part 2 records requests before the the full weight of enforcement hits. Reach out to us to start a conversation or request more information from our expert Compliance and Security Team today.


Share This