Making Sense of Federal Privacy Laws for Substance Use Disorder (SUD) and Mental Health Treatment

Why Privacy Laws Matter

Privacy and confidentiality are crucial to treatment, particularly when it comes to mental health and substance use disorders. Individuals seeking treatment for mental health conditions or substance use disorders depend on strict confidentiality protections in order to feel confident sharing sensitive information with their providers.

Intro to the Laws

Multiple federal laws, including HIPAA, 42 CFR Part 2, and FERPA, protect the privacy of mental health and substance use disorder treatment records. These laws permit sharing patient records in certain circumstances. Because these laws apply to different information in different ways, it can be hard to understand when they apply, what information should be kept private, and what can be shared, with whom, and when.

It is helpful to compare these three federal health privacy laws at a glance:


Applies to:

Covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates


Protects privacy and security of general health information




To protect health data integrity, confidentiality, and accessibility


Disclosures without patient consent for treatment, payment, and healthcare operations

42 CFR Part 2

Applies to:

SUD patient records from federally-assisted “Part 2 programs”


Protects privacy and security of records identifying individual as seeking/receiving SUD treatment



To encourage people to enter and remain in SUD treatment by guaranteeing confidentiality


Patient consent for treatment, payment, and healthcare operations, with limited exceptions


Applies to:

Schools that receive funding from the U.S. Department of Education


Protects privacy of personally identifiable information in education records (including health records prepared by school nurse or school counselor)


To give parents and adult students more control over their educational records


Parental (or adult student) consent to disclose information in most circumstances