Making Sense of Federal Privacy Laws for Substance Use Disorder (SUD) and Mental Health Treatment

Why Privacy Laws Matter

Privacy and confidentiality are crucial to treatment, particularly when it comes to mental health and substance use disorders. Individuals seeking treatment for mental health conditions or substance use disorders depend on strict confidentiality protections in order to feel confident sharing sensitive information with their providers.

Intro to the Laws

Multiple federal laws, including HIPAA, 42 CFR Part 2, and FERPA, protect the privacy of mental health and substance use disorder treatment records. These laws permit sharing patient records in certain circumstances. Because these laws apply to different information in different ways, it can be hard to understand when they apply, what information should be kept private, and what can be shared, with whom, and when.

It is helpful to compare these three federal health privacy laws at a glance:

HIPAA

Applies to:

Covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates

 

Protects privacy and security of general health information

 

 

Purpose:

To protect health data integrity, confidentiality, and accessibility

Permits:

Disclosures without patient consent for treatment, payment, and healthcare operations

42 CFR Part 2

Applies to:

SUD patient records from federally-assisted “Part 2 programs”

 

Protects privacy and security of records identifying individual as seeking/receiving SUD treatment

 

Purpose:

To encourage people to enter and remain in SUD treatment by guaranteeing confidentiality

Requires:

Patient consent for treatment, payment, and healthcare operations, with limited exceptions

FERPA

Applies to:

Schools that receive funding from the U.S. Department of Education

 

Protects privacy of personally identifiable information in education records (including health records prepared by school nurse or school counselor)

Purpose:

To give parents and adult students more control over their educational records

Requires:

Parental (or adult student) consent to disclose information in most circumstances