Patient Rights in Substance Use Disorder Treatment
Patients receiving treatment for substance use disorders (SUDs) hold a distinct and federally protected set of rights that govern how providers may collect, use, and disclose treatment information, how consent must be obtained, and what protections apply during both inpatient and outpatient care. These rights operate under a layered framework of federal statute, agency regulation, and state law — with certain protections, such as those under 42 CFR Part 2, that are significantly stronger than those found in general medical contexts. Understanding this framework is essential for patients, family members, treatment facilities, and legal advocates navigating the often complex intersection of confidentiality, consent, and access to care in SUD settings.
Definition and scope
Patient rights in substance use disorder treatment are the legally recognized entitlements of individuals receiving evaluation, counseling, medication-assisted treatment (MAT), detoxification, or residential rehabilitation services for alcohol or drug use disorders. These rights span three overlapping legal domains:
- Federal confidentiality protections under 42 CFR Part 2, administered by the Substance Abuse and Mental Health Services Administration (SAMHSA), which restricts disclosure of SUD treatment records far more strictly than the Health Insurance Portability and Accountability Act (HIPAA).
- HIPAA Privacy Rule protections under 45 CFR Parts 160 and 164, enforced by the U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR), which apply to all covered health entities.
- State-level protections, which may impose additional confidentiality requirements, consent procedures, or patient bill of rights mandates beyond the federal floor.
42 CFR Part 2 applies specifically to federally assisted SUD treatment programs — a category that includes any program receiving federal funds, tax-exempt status, or operating under a federal license or certification (42 CFR § 2.11). The scope is broad: it covers both substance use disorder diagnoses and the content of treatment itself.
The right to refuse treatment also applies in SUD contexts, though this right may be constrained under court-ordered treatment, civil commitment statutes, or correctional settings. Similarly, informed consent rights govern how providers must explain treatment options, risks, and alternatives before initiating care.
How it works
The operational framework governing SUD patient rights works through a specific consent-first architecture that differs from standard medical care.
Confidentiality and disclosure under 42 CFR Part 2:
- A patient must provide written, signed consent before a federally assisted SUD program may disclose any identifying information — including the fact that the patient is or was a patient.
- Consent must specify: the name or title of the program, the name or general designation of the recipient, the purpose of the disclosure, how much and what kind of information will be disclosed, the patient's right to revoke consent, and the date or condition on which consent expires (42 CFR § 2.31).
- Permitted disclosures without patient consent are narrowly defined: medical emergencies, court orders meeting specific requirements, mandated child abuse reporting, and program audits under strict limitations.
- In 2020, SAMHSA issued a final rule (85 FR 42986) that updated Part 2 to align more closely with HIPAA while preserving Part 2's higher baseline protections. The Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020 also amended 42 U.S.C. § 290dd-2, further modifying how Part 2 and HIPAA interact.
Informed consent and treatment rights:
Providers must obtain separate, specific consent for each disclosure category. A general consent form used in non-SUD medical settings does not satisfy Part 2 requirements. Patients retain the right to revoke consent at any time, except to the extent that the program has already acted on it.
Patient privacy rights under HIPAA remain applicable alongside Part 2, but where the two frameworks conflict, the more protective standard governs.
Common scenarios
Scenario 1: Family member requesting treatment information
A parent seeking information about an adult child's methadone treatment program cannot receive any records or confirmation of enrollment without the patient's specific written consent under 42 CFR Part 2, even if that parent is a listed emergency contact.
Scenario 2: Employer or insurer inquiry
An employer or insurance company contacting a federally assisted SUD program to verify treatment participation will be denied any disclosure absent a compliant written consent — including denial of whether the individual is a patient. General HIPAA authorizations do not substitute for Part 2 consent forms.
Scenario 3: Criminal justice referrals
Patients referred to SUD treatment through drug court or probation agreements retain confidentiality rights. Disclosures to the referring court or probation officer require a specific consent from the patient or a court order that satisfies the requirements of 42 CFR § 2.61–2.67.
Scenario 4: Co-occurring mental health treatment
Facilities treating both SUD and co-occurring mental health conditions must track which records are governed by Part 2 versus standard HIPAA. The more protective standard applies to SUD-specific records. For broader context, mental health patient rights address the parallel framework governing psychiatric care.
Decision boundaries
42 CFR Part 2 vs. HIPAA — the primary distinction:
| Dimension | 42 CFR Part 2 | HIPAA Privacy Rule |
|---|---|---|
| Scope trigger | Federally assisted SUD treatment programs | All covered health entities |
| Consent required for disclosure? | Yes, in nearly all circumstances | Not always — treatment, payment, and operations often exempt |
| Family disclosure without consent | Not permitted | Permitted with limitations |
| Law enforcement disclosure | Severely restricted | Permitted in certain contexts |
| Redisclosure restrictions | Expressly prohibited; recipient cannot re-disclose | Limited by minimum necessary standard |
Correctional and court-ordered treatment:
Patients under court-ordered SUD treatment occupy a narrower rights space. Court orders can compel participation and certain reporting, but facilities remain bound by Part 2's consent and redisclosure rules unless a qualifying court order exists. The rights of incarcerated patients framework addresses the further restrictions that apply to patients receiving SUD treatment within a custodial setting.
Minors in SUD treatment:
State law governs whether minors can consent to SUD treatment independently. In states permitting minor consent, Part 2 protections may prevent parents from accessing records without the minor's consent — a direct departure from general pediatric medical practice. The pediatric patient rights framework outlines the broader consent landscape for minor patients.
Telehealth delivery:
SUD treatment delivered via telehealth platforms, including buprenorphine prescribing authorized under the SUPPORT Act and subsequent DEA rulemaking, remains covered by Part 2 when delivered by a federally assisted program. The patient rights in telehealth reference addresses how digital care modalities intersect with federal privacy standards.
When no program is federally assisted:
A private, self-pay SUD counseling practice that receives no federal funds, tax exemptions, or federal certification falls outside Part 2 jurisdiction. In that scenario, HIPAA and applicable state law govern. Patients should confirm a program's regulatory status directly with the facility.
References
- Substance Abuse and Mental Health Services Administration (SAMHSA) — 42 CFR Part 2 Overview
- 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records (eCFR)
- HHS Office for Civil Rights — HIPAA Privacy Rule
- Federal Register Vol. 85, No. 136 — SAMHSA Final Rule on Part 2 (July 15, 2020)
- 42 U.S.C. § 290dd-2 — Confidentiality of Records (as amended by the CARES Act)
- SAMHSA — Medication-Assisted Treatment (MAT)
- U.S. Department of Justice — Drug Enforcement Administration, Telemedicine and Controlled Substances