11.1 Confidentiality Foundations for ADC Practice

Why SUD Records Get Extra Protection

Federal law treats substance use disorder (SUD) treatment records as especially sensitive because the social and legal consequences of disclosure are severe: a person whose addiction history leaks can lose a job, housing, child custody, or freedom. To encourage people to enter treatment without fear, Congress created a confidentiality scheme that is stricter than HIPAA. That scheme is codified at 42 CFR Part 2 ("Part 2"), administered by the Substance Abuse and Mental Health Services Administration (SAMHSA).

Part 2 applies to federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral for treatment. "Federally assisted" is broad — it includes programs that are licensed, certified, registered with the DEA, tax-exempt, or that receive any federal funds (including Medicaid/Medicare). Most addiction-counseling settings the ADC works in are Part 2 programs.

Part 2 vs. HIPAA: The Core Distinction

HIPAA is the national baseline for protecting health information across all health care. Under HIPAA, most disclosures for treatment, payment, and health care operations (TPO) do not require patient authorization. Part 2 flips that default: it generally requires the patient's written consent before any disclosure of SUD records — even to another treating provider or a payer — with only a few narrow exceptions.

A second Part 2 feature with no HIPAA equivalent is the re-disclosure prohibition: once Part 2 information is lawfully shared, the recipient may not re-disclose it without a separate Part 2 consent, and the records keep their protected status downstream.

When both laws cover the same record, the stricter (more protective) standard governs — usually Part 2.

The 2024 Final Rule (Effective Date Anchors)

SAMHSA's 2024 Final Rule (published Feb 16, 2024; effective April 16, 2024; compliance/enforcement by Feb 16, 2026) brought Part 2 closer to HIPAA without abandoning its core protections. Key changes the ADC should recognize:

• A patient may now sign a single consent for all future disclosures for treatment, payment, and health care operations (TPO), instead of a separate consent per recipient.
• Penalties for Part 2 violations are now aligned with HIPAA civil and criminal penalties (previously Part 2 violations were treated as criminal fines).
• Patients gain HIPAA-style rights: an accounting of disclosures and the right to request restrictions.
• A new category of SUD counseling-session notes kept separate from the record requires its own specific consent and cannot ride on a broad TPO consent.

The re-disclosure prohibition and the consent-first default remain intact.

The No-Consent Exceptions (Memorize These)

Part 2 allows disclosure WITHOUT patient consent only in defined situations:

1. Medical emergency — to medical personnel treating a condition that poses an immediate threat to health and requires immediate intervention.
2. Court order — a Part 2-specific court order under §§2.61–2.67, which must be accompanied by a subpoena to actually compel disclosure. A subpoena alone is never enough.
3. Audit and evaluation — to qualified personnel reviewing program operations.
4. Research — under approved protocols with required protections.
5. Qualified Service Organization Agreement (QSOA) — for contracted services (e.g., lab, billing, IT) that the program needs to operate.
6. Crimes on program premises or against program personnel — limited reporting to law enforcement.
7. Child abuse and neglect reporting — Part 2 does not preempt state mandatory child-abuse reporting laws.

Note that suspected child abuse reporting is an exception, but Part 2 still restricts the SUD records' use in any later proceeding. On the exam, when none of these applies and there is no valid consent, the counselor does not disclose.

Exam Strategy and Common Traps

Confidentiality is part of Domain IV, Professional and Ethical Responsibilities on the IC&RC ADC blueprint. ADC items usually ask for the best ethical next step, not a state-specific legal opinion. Watch for these traps:

• Treating Part 2 like HIPAA and sharing with another provider "because it's for treatment" — Part 2 needs consent or a single TPO consent on file.
• Accepting a subpoena as sufficient — you also need a Part 2 court order.
• Forgetting the re-disclosure rule when a family doctor asks to pass records along.
• Confirming or denying that a person is even a patient — that fact itself is protected.

When the rule is unclear, the model behavior is to consult supervision, follow agency policy, disclose only the minimum necessary, and document the reasoning. This same calibrated pattern — protect privacy, verify consent or an exception, disclose the minimum necessary, and document — answers the large majority of confidentiality items, and it keeps the counselor inside both Part 2 and the IC&RC ethical-responsibility expectations rather than drifting into casual or over-broad sharing.