Confidentiality: 42 CFR Part 2 and HIPAA

Why Confidentiality Dominates the Ethics Domain

Professional and Ethical Responsibilities account for roughly 15% of the IC&RC Alcohol and Drug Counselor (ADC) exam that New York CASAC candidates take. Within that domain, confidentiality is the highest-yield topic. Clients enter treatment expecting that their substance use history will not become public knowledge. Counselors who mishandle records destroy trust, invite lawsuits, and violate federal law. The exam does not ask you to memorize every subsection of the Code of Federal Regulations — it asks you to choose the legally and ethically correct action when records must be shared, withheld, or disclosed without consent.

42 CFR Part 2: The SUD-Specific Shield

42 CFR Part 2 is the federal regulation that protects the confidentiality of substance use disorder (SUD) patient records held by federally assisted programs. "Federally assisted" is broad: programs that receive federal funds, are tax-exempt, are registered to dispense controlled substances, or hold themselves out as providing SUD diagnosis or treatment generally fall under Part 2.

Part 2 protects any information that would identify a person as having or having had an SUD — not only clinical notes but also billing data, attendance records, and even the fact that someone is in treatment. The default rule is no disclosure without the patient's specific, signed written consent. The consent must state:

• Who is authorized to disclose and who may receive the information
• A description of the information to be shared
• The purpose of the disclosure
• An expiration date or event
• The patient's right to revoke consent in writing

Unlike many HIPAA scenarios, sharing SUD records with another healthcare provider for continuity of care still requires Part 2 consent in most cases. A general HIPAA authorization or a blanket medical release is not enough when Part 2 applies.

Part 2 also restricts use of SUD records in legal proceedings without a qualifying court order.

HIPAA: The Broader Healthcare Privacy Framework

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule applies to covered entities — health plans, healthcare clearinghouses, and providers who transmit health information electronically. HIPAA protects protected health information (PHI): individually identifiable health data.

Under HIPAA, providers may use and disclose PHI for treatment, payment, and healthcare operations (TPO) without a separate patient authorization in many routine situations. HIPAA also allows minimum necessary disclosures and requires a Notice of Privacy Practices.

Here is the exam trap: when Part 2 and HIPAA both apply, Part 2 is the stricter standard for SUD records. HIPAA does not loosen Part 2. If a program is subject to Part 2, you follow Part 2 for SUD-identifying information even when HIPAA would permit a broader disclosure.

Permitted Disclosures Without Patient Consent

Part 2 allows limited disclosures without consent, including:

• Medical emergencies — to medical personnel who need the information to treat a condition posing an immediate threat to life
• Crime on program premises or against program personnel
• Qualified audits and evaluations
• Research under approved protocols
• Court orders that meet Part 2's procedural requirements (not a mere subpoena)

HIPAA has its own exceptions (public health activities, abuse reporting where required by law, law enforcement in defined circumstances). On the exam, read whether the record identifies SUD treatment — that usually signals Part 2 analysis first.

The Duty to Warn and Protect

Confidentiality is not absolute. When a client communicates a credible, imminent threat of serious physical harm to an identifiable third party, counselors may have a duty to warn the potential victim and/or duty to protect through hospitalization, police notification, or other reasonable steps. This duty is grounded in Tarasoff-type case law and is reinforced in ethics codes.

Part 2 and HIPAA both contain pathways to disclose information necessary to prevent serious harm. The CASAC exam expects you to act promptly — not wait for supervision next week, not promise absolute secrecy, and not ignore a specific, credible threat because the client asked you to keep it confidential.

Practical CASAC Scenarios

Scenario A: A counselor wants to fax progress notes to a client's primary care physician. Under Part 2, the counselor needs a signed Part 2 consent naming the physician and describing what will be sent — unless another statutory exception applies.

Scenario B: A client in an opioid treatment program tests positive for cocaine. Sharing results with a probation officer requires consent or a qualifying court order.

Scenario C: A client says, "If my ex shows up at my job tomorrow, I'm going to kill her — she knows where I work." The counselor should assess imminence and specificity, document carefully, and initiate the duty-to-protect protocol, including notifying law enforcement or the identified person as agency policy and state law require.

Documentation and Client Education

Explain confidentiality and its limits at intake. Document every disclosure: what was shared, with whom, and under what legal authority.

Exam Strategy

When a question mentions SUD records, federally assisted program, or identifying someone as in treatment, think Part 2 first. When the question involves routine hospital billing with no SUD program involvement, HIPAA alone may govern. Wrong answers often describe HIPAA's looser TPO rules applied to Part 2 situations, or promise unlimited confidentiality when a threat or abuse report exception applies.