OCR Resources in Support of Substance Use Disorder Treatment Month

The United States Office for Civil Rights (OCR) is issuing this announcement in recognition of Substance Use Disorder Treatment Month, which serves to support people contemplating or seeking help for their substance use; practitioners treating or considering treating substance use disorder; and friends, family, and loved ones of those with substance use conditions.  OCR supports substance use disorder treatment through activities such as public education and guidance, and the administration and enforcement of relevant authorities, including the HIPAA Privacy Rule and the requirements for the Confidentiality of Substance Use Disorder Patient Records at 42 C.F.R. Part 2.

HIPAA Privacy Rule

At times, health care providers may need to share mental and behavioral health information to enhance patient treatment and to ensure the health and safety of the patient or others.  Parents, friends, and other caregivers of individuals with mental health conditions or substance use disorder play an important role in supporting the patient’s treatment, care coordination, and recovery.  The HIPAA Privacy Rule is designed to protect the privacy of all individuals’ identifiable health information and to ensure that health information is available when needed for treatment and other appropriate purposes.  Given the sensitive nature of mental health and substance use disorder treatment information, OCR is highlighting this collection of guidance addressing HIPAA protections, the obligations of covered health care providers, and some of the circumstances in which covered providers can share protected health information related to mental and behavioral health with an individual’s friends, family, and loved ones.  This guidance includes fact sheets, decision charts, and frequently asked questions on:

• HIPAA Helps Mental Health Professionals to Prevent Harm
• HIPAA Helps Family and Friends Stay Connected with Loved Ones Who Have a Substance Use Disorder, including Opioid Abuse, or a Mental or Behavioral Health Condition
• When can I obtain treatment information about my loved one? (Decision Chart)
• If You Experience a Health or Mental Health Crisis, HIPAA Helps Your Doctors, Nurses, and Social Workers to Reconnect You with Family, Friends, and Caregivers
• How HIPAA Allows Doctors to Respond to the Opioid Crisis
• When Your Child, Teenager, or Young Adult has Mental Illness: What Parents Need to Know about HIPAA
• Am I my child's personal representative under HIPAA?
• When may a mental health professional use professional judgment to decide whether to share a minor client’s treatment information with a parent?
• When can parents access information about their minor child’s mental health treatment? (Decision Chart)
• HIPAA Privacy Rule and Sharing Information Related to Mental Health
• Additional FAQs on Sharing Information Related to Treatment for Mental Health or Substance Use Disorder—Including Opioid Abuse
• HIPAA and Personal Representatives for Adults and Minors
• Mental Health FAQs
  

Confidentiality of Substance Use Disorder (SUD) Patient Records Regulations at 42 C.F.R. Part 2 (“Part 2”)

Part 2 protects the privacy of patients’ SUD treatment records.  In 2024, OCR and the Substance Abuse and Mental Health Services Administration (SAMHSA), published a final rule that increases coordination among providers treating patients for SUDs, strengthens confidentiality protections through civil enforcement, and enhances integration of behavioral health information with other medical records to improve patient health outcomes.  Please see OCR’s fact sheet for more information on the Part 2 changes.  Beginning on February 16, 2026, the public may file complaints alleging violations of Part 2, breaches of unsecured Part 2 records must be reported, and OCR may begin investigation and enforcement activities.  OCR will provide additional information about Part 2 in a future announcement, including how to file Part 2 complaints and breach reports.  OCR will also share a Model Part 2 Patient Notice, and an Updated HIPAA Privacy Rule Notice of Privacy Practices.