42 C.F.R. § 2.13 : Public Health — PUBLIC HEALTH SERVICE, DEPARTMENT OF HEALTH AND HUMAN SERVICES — GENERAL PROVISIONS — CONFIDENTIALITY OF SUBSTANCE USE DISORDER PATIENT RECORDS — GENERAL PROVISIONS — Confidentiality restrictions and safeguards

(a) General. The patient records subject to the regulations in this part may be disclosed or used only as permitted by the regulations in this part and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any federal, state, or local authority. Any disclosure made under the regulations in this part must be limited to that information which is necessary to carry out the purpose of the disclosure.
(b) Unconditional compliance required. The restrictions on disclosure and use in the regulations in this part apply whether or not the part 2 program or other lawful holder of the patient identifying information believes that the person seeking the information already has it, has other means of obtaining it, is a law enforcement agency or official or other government official, has obtained a subpoena, or asserts any other justification for a disclosure or use which is not permitted by the regulations in this part.
(c) Acknowledging the presence of patients: Responding to requests.
(1) The presence of an identified patient in a health care facility or component of a health care facility which is publicly identified as a place where only substance use disorder diagnosis, treatment, or referral for treatment is provided may be acknowledged only if the patient's written consent is obtained in accordance with subpart C of this part or if an authorizing court order is entered in accordance with subpart E of this part. The regulations permit acknowledgement of the presence of an identified patient in a health care facility or part of a health care facility if the health care facility is not publicly identified as only a substance use disorder diagnosis, treatment, or referral for treatment facility, and if the acknowledgement does not reveal that the patient has a substance use disorder.
(2) Any answer to a request for a disclosure of patient records which is not permissible under the regulations in this part must be made in a way that will not affirmatively reveal that an identified individual has been, or is being, diagnosed or treated for a substance use disorder. An inquiring party may be provided a copy of the regulations in this part and advised that they restrict the disclosure of substance use disorder patient records, but may not be told affirmatively that the regulations restrict the disclosure of the records of an identified patient.
(d) List of disclosures. Upon request, patients who have consented to disclose their patient identifying information using a general designation pursuant to § 2.31(a)(4)(ii)(B) must be provided a list of entities to which their information has been disclosed pursuant to the general designation.
(1) Under this paragraph (d), patient requests:
(i) Must be made in writing; and
(ii) Are limited to disclosures made within the past two years;
(2) Under this paragraph (d), the entity named on the consent form that discloses information pursuant to a patient's general designation (the entity that serves as an intermediary, as described in § 2.31(a)(4)(ii)(B) ) must:
(i) Respond in 30 or fewer days of receipt of the written request; and
(ii) Provide, for each disclosure, the name(s) of the entity(-ies) to which the disclosure was made, the date of the disclosure, and a brief description of the patient identifying information disclosed.
(3) The part 2 program is not responsible for compliance with this paragraph (d); the entity that serves as an intermediary, as described in § 2.31(a)(4)(ii)(B), is responsible for compliance with the requirement.

42 C.F.R. §2.13

82 FR 6115, 2/17/2017; 85 FR 43037, 8/14/2020