For Professionals

Confidentiality

Guidance for the confidentiality of patient records for those working in the substance use disorder field.

Laws and Regulations

The Confidentiality of Substance Use Disorder (SUD) Patient Records federal regulations, also known as 42 CFR Part 2, protect the privacy of patients' SUD treatment records. 

The Pennsylvania Drug and Alcohol Abuse and Control Act is the statute that governs the confidentiality of client records prepared or obtained under the law. It applies to records of SUD treatment prepared or obtained by any SUD or medical provider.

In 2022, that law was amended when Act 33 of 2022 was signed into law. Act 33 makes Pennsylvania’s SUD confidentiality requirements consistent with federal law. Act 33 also prohibits DDAP from issuing or enforcing regulations that restrict disclosure of records or information that are permitted by federal law.

Stakeholder Input

Prior to the enactment of the new law, DDAP surveyed stakeholders to learn what partners think about requirements that control the sharing of information about clients in SUD treatment programs or information about SUD in a person's health record. View the survey results.  

Pennsylvania's Requirements

  • 4 Pa. Code § 255.5 is a regulation that limits the information and recipients of disclosure of client information by SUD projects and coordinating bodies.

  • 28 Pa Code § 709.28  is a regulation that applies confidentiality standards to treatment activities that are licensed under DDAP.

  • Compliance with Section 255.5 is also written into regulations of mental health and psychiatric treatment providers.  See, e.g., 55 Pa. Code § 5100.37

Webinar Series

The Confidentiality Webinar Series, developed for the substance use disorder field, addresses Act 33, common regulatory citations, and frequently asked questions. 

This two-part series is a supplement to the Substance Use Disorder Confidentiality Training available from DDAP's Training Management System.

Contact

If you are a drug and alcohol service provider with specific questions about how SUD confidentiality regulations apply to your organization, email: