CIPP/US Study Guide
Chapter 8: Medical Privacy

Confidentiality of Substance Use Disorder Patient Records Rule

Rooted in 1970s laws, this rule protects patient-identifying information held by federally funded substance abuse treatment programs. It requires written consent, restricts redisclosure, and lists narrow exceptions. Violations are criminal ($500 first, $5,000 subsequent). It does not preempt stricter state law.

This rule descends from the 1970 Comprehensive Alcohol Abuse Act and the 1972 Drug Abuse Prevention Act. It covers Patient-identifying information held by a Program that receives federal funding and provides substance abuse diagnosis, treatment, or referral. It also restricts information that could substantiate criminal charges about drug or alcohol use.

Disclosure requires written patient consent; a general designation may permit disclosure to entities with a treating relationship, and the patient may request a list of recipients. Redisclosure of identifying information is prohibited.

  • Medical emergencies
  • Scientific research
  • Audits and evaluations
  • Communications with a qualified service organization (QSO)
  • Crimes on program premises or against program personnel
  • Child abuse reporting
  • Court order
Criminal penalties and HIPAA overlap

Violations are criminal: a first offense is fined no more than $500, subsequent offenses no more than $5,000, reported to the U.S. Attorney's Office. Entities are likely also subject to HIPAA, and the rule does not preempt stricter state law.

Key terms - quick answers

What is “Patient-identifying information”?
Any information that could reasonably identify, directly or indirectly, a person diagnosed with or treated for substance abuse.
What is “Program”?
Under the rule, an entity, unit, or staff (other than a general medical facility) that holds itself out as providing substance abuse diagnosis, treatment, or referral, and receives federal funding.
What is “QSO”?
Qualified service organization; an entity that may receive information without consent for information it needs to provide services to the program.