It is no secret that the number of people living with substance use disorder (SUD) (including opioids) is large, widespread, and serious cause for concern. Many researchers are looking for ways to understand the scope of the problem and thereby develop interventions. However, SUD information, such as health insurance claims, is governed by different rules than other health care data.

Part two of item 42 in the Code of Federal Regulations (CFR) details the rules surrounding the confidentiality of information related to SUDs. Similar to HIPAA, which addresses the release and use of personal health information and allows for use of this data in specific instances, 42 CFR Part 2 has criteria for the release of SUD information. Compared to HIPAA, however, the circumstances that allow for sharing SUD data are very, very narrow.

Forty-two CFR Part 2 is designed to protect patients from the stigma associated with living with a SUD. Simply put, programs who treat SUD and who are federally funded, are not allowed to share any information SUD diagnosis or treatment without the patient’s written consent– except in very specific instances.

A “program” is defined as an “individual, entity (other than a general medical facility), or an identified unit in a general medical facility, that “holds itself out” as providing and provides diagnosis, treatment, or referral for treatment for a SUD. Medical personnel or other staff in a general medical facility who are identified as providers whose primary function is to provide diagnosis, treatment, or referral for treatment for a SUD are also Programs. “Holds itself out” means any activity that would lead one to reasonably conclude that the individual or entity provides substance use disorder diagnosis, treatment, or referral for treatment.”

The circumstances in which a program can release patient SUD information protect the safety of the patient and those around them:

  • They can share the information with medical personnel in the event of a medical emergency involving the patient.
  • Law enforcement can be apprised of a patient’s SUD if there is an immediate threat to the health and safety of the patient or to the staff of a treatment program.
  • There is an immediate threat to the health and safety of the patient or an individual if the information is not disclosed.
  • If there are reports of child abuse or neglect involving the patient.
  • Court-ordered release of information.

These criteria are the reason that the Colorado All Payer Claims Database (CO APCD) does not contain any claims involving SUDs. Submitters are not allowed to send them.

Substance use disorder claims are different from claims for opioid prescriptions and treatment. Opioids are frequently part of the care plan for individuals with chronic conditions like cancer and the CO APCD does collect these claims. However, should a patient prescribed opioids for a broken ankle become addicted and require opioid use disorder treatment, the CO APCD would have the claims all the way up until one appears with a substance use disorder diagnostic code – that one would not make it into the data warehouse.

In Colorado, 42 CFR Part 2 is also the reason that the CO APCD does not receive many claims indicating the use of marijuana. Though it is legal here, it remains classified as a controlled substance.

The Substance Abuse and Mental Health Services Administration (SAMHSA) has detailed fact sheets for providers on their website to help them navigate information sharing in accordance with 42 CFR Part 2.