What is the difference between HIPAA privacy rules and 42 CFR Part 2 in the context of restricting and sharing a patient’s substance use treatment information?

• A. HIPAA prohibits disclosures for treatment scenarios unless there is consent.
• B. 42 CFR Part 2 applies to all health records regardless of substance use.
• C. HIPAA allows disclosures for treatment, payment, and health care operations with authorization or permitted uses; 42 CFR Part 2 provides stricter protections for substance use disorder records and generally requires patient consent for disclosures and limits redisclosure.
• D. HIPAA overrides 42 CFR Part 2 in all cases.

Answer: (C)

The main idea here is that HIPAA and 42 CFR Part 2 operate in different privacy spaces, with Part 2 providing tighter protections for substance use treatment records. HIPAA creates the baseline for protected health information across most health care contexts and generally allows disclosures for treatment, payment, and health care operations when there’s patient authorization or when a permitted use applies. In contrast, 42 CFR Part 2 specifically protects records that come from substance use disorder treatment programs and typically requires patient consent for disclosures and imposes strict limits on redisclosure. This means that, in practice, Part 2 often restricts what can be shared even when HIPAA would allow a disclosure with consent or for treatment. The two rules can both apply, but Part 2 does not get overridden by HIPAA in all cases; its protections are designed to be more restrictive for substance use treatment information. That combination—HIPAA’s treatment/disclosure framework plus Part 2’s stricter consent and redisclosure rules—best captures the difference.