California substance use disorder records: how 42 CFR Part 2 and state law layer on HIPAA

Substance use disorder (SUD) records in California are not governed by the federal Health Insurance Portability and Accountability Act (HIPAA) alone. Two layers can sit on top of it: 42 CFR Part 2, the federal confidentiality rule for records held by a federally assisted SUD program, and California Health and Safety Code § 11845.5, which makes the identity and treatment records of patients in state-regulated alcohol and drug programs confidential. Both are stricter than HIPAA in the areas they touch, and where either is stricter, it — not HIPAA — is the rule you follow.

For a practice that treats addiction, the practical question is rarely "does HIPAA apply?" It always does. The harder questions are which additional layer reaches this specific record and what each layer adds on top of the federal baseline. This article walks through the three regimes, the 2024 changes to Part 2, and how substance use records that fall outside both special regimes are still protected under the CMIA.

Key takeaways

• 42 CFR Part 2 protects records identifying a patient as having a substance use disorder, held by a federally assisted Part 2 program; its 2024 final rule (compliance date February 16, 2026) aligned consent with HIPAA but kept the bar on using records against the patient.¹
• California's Health and Safety Code § 11845.5 makes the identity and diagnosis, prognosis, or treatment records of patients in alcohol and drug programs regulated or assisted by the state confidential, disclosable only on written consent or a narrow set of exceptions.²
• For SUD information a practice holds outside a Part 2 program, the CMIA still treats it as medical information, and Civil Code § 56.101 lists substance use among the sensitive services whose electronic records the holding business must be able to segregate.³
• Part 2 records generally cannot be used in legal proceedings against the patient without specific consent or a court order — the enduring core of the rule.⁴
• You resolve overlaps by applying the most protective rule that reaches the record; following the stricter rule never violates HIPAA, whose permissions are ceilings rather than mandates.⁵

Why substance use records carry extra rules

HIPAA treats an addiction-treatment record as protected health information, but it does not otherwise single it out for heightened protection — a covered entity may generally use and disclose protected health information for treatment, payment, and health care operations without separate authorization.⁶ Congress and the California Legislature both concluded that substance use information is sensitive enough that the ordinary permissions are too broad. Stigma, and the risk that a treatment record surfaces in employment, family, or criminal matters, led to a narrower gate.

The result is layering. HIPAA sets a national floor; 42 CFR Part 2 and Health and Safety Code § 11845.5 raise specific parts of it. HIPAA's own preemption rule preserves this: a state privacy provision that is more stringent than the federal standard is not preempted, under 45 CFR § 160.203.⁵ Part 2, as a separate federal law, applies on its own terms.

The three regimes, and which records each reaches

Regime	What it reaches	Core restriction beyond HIPAA
HIPAA	All protected health information the practice holds	The federal floor — treatment, payment, and operations permitted
42 CFR Part 2	Records identifying a patient as having a substance use disorder, held by a federally assisted Part 2 program	Consent-gated; no use in proceedings against the patient without specific consent or court order
Health & Safety Code § 11845.5	Identity and treatment records of patients in alcohol and drug programs conducted, regulated, or assisted by California DHCS	Disclosure only on written consent or enumerated exceptions; protection survives after a person stops being a client

The overlap is real but bounded. A general primary-care office that notes a patient's history has protected health information but is not a Part 2 program. A state-licensed addiction treatment service that participates in Medicaid can be inside all three regimes at once for the records it holds.

42 CFR Part 2 and what the 2024 final rule changed

Part 2 is a federal law — 42 U.S.C. 290dd-2 and 42 CFR part 2 — that protects the confidentiality of patient records for people receiving services for substance use disorders.⁷ It applies to a "Part 2 program": a federally assisted program that holds itself out as providing, and provides, SUD diagnosis, treatment, or referral for treatment. Not every counselor is a Part 2 program, but many California addiction-treatment services are, because Medicaid participation and other federal support meet the "federally assisted" test.

Historically Part 2 was far stricter than HIPAA and hard to operate alongside it. The 2024 final rule, published in the Federal Register on February 16, 2024 with a compliance date of February 16, 2026, aligned the two while keeping Part 2's sharpest protections.¹ The changes that matter most to a practice:

• Single consent for treatment, payment, and operations. The U.S. Department of Health and Human Services (HHS) now permits a single consent for all future uses and disclosures for treatment, payment, and health care operations, which remains valid until the patient revokes it in writing.¹ This ends the old requirement of a fresh consent for each disclosure.
• Redisclosure under HIPAA — with one hard limit. Once a HIPAA covered entity or business associate receives a Part 2 record under that consent, it may redisclose the record as HIPAA allows, except for using the information in legal proceedings against the patient absent specific consent or a court order.⁴ This carve-out is the enduring core of Part 2.
• SUD counseling notes. The rule created a category analogous to HIPAA's psychotherapy notes: SUD counseling notes require a separate patient consent and cannot ride on the general treatment, payment, and operations consent.¹
• Breach notification and enforcement. The HIPAA Breach Notification Rule now applies to Part 2 records, and enforcement was aligned with HIPAA's civil and criminal penalty structure. Beginning on the compliance date, anyone may file a Part 2 complaint with the HHS Office for Civil Rights (OCR).¹

The takeaway: Part 2 is now much closer to HIPAA operationally, but the prohibition on using addiction records against the patient in a proceeding, and the separate consent for counseling notes, still make it stricter than HIPAA in exactly the moments that matter most.

California's own SUD confidentiality: Health & Safety Code § 11845.5

California adds its own tightening for programs tied to the state. Health and Safety Code § 11845.5 provides that the identity and records of the identity, diagnosis, prognosis, or treatment of any patient "maintained in connection with the performance of any alcohol and other drug treatment or prevention effort or function conducted, regulated, or directly or indirectly assisted by the department" are confidential, disclosable only for the purposes and under the circumstances the statute expressly authorizes.² The "department" is the California Department of Health Care Services (DHCS), which regulates and certifies SUD programs.

Where § 11845.5 applies, it works much like Part 2:

• Written consent is the general gate. The content of a protected record may be disclosed with the prior written consent of the client, but only to the extent, under the circumstances, and for the purposes stated in the signed release.²
• Narrow exceptions. Without consent, disclosure is limited to enumerated situations — for example, communications between qualified professionals within the program, a bona fide medical emergency, qualified research or audits with no patient identity revealed, and a court order granted on a showing of good cause.²
• No use to prosecute the client. Except under a qualifying court order, a protected record may not be used to initiate or substantiate criminal charges against a client or to conduct an investigation of a client.²
• The protection outlasts the treatment. The restrictions continue to apply to a person's records even after they stop being a client.²

The trigger is the DHCS relationship, not government ownership. A general outpatient practice with no DHCS SUD-program license is usually outside § 11845.5; a licensed or certified addiction treatment program is generally inside it.

Substance use records outside a special regime are still CMIA data

Not every record touching substance use sits inside Part 2 or § 11845.5. A general practice that documents a patient's substance use history, without being an SUD program, holds that information as ordinary medical information under California's Confidentiality of Medical Information Act (CMIA). It is not unprotected. The CMIA governs its disclosure, and Civil Code § 56.101 lists substance use among the "sensitive services" — alongside reproductive, sexual, gender-affirming, and mental health care — whose electronic records a covered business must be able to segregate, shield from certain out-of-state disclosure, and limit access to.³ Substance use information is never merely ordinary medical data in California.

Which rule controls when they overlap

The method is the one HIPAA's preemption framework implies: apply the most protective rule that reaches the record.

• For a substance use disorder record held by a Part 2 program, Part 2 is generally the strictest layer — especially its bar on use in proceedings against the patient — and it controls there.
• For a record held by a DHCS-regulated alcohol or drug program, Health and Safety Code § 11845.5's consent and no-prosecution rules add obligations on top of HIPAA.
• For substance use information a general practice holds, the CMIA and its sensitive-services rules govern.

Following the stricter layer never puts you out of step with HIPAA, because HIPAA's treatment, payment, and operations permissions are things a covered entity may do, not things it must do. The friction is operational, not a true legal conflict: the analysis for these records simply has more questions than HIPAA alone asks.

What this means for your HIPAA documentation

These rules land on your forms and procedures — the written policies and procedures HIPAA requires a practice to maintain under 45 CFR § 164.530(i). A California practice that touches substance use records should record:

• whether the practice is a 42 CFR Part 2 program, and if so, how its consent forms, counseling-note handling, and redisclosure practices reflect the 2024 rule;
• whether Health and Safety Code § 11845.5 reaches the practice through a DHCS license or certification, and the consent and no-prosecution rules that follow;
• whether the system holding substance use information outside a special program provides the Civil Code § 56.101(c) sensitive-services controls; and
• how SUD counseling notes and HIPAA psychotherapy notes are segregated and separately consented.⁸

A documentation set that treats HIPAA as the only applicable law is incomplete for a California SUD practice — it will miss the exact consent and legal-proceedings rules a regulator or plaintiff's counsel would look for first.

What California SUD practices should do this month

1. Classify your records. Determine, in writing, whether you are a 42 CFR Part 2 program and whether Health and Safety Code § 11845.5 reaches you through a DHCS license or certification. Those two answers drive everything else.
2. Update consent forms to the 2024 Part 2 rule. If you are a Part 2 program, confirm your treatment/payment/operations consent, your separate SUD counseling-note consent, and your redisclosure notices match the rule whose compliance date was February 16, 2026.
3. Segregate counseling and psychotherapy notes. Keep SUD counseling notes and HIPAA psychotherapy notes separate from the general record so the heightened consent rules are enforceable.
4. Treat substance use data as sensitive even outside a program. Substance use is a sensitive service under the CMIA, so confirm the system that holds those records provides the § 56.101(c) segregation and out-of-state disclosure controls — subdivision (c)(4) places those capability duties on the record-holding business rather than on a provider.
5. Write the state facts into your documentation. Record the Part 2, § 11845.5, and sensitive-services obligations in the policies and procedures that govern consent and disclosure.

These steps prepare the ground. Turning them into forms and procedures a regulator would find defensible is the work itself — specific, citation-heavy, and easy to get wrong from a blank page. CoreFolio HIPAA walks through each step and produces that documentation with the structure already in place.

Sources

Footnotes

1. Confidentiality of Substance Use Disorder (SUD) Patient Records, final rule, 89 Fed. Reg. 12472 (Feb. 16, 2024) — single treatment/payment/ operations consent, redisclosure by HIPAA-covered recipients, SUD counseling notes, Breach Notification Rule application, and the February 16, 2026 compliance date. U.S. Department of Health and Human Services: https://www.hhs.gov/hipaa/part-2/index.html — rule at https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records ↩ ↩² ↩³ ↩⁴ ↩⁵

2. Cal. Health & Safety Code § 11845.5 (confidentiality of the identity and records of the identity, diagnosis, prognosis, or treatment of patients maintained in connection with an alcohol and other drug treatment or prevention effort conducted, regulated, or directly or indirectly assisted by the Department of Health Care Services — disclosure only on prior written consent or enumerated exceptions; no use to initiate or substantiate criminal charges absent a qualifying court order; protection survives the end of treatment). California Legislative Information: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=HSC&sectionNum=11845.5. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

3. Cal. Civ. Code § 56.101 (duty to handle medical information so as to preserve confidentiality; the § 56.101(c) sensitive-services capabilities — limit access, prevent out-of-state disclosure, segregate, and automatically disable access — for records on the provision of sensitive services, which include substance use disorder services). California Legislative Information: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.101. ↩ ↩²

4. 42 CFR Part 2 — when a HIPAA covered entity or health plan receives a Part 2 record with a treatment/payment/operations consent, "that entity can share the record again without consent in all the ways that HIPAA allows, except for using the information in legal proceedings against the patient." U.S. Department of Health and Human Services: https://www.hhs.gov/hipaa/part-2/index.html ↩ ↩²

5. 45 CFR § 160.203 (preemption of contrary State law; the "more stringent" exception for state privacy provisions). Electronic Code of Federal Regulations: https://www.ecfr.gov/current/title-45/section-160.203 ↩ ↩²

6. 45 CFR § 164.506 (permitted uses and disclosures for treatment, payment, and health care operations, without authorization). Electronic Code of Federal Regulations: https://www.ecfr.gov/current/title-45/section-164.506 — full text also at https://www.law.cornell.edu/cfr/text/45/164.506 ↩

7. Confidentiality of Substance Use Disorder (SUD) Patient Records ("Part 2"), 42 U.S.C. 290dd-2 and 42 CFR part 2. U.S. Department of Health and Human Services overview: https://www.hhs.gov/hipaa/part-2/index.html — regulation text at https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2 ↩

8. 45 CFR § 164.508(a)(2) (HIPAA — a separate authorization is generally required to use or disclose psychotherapy notes, with narrow exceptions). Electronic Code of Federal Regulations: https://www.ecfr.gov/current/title-45/section-164.508 ↩