Oregon behavioral health and substance use records: how ORS 179.505 and 42 CFR Part 2 layer on HIPAA

Behavioral health and substance use disorder records in Oregon are not governed by HIPAA alone. Two layers can sit on top of it: 42 CFR Part 2, the federal confidentiality rule for records held by a federally assisted substance use disorder program, and ORS 179.505, Oregon's health-records confidentiality statute for programs tied to the Oregon Health Authority. Both are stricter than HIPAA in the areas they touch, and where either is stricter, it — not HIPAA — is the rule you follow.

For a practice that treats mental health, addiction, or both, the practical question is rarely "does HIPAA apply?" It always does. The harder questions are which additional layer reaches this specific record, and what each layer adds on top of the federal baseline. This article walks through the three regimes, the 2024 changes to Part 2, and how Oregon's coordinated care system pulls behavioral health data toward sharing at the same time these rules pull it toward restriction.

Key takeaways

• Three regimes can reach a behavioral health record in Oregon: HIPAA (always), 42 CFR Part 2 (substance use disorder records held by a federally assisted Part 2 program), and ORS 179.505 (records held by an Oregon Health Authority–related provider).
• 42 CFR Part 2's 2024 final rule aligned consent with HIPAA — one consent can now cover future treatment, payment, and operations — but Part 2 records still cannot be used in legal proceedings against the patient without specific consent or a court order.¹
• ORS 179.505 adds an authorization-content standard and a five-working-day patient-access rule that are stricter than HIPAA's, for the providers it reaches.²
• Oregon's coordinated care rules direct a managed care entity and its network to share behavioral health diagnoses for whole-person care (OAR 410-141-3520), which sits in tension with — but does not override — Part 2's consent rules.³
• You resolve overlaps by applying the most protective rule that reaches the record; following the stricter rule never violates HIPAA, whose permissions are ceilings rather than mandates.

Why behavioral health records carry extra rules

HIPAA treats a psychotherapy note and an addiction-treatment record as protected health information, but it does not otherwise single most of them out for heightened protection — a covered entity may generally use and disclose protected health information for treatment, payment, and health care operations without separate authorization. Congress and the Oregon Legislature both concluded that some categories are sensitive enough that the ordinary permissions are too broad. Stigma, employment and housing consequences, and the risk that records surface in litigation led to a narrower gate for substance use and, in Oregon, for records held by behavioral health programs.

The result is layering. HIPAA sets a national floor; 42 CFR Part 2 and ORS 179.505 raise specific parts of it. HIPAA's own preemption rule preserves this: a state privacy provision that is more stringent than the federal standard is not preempted, under 45 CFR § 160.203.⁴ Part 2, as a separate federal statute, applies on its own terms.

The three regimes, and which records each reaches

Regime	What it reaches	Core restriction beyond HIPAA
HIPAA	All protected health information the practice holds	The federal floor — treatment/payment/operations permitted
42 CFR Part 2	Records identifying a patient as having a substance use disorder, held by a federally assisted Part 2 program	Consent-gated; no use in proceedings against the patient without specific consent or court order
ORS 179.505	"Written accounts" of health information held by an Oregon Health Authority–related "public provider"	Authorization-content rules; five-working-day patient access

The overlap is real but bounded. A solo private-pay therapist with no Oregon Health Authority relationship and no federal assistance may be governed by HIPAA alone. A community mental health program that also runs a state-licensed addiction treatment service can be inside all three at once for different records it holds.

42 CFR Part 2 and what the 2024 final rule changed

Part 2 is a federal law — 42 U.S.C. 290dd-2 and 42 CFR part 2 — that "protects the confidentiality of patient records for people receiving services for substance use disorders."⁵ It applies to a "Part 2 program": a federally assisted program that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment. Not every counselor is a Part 2 program, but many Oregon addiction-treatment services are, because Medicaid participation and other federal support meet the "federally assisted" test.

Historically Part 2 was far stricter than HIPAA and hard to operate alongside it. The 2024 final rule, which carried a compliance date of February 16, 2026, aligned the two while keeping Part 2's sharpest protections.¹ The changes that matter most to a practice:

• Single consent for treatment, payment, and operations. The U.S. Department of Health and Human Services (HHS) now allows "a single consent for all future uses and disclosures for treatment, payment, and health care operations," which remains valid until the patient revokes it in writing.¹ This ends the old requirement of a fresh consent for each disclosure.
• Redisclosure under HIPAA — with one hard limit. Once a HIPAA covered entity or business associate receives a Part 2 record under that consent, it may redisclose the record as HIPAA allows, "except for using the information in legal proceedings against the patient" absent specific consent or a court order.⁶ This carve-out is the enduring core of Part 2.
• SUD counseling notes. The rule created a category analogous to HIPAA's psychotherapy notes: SUD counseling notes require a separate patient consent and cannot ride on the general treatment/payment/operations consent.¹
• Breach notification and enforcement. The HIPAA Breach Notification Rule now applies to Part 2 records, and enforcement was aligned with HIPAA's civil and criminal penalty structure.¹

The takeaway: Part 2 is now much closer to HIPAA operationally, but the prohibition on using addiction records against the patient in a proceeding, and the separate consent for counseling notes, still make it stricter than HIPAA in exactly the moments that matter most.

ORS 179.505: Oregon's behavioral health confidentiality rule

Oregon's own confidentiality tightening lives in ORS 179.505, which governs disclosure of "written accounts" of individually identifiable health information held by a "health care services provider."² Its scope is narrower than it looks: it reaches records held by or for a "public provider," which the statute defines to include any program providing a full-day, part-day, or by-appointment program of treatment that is licensed, approved, established, maintained, or contracted with the Oregon Health Authority for alcoholism, drug addiction, or mental or emotional disturbance — plus community mental health programs and the private entities they contract with.²

The trigger is the Oregon Health Authority relationship, not government ownership. Where ORS 179.505 applies, it adds requirements beyond HIPAA:

• Authorization content. A disclosure made with the individual's authorization requires a written, signed, and dated authorization naming the disclosing provider, the recipient, the individual, the nature of the information, and a revocation statement with an expiration.²
• Faster patient access. The provider must disclose a copy of the written account to the individual or their representative "within a reasonable time not to exceed five working days" of a written request — faster than HIPAA's 30-day outer limit.²⁷
• Mental-health access denial. Access to psychiatric or psychological information may be denied where disclosure would be an immediate and grave detriment to treatment and is medically contraindicated by the treating professional.²
• Private right of action. Unlike Oregon's breach statute, ORS 179.505 is backed by a private suit for equitable relief and damages of actual loss or $500, whichever is greater, plus attorney fees.²

A general dental or primary-care office with no Oregon Health Authority nexus is usually outside ORS 179.505 — but a behavioral health program is often squarely inside it.

The coordinated care tension: whole-person sharing vs consent

Here is where Oregon's health system creates genuine friction. Most Oregon Health Plan members are enrolled with a coordinated care organization (CCO), and Oregon's coordinated care rules deliberately push behavioral health data toward sharing to enable integrated care. Oregon Administrative Rule 410-141-3520 directs a managed care entity and its provider network to "use and disclose sensitive diagnosis information including HIV and other health and behavioral health diagnoses within the MCE for the purpose of providing whole-person care," while treating that information as confidential and privileged and limiting redisclosure outside the network.³

That mandate is real, but it does not repeal 42 CFR Part 2. For substance use disorder records held by a Part 2 program, Part 2's consent rules still gate the disclosure — the whole-person-care duty and the Part 2 consent requirement have to be satisfied together. In practice, that means a Part 2 program participating in a CCO relies on the aligned treatment/payment/operations consent the 2024 rule now permits, rather than treating the care-coordination mandate as its own legal authority to disclose addiction records. Reading OAR 410-141-3520 as an override of Part 2 is the mistake to avoid.

Which rule controls when they overlap

The method is the same one HIPAA's preemption framework implies: apply the most protective rule that reaches the record.

• For a substance use disorder record held by a Part 2 program, Part 2 is generally the strictest layer — especially its bar on use in proceedings against the patient — and it controls there.
• For a behavioral health record held by an Oregon Health Authority–related provider, ORS 179.505's authorization-content and five-working-day access rules add obligations on top of HIPAA.
• For everything else, HIPAA is the operative rule.

Following the stricter layer never puts you out of step with HIPAA, because HIPAA's treatment, payment, and operations permissions are things a covered entity may do, not things it must do. The friction is operational, not a true legal conflict: the analysis for these records simply has more questions than HIPAA alone asks.

What this means for your HIPAA risk analysis

None of this changes the method of a HIPAA risk analysis under 45 CFR § 164.308(a)(1)(ii)(A). It changes the inputs. A defensible risk analysis for an Oregon behavioral health or addiction practice should record:

• whether the practice is a 42 CFR Part 2 program, and if so, how its consent forms, counseling-note handling, and redisclosure practices reflect the 2024 rule;
• whether ORS 179.505 reaches the practice through an Oregon Health Authority relationship, and if so, the authorization-content and five-working-day access rules;
• how any coordinated care organization contract flows down data-sharing and confidentiality duties, and how Part 2 consent is preserved within it; and
• how psychotherapy notes (45 CFR § 164.508(a)(2)) and SUD counseling notes are segregated and separately consented.⁸

A risk analysis that treats HIPAA as the only applicable law is incomplete for an Oregon behavioral health practice — it will miss the exact consent and access rules a regulator or plaintiff's counsel would look for first.

What Oregon behavioral health practices should do this month

1. Classify your records. Determine, in writing, whether you are a 42 CFR Part 2 program and whether ORS 179.505 reaches you through an Oregon Health Authority license, certification, or contract. Those two answers drive everything else.
2. Update consent forms to the 2024 Part 2 rule. If you are a Part 2 program, confirm your treatment/payment/operations consent, your separate SUD counseling-note consent, and your redisclosure notices match the rule that took effect for compliance on February 16, 2026.
3. Segregate counseling and psychotherapy notes. Keep SUD counseling notes and HIPAA psychotherapy notes separate from the general record so the heightened consent rules are enforceable.
4. Read your CCO contract's data-sharing terms. Confirm the whole-person sharing duties in the contract are reconciled with Part 2 consent for addiction records rather than treated as an independent authority to disclose.
5. Fold the state facts into your risk analysis. Record the Part 2 and ORS 179.505 obligations, and your minor-consent handling for adolescents, as part of your documented environment.

These steps prepare the ground. Turning them into a dated risk analysis, a gap report, and consent and access procedures a regulator would find defensible is the work itself — specific, citation-heavy, and easy to get wrong from a blank page. CoreFolio HIPAA walks through each step and produces that documentation with the structure already in place.

Sources

Footnotes

1. Confidentiality of Substance Use Disorder (SUD) Patient Records, final rule, 89 Fed. Reg. (Feb. 16, 2024) — single treatment/payment/ operations consent, redisclosure by HIPAA-covered recipients, SUD counseling notes, Breach Notification Rule application, and the February 16, 2026 compliance date. HHS fact sheet: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html — rule at https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records ↩ ↩² ↩³ ↩⁴ ↩⁵

2. ORS 179.505 (Disclosure of written accounts by health care services provider — "public provider" scope; written-authorization content; five-working-day patient access; mental-health access denial) and ORS 179.507 (private right of action). Oregon Revised Statutes, Chapter 179: https://www.oregonlegislature.gov/bills_laws/ors/ors179.html ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

3. OAR 410-141-3520 (Record Keeping and Use of Health Information Technology — managed care entity and provider network "shall use and disclose sensitive diagnosis information including HIV and other health and behavioral health diagnoses within the MCE for the purpose of providing whole-person care"; individually identifiable information treated as confidential and privileged). Oregon Secretary of State, Oregon Administrative Rules: https://secure.sos.state.or.us/oard/displayDivisionRules.action?selectedDivision=1728 — full text also at https://www.law.cornell.edu/regulations/oregon/Or-Admin-Code-SS-410-141-3520 ↩ ↩²

4. 45 CFR § 160.203 (preemption of contrary State law; "more stringent" exception for state privacy provisions). Electronic Code of Federal Regulations: https://www.ecfr.gov/current/title-45/section-160.203 ↩

5. Confidentiality of Substance Use Disorder (SUD) Patient Records ("Part 2"), 42 U.S.C. 290dd-2 and 42 CFR part 2. U.S. Department of Health and Human Services overview: https://www.hhs.gov/hipaa/part-2/index.html — regulation text at https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2 ↩

6. 42 CFR Part 2 — when a HIPAA covered entity or health plan receives a Part 2 record with a treatment/payment/operations consent, "that entity can share the record again without consent in all the ways that HIPAA allows, except for using the information in legal proceedings against the patient." U.S. Department of Health and Human Services: https://www.hhs.gov/hipaa/part-2/index.html ↩

7. 45 CFR § 164.524(b)(2) (HIPAA right of access — the covered entity must act on an access request "no later than 30 days after receipt"). Electronic Code of Federal Regulations: https://www.ecfr.gov/current/title-45/section-164.524 — full text also at https://www.law.cornell.edu/cfr/text/45/164.524 ↩

8. 45 CFR § 164.508(a)(2) (HIPAA — authorization required for most uses and disclosures of psychotherapy notes). Electronic Code of Federal Regulations: https://www.ecfr.gov/current/title-45/section-164.508 ↩