Maintaining the confidentiality of patients’ substance use disorder (SUD) treatment is crucial to providing quality treatment and improves treatment outcomes.  Privacy protections ensure that individuals are not subject to negative consequences for seeking and receiving SUD treatment. These protections are particularly important for individuals receiving SUD treatment in jails and prisons.

This resource is meant to assist jails and prisons implementing programs providing medication for opioid use disorder (MOUD) in determining whether the privacy and security requirements of 42 CFR Part (Part 2) apply.

Key Points

• If a jail or prison is federally assisted, and its MOUD providers meet the definition of a Part 2 program, then the jail or prison must follow Part 2’s privacy and security requirements for all patient records created and maintained by the Part 2 program.

• If the jail or prison’s MOUD providers do not meet the definition of a Part 2 program – for example, because MOUD is provided by a general medical facility and there is no identified SUD unit or identified SUD providers – then the jail or prison does not have a Part 2 program.

• A jail or prison that is not a Part 2 program may be subject to the requirements of Part 2 as a “lawful holder” if it receives records from a Part 2 program.