Confidentiality of Substance Use Disorder Patient Records

Forms and Documents

Document	Type	Status	Availability
Justification Statement for Non-substantive Change - Part 2 Forms.pdf	Justification for No Material/Nonsubstantive Change	Uploaded 2025-11-14	Repair queued
Justification Statement for Non-substantive Change - Part 2 Forms.pdf	Justification for No Material/Nonsubstantive Change	Uploaded 2025-11-14	Repair queued
Supplemental Document Part 2 Investigative Agency Report Form.pdf	Supplementary Document	Uploaded 2025-11-14	Available
Supplemental Document Part 2 Investigative Agency Report Form.pdf	Supplementary Document	Uploaded 2025-11-14	Repair queued
Supplemental Document Part2_Breach_Portal_Questions.pdf	Supplementary Document	Uploaded 2025-11-14	Available
Supplemental Document Part2_Breach_Portal_Questions.pdf	Supplementary Document	Uploaded 2025-11-14	Missing upstream
3_1_2024 Part 2 Supporting Statement FINAL.docx	Supporting Statement A	Uploaded 2024-03-01	Repair queued
3_1_2024 Part 2 Supporting Statement FINAL.docx	Supporting Statement A	Uploaded 2024-03-01	Repair queued

IC Document Collections

IC ID	Collection	Type	Status	Form
264408	Programs Receiving a Complaint		Unchanged
264402	Attach consent form with each disclosure (paper records)		Unchanged
264401	Attach consent form with each disclosure (electronic records)		Unchanged
256946	Reports to the Secretary		Unchanged
256945	Right to Request Restrictions		Unchanged
256944	Accounting of Disclosures of Part 2 Records		Unchanged
256942	Right to Discuss Patient Notice		Unchanged
256941	Less than 500 Affected Individuals (investigating and documenting breach) -- affecting <10		Unchanged
256940	Less than 500 Affected Individuals (investigating and documenting breach) -- affecting 10-499		Unchanged
256923	500 or More Affected Individuals (investigating and documenting breach)		Unchanged
256921	Notice to Secretary (notice for breaches affecting fewer than 500 individuals)		Unchanged
256920	Notice to Secretary (notice for breaches affecting 500 or more individuals)		Unchanged
256919	Media Notice - Breach		Unchanged
256918	Individual Notice-Substitute Notice (individuals' voluntary burden to call toll-free number for information)		Unchanged
256917	Individual Notice-Substitute Notice (staffing toll-free number)		Unchanged
256916	Individual Breach Notice-Substitute Notice (posting or publishing)		Unchanged
256915	Individual Breach Notice-Written and E-mail Notice (processing and sending)		Unchanged
256914	Individual Breach Notice-Written and E-mail Notice (preparing and documenting)		Unchanged
256913	Individual Breach Notice-Written and E-mail Notice (drafting)		Unchanged
256890	Disclosures for Audit & Evaluation - Paper		Unchanged
256889	Disclosures for Audit & Evaluation - Electronic		Unchanged
256888	Disclosures for Research - Paper		Unchanged
256887	Disclosures for Research - Electronic		Unchanged
256886	Documenting Emergency Treatment Disclosures		Unchanged
256885	PDMP Reporting		Unchanged
256884	Obtaining Consent for TPO		Unchanged
256883	Patient Notice - Providing to Patient		Unchanged
256881	Breach Notification - Training		Unchanged
256880	Training Program Development		Unchanged
256879	Notice to Accompany Disclosure - Updating		Unchanged
256878	Updating Consent Form		Unchanged
256877	Obtaining Consent - Training		Unchanged
256862	Requests for Restrictions - Training		Unchanged
256861	Accounting of Disclosures - Training		Unchanged
256860	Patient Notice - Updating		Unchanged
256859	Patient Notice and Right to Discuss - Training		Unchanged
256858	Complaint Procedures & Nonretaliation- Training		Unchanged

ICR Details

OMB Control No: 0945-0010	ICR Reference No: 202511-0945-002
Status: Active	Previous ICR Reference No: 202401-0945-001
Agency/Subagency: HHS/OCR	Agency Tracking No:
Title: Confidentiality of Substance Use Disorder Patient Records
Type of Information Collection: No material or nonsubstantive change to a currently approved collection	Common Form ICR:  No
Type of Review Request: Regular
OIRA Conclusion Action: Approved without change	Conclusion Date: 01/15/2026
Retrieve Notice of Action (NOA)	Date Received in OIRA: 12/29/2025
Terms of Clearance:

	Inventory as of this Action	Requested	Previously Approved
Expiration Date	03/31/2027	03/31/2027	03/31/2027
Responses	15,178,340	0	15,178,340
Time Burden (Hours)	672,667	0	672,667
Cost Burden (Dollars)	0	0	0

---

Abstract: The Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR part 2) implement section 543 of the Public Health Service Act, 42 United States Code (U.S.C.) § 290dd-2, as amended by section 131 of the Alcohol, Drug Abuse and Mental Health Administration Reorganization Act (ADAMHA Reorganization Act), Pub. L., 102-321 (July 10, 1992) and section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), Public Law 116-136 (March 27, 2020). The regulations serve to protect the confidentiality of patient records created by federally funded programs for the treatment of substance use disorder. The Department of Health and Human Services has published regulatory changes to implement the CARES Act.

---

Authorizing Statute(s): US Code: 42 USC 290dd-2 Name of Law: Confidentiality of Records
  

Citations for New Statutory Requirements: PL: Pub.L. 116 - 136 3221 Name of Law: Coronavirus Aid, Relief, and Economic Security (CARES) Act

---

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:
0945-AA16	Final or interim final rulemaking	89 FR 12472	02/16/2024

---

Federal Register Notices & Comments

Did the Agency receive public comments on this ICR? Yes

---

Number of Information Collection (IC) in this ICR: 37

IC Title	Form No.	Form Name
500 or More Affected Individuals (investigating and documenting breach)
Accounting of Disclosures - Training
Accounting of Disclosures of Part 2 Records
Attach consent form with each disclosure (electronic records)
Attach consent form with each disclosure (paper records)
Breach Notification - Training
Complaint Procedures & Nonretaliation- Training
Disclosures for Audit & Evaluation - Electronic
Disclosures for Audit & Evaluation - Paper
Disclosures for Research - Electronic
Disclosures for Research - Paper
Documenting Emergency Treatment Disclosures
Individual Breach Notice-Substitute Notice (posting or publishing)
Individual Breach Notice-Written and E-mail Notice (drafting)
Individual Breach Notice-Written and E-mail Notice (preparing and documenting)
Individual Breach Notice-Written and E-mail Notice (processing and sending)
Individual Notice-Substitute Notice (individuals' voluntary burden to call toll-free number for information)
Individual Notice-Substitute Notice (staffing toll-free number)
Less than 500 Affected Individuals (investigating and documenting breach) -- affecting 10-499
Less than 500 Affected Individuals (investigating and documenting breach) -- affecting <10
Media Notice - Breach
Notice to Accompany Disclosure - Updating
Notice to Secretary (notice for breaches affecting 500 or more individuals)
Notice to Secretary (notice for breaches affecting fewer than 500 individuals)
Obtaining Consent - Training
Obtaining Consent for TPO
PDMP Reporting
Patient Notice - Providing to Patient
Patient Notice - Updating
Patient Notice and Right to Discuss - Training
Programs Receiving a Complaint
Reports to the Secretary
Requests for Restrictions - Training
Right to Discuss Patient Notice
Right to Request Restrictions
Training Program Development
Updating Consent Form

---

ICR Summary of Burden

	Total Approved	Previously Approved	Change Due to New Statute	Change Due to Agency Discretion	Change Due to Adjustment in Estimate	Change Due to Potential Violation of the PRA
Annual Number of Responses	15,178,340	15,178,340	0	0	0	0
Annual Time Burden (Hours)	672,667	672,667	0	0	0	0
Annual Cost Burden (Dollars)	0	0	0	0	0	0

Burden increases because of Program Change due to Agency Discretion: No

Burden Increase Due to:

Burden decreases because of Program Change due to Agency Discretion: No

Burden Reduction Due to:

Short Statement: Burden reductions occurred due to a statutory change that will reduce the number of written patient consents that programs and lawful holders of part 2 records are required to obtain. Burden increases occurred due to a statutory change that requires programs experiencing a breach of part 2 records to provide breach notification to affected patients, HHS, and at times, the media. Non-recurring burdens increased for one-time changes to update policies and procedures, implement workforce training, and revise the patient confidentiality notice. Please see the Supporting Statement for a full description of all changes to burdens and the justification for each change.

---

Annual Cost to Federal Government: $2,214,100

Does this IC contain surveys, censuses, or employ statistical methods? No

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination.     No

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination.     Yes

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? No

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? No

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? No

Is this ICR related to the Pandemic Response? No

---

Common Form ICR:  No

---

On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).

The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:

(a) It is necessary for the proper performance of agency functions;

(b) It avoids unnecessary duplication;

(c) It reduces burden on small entities;

(d) It uses plain, coherent, and unambiguous language that is understandable to respondents;

(e) Its implementation will be consistent and compatible with current reporting and recordkeeping practices;

(f) It indicates the retention periods for recordkeeping requirements;

(g) It informs respondents of the information called for under 5 CFR 1320.8 (b)(3) about:

(i) Why the information is being collected;

(ii) Use of information;

(iii) Burden estimate;

(iv) Nature of response (voluntary, required for a benefit, or mandatory);

(v) Nature and extent of confidentiality; and

(vi) Need to display currently valid OMB control number;

(h) It was developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected.

(i) It uses effective and efficient statistical survey methodology (if applicable); and

(j) It makes appropriate use of information technology.

If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.

Certification Date: 12/29/2025

---