Maine Substance Abuse Record Privacy Laws: A Plain-English Guide to Your Rights and Provider Obligations

This plain-English guide explains how Maine protects the confidentiality of substance use disorder records, when disclosures are allowed, and what providers must do to stay compliant. It summarizes core rules under Maine law, HIPAA, and Federal 42 CFR Part 2 Compliance so you can make informed decisions about your care and your data. This is general information, not legal advice.

Confidentiality of Substance Use Disorder Records

What counts as a “substance use disorder record”

Substance Use Disorder Confidentiality protections apply to any information that identifies you as receiving, having received, or seeking diagnosis, treatment, or referral for a substance use disorder. This includes clinical notes, intake forms, billing records, lab results, and appointment logs that would reveal your status as a patient.

Who must comply

Providers in Maine must follow overlapping rules: state health-privacy statutes, HIPAA, and the federal confidentiality rule for SUD services (42 CFR Part 2). Part 2 applies to specialized SUD programs and to any covered entity that maintains Part 2 records. HIPAA applies broadly to covered providers, health plans, and their business associates.

Patient Consent Requirements

In most non-emergency situations, a provider needs your written consent before sharing Part 2–protected records. A valid consent should clearly state who may disclose, who may receive, what specific information may be shared, the purpose of the disclosure, an expiration date or event, and your right to revoke. You can limit the scope (for example, “medication list only”) and the recipients.

Treatment Facility Record Privilege

Maine recognizes strong privacy interests in treatment facility records. As a result, these records are privileged and may not be disclosed or used in proceedings without proper authorization or a qualifying court order. Providers must store SUD treatment information in a manner that prevents unauthorized access and must apply “minimum necessary” principles to any permitted disclosure.

Using and disclosing information without new consent

HIPAA allows sharing for treatment, payment, and health care operations, but Part 2 adds stricter limits. Even for care coordination, a Part 2 program generally needs your consent unless an exception applies. When disclosure is permitted, recipients must be notified that further re-disclosure is restricted by law.

Disclosure for Research Purposes

When research access is allowed

Your identifiable SUD records may be used for research only under narrow pathways: your specific consent or documentation that an Institutional Review Board (IRB) or equivalent privacy board has approved the study and data safeguards consistent with Part 2. De-identified data sets can often be shared more freely when they cannot be traced back to you.

Safeguards researchers must follow

Approved researchers must protect confidentiality, use only the minimum information needed, and prohibit re-identification or re-disclosure outside the research protocol. If results are published, they must not include information that could identify you.

Disclosure in Medical Emergencies

What qualifies as a medical emergency

Medical Emergency Disclosure without consent is allowed when immediate information sharing is necessary to address a bona fide emergency that poses a serious threat to your health or safety and you cannot provide consent in time. Only information needed to treat the emergency may be shared.

Documentation and follow-up

When a provider discloses SUD information during an emergency, they must document the date and time, the nature of the emergency, the information released, and to whom it was disclosed. After the emergency ends, normal confidentiality rules resume.

Emergency access through exchanges

If your records are accessible through a health information exchange, clinicians may use a break-the-glass feature to view restricted data in a true emergency. This access is audited and limited to what is necessary for immediate care.

Disclosure for Legal Proceedings

Court-Ordered Record Disclosure

A subpoena by itself is not enough to obtain Part 2–protected records. A court must issue a specific order after finding good cause, carefully limiting what may be disclosed, for what purpose, and to whom. The court must weigh your privacy against the need for the information and typically require protective measures to prevent misuse or public release.

Other legal disclosures

Providers may disclose limited information to law enforcement about crimes on program premises or against staff, and they must comply with certain mandated reporting laws (such as reports of suspected child abuse or neglect). Even in these cases, disclosures should be narrow and consistent with governing statutes.

Health Information Exchange Participation

How HealthInfoNet works in Maine

Maine’s statewide health information exchange, HealthInfoNet, allows participating organizations to share clinical data to improve care. However, Part 2–protected SUD information is segmented and more restricted than general medical data. Providers must manage consents and respect redisclosure limits when viewing or contributing SUD records.

HealthInfoNet Opt-Out

You may choose not to share your information through HealthInfoNet. To opt out, submit an opt-out request to HealthInfoNet or ask your provider’s office for assistance with the process. Opting out removes your data from routine exchange, though emergency access may still occur in life-threatening situations. You can change your mind later and opt back in.

Provider responsibilities when using the exchange

• Verify and honor patient preferences, including HealthInfoNet Opt-Out status.
• Segment SUD data where required and avoid improper re-disclosure.
• Use the minimum necessary information for the stated purpose.
• Maintain audit logs and respond promptly to revocations or amendments.

Client Rights and Access to Treatment

Your core privacy rights

• Access: You can request and receive copies of your records within legally required time frames.
• Amend: You can ask to correct or add to your record if you believe something is inaccurate or incomplete.
• Restrictions: You may request limits on certain uses or disclosures where the law allows.
• Accounting: You can request a list of certain disclosures that occurred without your authorization.
• Consent control: You may grant, limit, or revoke consent for sharing Part 2–protected information.

Access to care and non-discrimination

You generally cannot be denied treatment because you choose to protect your confidentiality. Programs should explain how care coordination works, when consent is needed, and what happens if you decline to share information, including any impacts on billing or external referrals.

How to exercise your rights

Ask your provider for the appropriate request form, proof of identity requirements, and expected timelines. Keep copies of any consents or revocations you sign. If you believe your rights were violated, you may file a written complaint with the provider and the appropriate state or federal oversight agency.

Federal Confidentiality of Substance Abuse Records

Overview of 42 CFR Part 2

Part 2 is the federal rule that provides extra protections for SUD treatment information. It generally requires written consent for disclosure, mandates a warning against re-disclosure, and allows limited exceptions such as medical emergencies, certain research, audits and evaluations, and narrowly tailored court orders.

How Part 2 and HIPAA work together

HIPAA sets a baseline for all protected health information, while Part 2 adds stricter conditions to records that would identify you as an SUD patient. Recent updates more closely align consent and enforcement concepts with HIPAA, but the core principle remains: when Part 2 applies, follow the stricter rule.

Practical compliance steps for providers

• Identify where Part 2 records are created or stored and segregate them when needed.
• Use clear, specific consent forms and honor revocations immediately.
• Include a no-redisclosure notice with each permitted disclosure of Part 2 information.
• Train staff on Medical Emergency Disclosure procedures and documentation.
• Establish court-order response protocols and involve counsel before releasing records.
• Review HealthInfoNet workflows to ensure appropriate segmentation and opt-out honoring.

Summary

Maine law, HIPAA, and 42 CFR Part 2 work together to protect sensitive SUD information. Most disclosures require your clear consent; limited exceptions exist for emergencies, qualified research, audits, and carefully restricted court orders. Providers must safeguard records, respect your choices, and document every step.

FAQs

What rights do patients have under Maine substance abuse record privacy laws?

You have the right to confidentiality, to access and get copies of your records, to request amendments, to limit certain disclosures, to receive an accounting of specific non-consented disclosures, and to control consents for sharing SUD information. You may also opt out of HealthInfoNet and file complaints if you believe your privacy was violated.

When can substance abuse records be disclosed without patient consent?

Disclosures without consent are limited to situations authorized by law, including bona fide medical emergencies, certain research with IRB or privacy-board approval, audits and evaluations, mandated reports (such as suspected child abuse or crimes on program premises), and court-ordered disclosures that satisfy strict legal criteria.

How does Maine law protect substance use disorder treatment records during legal proceedings?

Treatment records are privileged. A subpoena alone is not sufficient to compel release of Part 2–protected information. Courts must make specific findings of good cause, narrowly limit what is disclosed, and impose protective orders to prevent inappropriate use or re-disclosure, thereby safeguarding your privacy throughout the process.

What are the obligations of providers regarding patient confidentiality in Maine?

Providers must identify and segregate Part 2 records, obtain valid Patient Consent Requirements before disclosures unless an exception applies, include no-redisclosure notices, document emergency releases, honor HealthInfoNet Opt-Out preferences, maintain access and amendment processes, train staff, and respond correctly to Court-Ordered Record Disclosure requests. These steps ensure ongoing Federal 42 CFR Part 2 Compliance and protect your rights.