Oregon Privacy Laws for Inpatient Addiction Consult Services: A Practical Guide

Inpatient addiction consult teams often need to share information quickly with hospital clinicians, patients, families, and follow-up providers. The right to share depends on who created or holds the record, whether the service is a Part 2 program, the patient’s consent, and any stricter Oregon law that applies.

This guide focuses on practical distinctions for hospital services. It is not a substitute for advice about a specific hospital’s legal status, policies, or patient record.

When Does Federal Part 2 Apply to a Hospital Addiction Consult Service?

42 CFR Part 2 applies to records created by a federally assisted SUD program for diagnosis, treatment, or referral for treatment when the records identify a patient as having or having had a substance use disorder. Federal assistance can include Medicare participation, federal funding, or tax-exempt status. The program must also meet Part 2’s definition of a program: it holds itself out as providing, and provides, SUD diagnosis, treatment, or referral.

A hospital is not automatically a Part 2 program just because it treats patients with substance use disorders or receives federal support. Under the regulation, a program may be an identified SUD unit within a general medical facility, or staff whose primary function is SUD diagnosis, treatment, or referral and who are identified as providing those services. Ordinary emergency-room personnel who refer a patient with an apparent overdose to intensive care generally are not a Part 2 program, unless the relevant staff or service meets those criteria or the emergency department has promoted itself as providing SUD services. See 42 CFR §§ 2.11–2.12.

For an inpatient addiction consult service, assess how the service is organized and presented—not only the hospital’s overall status. Is the team an identified unit or group of identified SUD providers? Does it provide SUD diagnosis, treatment, or referral as a primary function? Is the program federally assisted? Document the analysis and identify which records the program creates or receives. Part 2 records can include intake, referral, billing, email, text, and other information, not just a specially labeled SUD chart.

Records created by a treating provider that is not subject to Part 2 do not become Part 2 records merely because that provider documents a patient’s SUD and treatment. But a non-Part 2 provider that receives protected records from a Part 2 program may have duties as a recipient, depending on the consent and the notice accompanying the disclosure. The regulation distinguishes these situations in 42 CFR § 2.12.

How Do Part 2 Consent Rules Support Inpatient Care Coordination?

Part 2 now permits a patient to give one written Part 2 consent for treatment, payment, and health care operations that covers future uses and disclosures for those purposes. A consent may name a recipient or use an allowed general description, such as the patient’s treating providers and health plans. The consent must still identify the information and purpose, explain revocation rights, include an expiration date or event, and meet other required elements. See 42 CFR § 2.31.

With a valid consent, an inpatient consult service may share covered records for care coordination within the consent’s scope. A HIPAA covered entity or business associate receiving records under a single TPO consent may use or redisclose them as HIPAA permits, except that the records cannot be used in proceedings against the patient without the separate authorization or court order required by Part 2. The consent does not authorize every disclosure for every purpose, and patients may revoke it in writing, subject to disclosures already made in reliance on it. See 42 CFR § 2.33.

Staff should verify that the consent covers the intended recipient, information, and purpose before sending records. Each disclosure made with written consent must include a copy of the consent or a clear explanation of its scope, along with the required Part 2 notice. See 42 CFR § 2.32. SUD counseling notes—separately maintained notes analyzing counseling conversations—require a specific consent and cannot be swept into a general TPO consent, subject to limited exceptions. See 42 CFR § 2.31(b).

What May Be Shared During a Medical Emergency?

A bona fide medical emergency disclosure is permitted when medical personnel need patient-identifying information to address a genuine medical emergency and the patient’s prior written consent cannot be obtained. The disclosure must be limited to what is necessary to meet the emergency; the exception is not a general permission to share SUD records for convenience or routine coordination.

Immediately after the disclosure, the Part 2 program must document the recipient and their facility affiliation, the person who made the disclosure, the date and time, and the nature of the emergency. See 42 CFR § 2.51. Oregon law also permits certain health care providers to disclose records as necessary to meet a medical emergency, but federal Part 2 requirements still apply to Part 2 records. See ORS 179.505(4)(a).

In practice, identify the medical personnel who need the information, share only what is needed for the emergency, and document the basis for using the exception. A patient’s inability to provide consent in an emergency does not, by itself, permit broad disclosure to family members or other nonmedical recipients.

When Can Part 2 Records Be Used in Legal Proceedings?

Part 2 generally bars using or disclosing protected records—or testimony describing them—in civil, criminal, administrative, or legislative proceedings against a patient unless the patient gives specific written consent or a court authorizes the use or disclosure under Part 2. That consent cannot be combined with a consent for another purpose, such as treatment or payment. A subpoena alone is not the Part 2 court order.

Even when a court order authorizes disclosure, the holder must receive a subpoena or similar legal mandate compelling disclosure before releasing the records. Part 2 also requires notice and an opportunity to be heard in circumstances specified by the law. See 42 CFR § 2.22(b)(1)(ii)(H) and HHS’s Part 2 patient notice guidance.

Oregon imposes additional restrictions for records within ORS 179.505: among other provisions, those records generally may not be used to initiate or substantiate proceedings against the individual or to investigate the individual, subject to statutory exceptions. Because both the record’s source and the requested use matter, route a Part 2 court order and subpoena through privacy or legal review rather than treating ordinary legal process as sufficient. See ORS 179.505(11) and 42 CFR § 2.20.

How Do Oregon Confidentiality Rules Affect SUD Records?

Oregon’s ORS 179.505 provides confidentiality protections for written accounts held by health care services providers that fall within the statute’s definitions. It generally restricts access and disclosure, while allowing specified disclosures, including certain treatment-related sharing and medical-emergency disclosures. The law also limits how recipients may further disclose records. Because the statute’s provider and record definitions matter, determine whether the specific hospital service and record fall within its scope rather than assuming it covers every Oregon hospital record identically. See ORS 179.505.

Where both state and federal requirements apply, a disclosure permitted by Part 2 is not automatically permitted under Oregon law. Part 2 expressly provides that it does not authorize a disclosure prohibited by state law. Apply the stricter rule when the laws differ, and use the applicable consent, emergency, or other exception before disclosing. See 42 CFR § 2.20.

For an inpatient service, a practical policy should identify which team members are part of a Part 2 program, which records are covered, and which Oregon confidentiality provisions apply to the hospital or its program. That lets clinicians coordinate care without assuming that HIPAA alone answers every SUD-record question.

What Consent Rights Apply to Minors Seeking Addiction Treatment?

Oregon law permits a minor to obtain outpatient diagnosis or treatment for a substance use disorder without parental knowledge or consent from a qualifying mental health care provider; the provision excludes methadone treatment. It also directs the person providing treatment to involve the minor’s parents before treatment ends, unless the parents refuse or clear clinical indications to the contrary are documented, with specified exceptions. The statute concerns outpatient treatment; it does not, by itself, establish that a minor may independently consent to every inpatient service. See ORS 109.675.

When a minor has legal capacity under state law to obtain SUD treatment without parental consent, Part 2 provides that only the minor may give written consent for covered uses or disclosures. A parent’s request for records—or a request to bill a parent’s plan—does not automatically transfer that consent authority. Part 2 has a narrow provision for communicating relevant facts to a parent or guardian when the program director determines that the minor lacks capacity to make a rational choice about disclosure and that a substantial threat to life or physical well-being may be reduced by communicating those facts. See 42 CFR § 2.14.

Oregon separately allows a mental health care provider to disclose relevant information to a parent or guardian in specified circumstances, including when inpatient treatment or detoxification in a residential or acute care facility is needed. That state permission does not eliminate a stricter federal Part 2 requirement for records held by a Part 2 program. For a minor’s inpatient consult, confirm who may consent to the treatment, whether the service is a Part 2 program, and whether a specific disclosure is permitted under both state and federal rules before sharing records with a parent or guardian. See ORS 109.680 and 42 CFR § 2.14.

What Privacy Notices and Breach Notifications Are Required?

Part 2 programs must give patients a plain-language privacy notice explaining permitted uses and disclosures, patient rights, the program’s duties, and how to make a complaint. The program must generally provide it no later than the first service after the compliance date; in an emergency treatment situation, it may provide the notice as soon as reasonably practicable. A Part 2 program that is also a HIPAA covered entity may use a combined notice if it meets both sets of requirements. See 42 CFR § 2.22 and HHS’s Part 2 guidance. Compliance with the 2024 Part 2 final rule was required by February 16, 2026. See HHS’s final-rule fact sheet.

A Part 2 program must maintain policies and procedures to protect patient-identifying information and must follow the HIPAA Breach Notification Rule for breaches of unsecured Part 2 records. Required notices may include notice to affected individuals, the HHS Secretary, and, in some cases, the media. Individual notice is generally due without unreasonable delay and no later than 60 days after discovery. For breaches affecting 500 or more individuals, notice to the Secretary is due within that period; for breaches affecting fewer than 500, reporting to the Secretary is generally due within 60 days after the end of the calendar year in which the breach was discovered. Media notice is required when a breach affects more than 500 residents of a state or jurisdiction. See 42 CFR § 2.16 and HHS breach-reporting guidance.

For Oregon inpatient addiction consult services, the core steps are to determine whether the service is a Part 2 program, identify which records are covered, confirm consent or a valid exception before disclosure, and apply any stricter Oregon rule. Clear workflows for care coordination, emergencies, minor patients, legal requests, privacy notices, and breaches help teams protect confidentiality while supporting treatment.

FAQs

Is an inpatient addiction consult service subject to 42 CFR Part 2?

It may be. Part 2 can cover an identified unit within a federally assisted general medical facility that holds itself out as providing, and provides, SUD diagnosis, treatment, or referral, or identified staff whose primary function is providing those services. A hospital’s ordinary emergency-room staff are not automatically covered just because they treat or refer a patient with an overdose. Assess the service’s structure, function, and public presentation, as well as the records at issue. See 42 CFR §§ 2.11–2.12.

Can a single Part 2 consent cover future care coordination disclosures?

Yes. A patient may give one written consent for future uses and disclosures for treatment, payment, and health care operations. The consent must meet Part 2’s requirements, and the disclosure must remain within its scope. A separate consent is required for SUD counseling notes, subject to limited exceptions, and a TPO consent does not authorize use of records against the patient in legal proceedings. See 42 CFR § 2.31.

When may SUD records be disclosed without consent in an emergency?

Part 2 allows necessary patient-identifying information to be disclosed to medical personnel to meet a bona fide medical emergency when prior written consent cannot be obtained. The program must document the disclosure and its circumstances immediately afterward. The exception is limited to what is needed for the emergency. See 42 CFR § 2.51.

Can a minor in Oregon control disclosure of addiction treatment records?

For outpatient SUD treatment that a minor may obtain under Oregon law without parental consent, Part 2 generally gives the minor—not the parent—authority to consent to covered disclosures. Federal rules provide a limited exception for communicating relevant facts to a parent or guardian when the program director makes the required capacity and substantial-threat determinations. Oregon law also contains specified disclosure provisions, but those do not remove stricter federal Part 2 requirements. See ORS 109.675 and 109.680 and 42 CFR § 2.14.