Oregon Substance Abuse Record Privacy Laws Explained

Confidentiality of Substance Abuse Records

Oregon treats substance abuse treatment information as especially sensitive. Programs, clinics, and professionals must protect your identity, diagnosis, and treatment details from unauthorized use or disclosure. This protection draws from state rules, Oregon Department of Human Services regulations, and federal requirements that set higher privacy standards for substance use disorder (SUD) records than for most other health information.

In child welfare settings, confidentiality is reinforced through Child Welfare Law Confidentiality principles and related policies. Oregon Administrative Code SS 413-010-0030, which addresses access and confidentiality in child welfare case records, helps guide how caseworkers and contractors handle SUD-related information obtained in the course of services. These rules operate alongside program-level privacy policies that restrict who may view or share your records.

Programs typically limit access to a “need-to-know” basis, apply role-based permissions in electronic systems, and provide training on HIPAA Substance Abuse Protections and federal substance use privacy laws. You should also receive a written notice describing your privacy rights and the ways your information may be used and disclosed.

Disclosure Regulations for Substance Abuse Records

Oregon providers follow strict criteria before sharing SUD records. In general, disclosure is permitted only when a recognized legal pathway exists and only the minimum necessary information is released. Common pathways include:

• Your written consent through a Release of Information Authorization that is specific, time-limited, and revocable.
• Medical emergencies when disclosure is necessary to address an immediate threat to your health or safety.
• Internal communications within a program or among personnel providing your care, limited to what is necessary for treatment.
• Audits, quality reviews, or evaluations by authorized oversight bodies, with restrictions on any re-disclosure.
• Court orders that meet specialized federal standards for SUD information; ordinary subpoenas or requests are not enough without the required judicial findings.
• Mandated reports, such as suspected abuse or neglect, made to the proper authorities as strictly required by law.
• De-identified or aggregated data that cannot be linked back to you.

Even when disclosure is allowed, programs document the legal basis, disclose only what is necessary, and include required notices warning recipients that further disclosure is prohibited unless another law permits it.

Federal Confidentiality Requirements

At the federal level, 42 U.S. Code § 290dd-2 and its implementing regulations (often referred to as “Part 2”) set the cornerstone standards for SUD record privacy. These rules generally prohibit disclosing information that would identify you as having a substance use disorder or receiving treatment, unless an exception applies or you provide a compliant written consent.

Part 2 works in tandem with HIPAA Substance Abuse Protections. HIPAA governs most health information, while Part 2 adds extra safeguards for SUD records—particularly limits on re-disclosure and on use of records in civil, criminal, administrative, and legislative proceedings without a qualifying court order. Modern rules also clarify how consent can authorize disclosures for treatment, payment, and health care operations, while preserving core protections such as the prohibition on improper re-disclosure.

Providers in Oregon must harmonize these federal protections with state law. When laws differ, the more protective rule applies to your SUD information.

Medical Records Privacy Protections

Beyond SUD-specific rules, your medical records are protected by HIPAA and state privacy statutes. Providers must apply the minimum necessary standard, maintain secure storage, and limit access to staff who need information to perform their duties. You are entitled to privacy notices that explain how your data is used, shared, and safeguarded.

Prescription Drug Monitoring Program privacy adds another layer. Oregon’s PDMP tracks dispensing of controlled substances to support safe prescribing and reduce diversion. Access is restricted to authorized users for clearly defined purposes, and any use of PDMP data involving SUD treatment information remains subject to federal and state confidentiality limits. PDMP data is not a free source of treatment records and cannot be used to bypass Part 2 or HIPAA protections.

Client Rights to Access Records

You have important rights to your own records. Upon request, you may inspect or obtain copies of your SUD and medical records within legally required timeframes, except in limited situations where access could endanger life or physical safety or would reveal confidential third-party information.

You may request amendments to correct inaccuracies, ask for an accounting of certain disclosures, and request restrictions or confidential communications (for example, using an alternative mailing address). Programs must explain how to submit requests and how decisions will be communicated to you. If a request is denied, you are usually entitled to a written explanation and information on how to challenge or supplement the record.

Authorization Procedures for Record Release

When disclosure depends on your permission, providers must use a Release of Information Authorization that meets both HIPAA and Part 2 requirements. A valid authorization typically includes:

• Your full name and identifying information, and the name(s) of the program(s) authorized to disclose.
• Exactly what information will be shared (for example, intake notes, diagnoses, therapy summaries, medication history), and for what purpose.
• The name of the person or organization authorized to receive the information.
• An expiration date or event, your signature and date, and a clear statement that you may revoke consent at any time in writing.
• A federally required notice that further disclosure is prohibited unless permitted by law.

Electronic and paper authorizations are both common, provided they capture all required elements. Special considerations apply in child welfare and family court matters: Oregon Department of Human Services regulations and Oregon Administrative Code SS 413-010-0030 guide how consents are obtained and used, who may sign in various custody or guardianship situations, and how disclosures are limited to the stated purpose.

Prohibited Disclosures of Substance Abuse Information

Some disclosures are flatly prohibited or tightly constrained. Programs may not:

• Use or disclose SUD records for law enforcement, civil, administrative, or legislative proceedings without a qualifying court order that meets federal standards.
• Re-disclose SUD information received from another program unless the re-disclosure is expressly permitted by law or covered by the original consent.
• Sell SUD information or use it for marketing or fundraising without your specific authorization.
• Disclose to employers, schools, or the public without a valid Release of Information Authorization or another lawful basis.
• Post or share identifiable information on social media or in public forums.
• Use PDMP data outside permitted purposes; Prescription Drug Monitoring Program privacy rules and federal SUD protections still apply.

In sum, Oregon providers must layer state confidentiality duties with HIPAA Substance Abuse Protections and the heightened federal safeguards under 42 U.S. Code § 290dd-2. Thoughtful consent practices, narrow disclosures, and strict limits on re-disclosure help ensure your treatment information remains private and used only for legitimate, authorized purposes.

FAQs

What protections exist for substance abuse records in Oregon?

Substance abuse records in Oregon are protected by a combination of state privacy rules, Oregon Department of Human Services regulations, HIPAA, and federal SUD confidentiality law under 42 U.S. Code § 290dd-2. Together, these standards restrict access to your identity and treatment details, limit re-disclosure, and require strong administrative, technical, and physical safeguards to keep your information confidential.

When can substance abuse records be disclosed in Oregon?

Disclosure is allowed only in clearly defined circumstances, such as with your signed Release of Information Authorization, during a medical emergency, for internal treatment communications, for audits or evaluations, when required by specific mandated reporting laws, or under a qualifying court order that meets federal SUD standards. Even then, programs disclose only what is necessary and provide notices that prohibit further re-disclosure unless permitted by law.

How does federal law affect Oregon's substance abuse record privacy?

Federal law—particularly 42 U.S. Code § 290dd-2 and its regulations—adds stronger protections on top of HIPAA, especially for SUD information that identifies you as a patient. It limits how records can be used in legal proceedings, tightens rules on re-disclosure, and sets specific consent requirements. Oregon providers must comply with these federal rules; when federal and state standards differ, the more protective rule applies.

What rights do clients have regarding access to their substance abuse records?

You may inspect or obtain copies of your records, request corrections, ask for an accounting of certain disclosures, and request restrictions or confidential communications. Programs must explain how to submit requests and respond within required timeframes, subject to limited exceptions for safety or to protect third-party confidentiality. If access is limited or denied, you are entitled to a written explanation and information about next steps.