Puerto Rico Substance Abuse Record Privacy Laws: Your Rights and Provider Obligations

Federal Confidentiality Requirements for Substance Use Records

At the federal level, 42 U.S.C. § 290dd-2 and its implementing rule, 42 CFR Part 2, protect the confidentiality of substance use disorder (SUD) patient records created or maintained by “federally assisted” SUD programs. These protections limit when identifiable SUD information can be used or disclosed and apply to programs, lawful holders, HIPAA covered entities, and business associates that receive Part 2 records. ([hhs.gov](https://www.hhs.gov/hipaa/part-2/index.html))

Under the 2024 final rule, patients may give a single written consent for treatment, payment, and health care operations (TPO). When a HIPAA entity receives Part 2 records with a TPO consent, it can redisclose consistent with HIPAA—except that Part 2 records still cannot be used in legal proceedings against the patient without patient consent or a qualifying court order. Compliance was required by February 16, 2026. ([hhs.gov](https://www.hhs.gov/hipaa/part-2/index.html))

Part 2 now aligns penalties with HIPAA’s enforcement framework: HHS’s Office for Civil Rights (OCR) administers and enforces Part 2 and may impose civil money penalties under 45 CFR part 160, subparts C–E; criminal penalties under 42 U.S.C. § 1320d‑6 may also apply. Individuals can file Part 2 complaints with OCR beginning February 16, 2026. ([hhs.gov](https://www.hhs.gov/hipaa/part-2/index.html))

Puerto Rico Medical Record Privacy Regulations

Puerto Rico’s Patient Bill of Rights (24 L.P.R.A. § 3049) guarantees strict confidentiality of medical records, limiting disclosures to the patient’s written consent, court orders, or specific legal authorizations (for example, certain fraud or crime investigations). Providers and insurers must safeguard identity and furnish a copy of the record—without charge—within five working days after the physician–patient relationship ends. ([law.justia.com](https://law.justia.com/codes/puerto-rico/title-twenty-four/part-vii/chapter-132/3049/))

For behavioral health, the Ley de Salud Mental de Puerto Rico (Law 408‑2000) includes a Deber de Guardar la Confidencialidad and penalizes unauthorized disclosures. Facilities must protect clinical files against improper use and unauthorized access, and violations can carry criminal penalties. These local rules complement HIPAA and Part 2 without diminishing their protections. ([docs.pr.gov](https://docs.pr.gov/files/ASSMCA/Leyes/LEY%20408-2000.pdf))

Together, these statutes form Puerto Rico’s medical privacy framework—often described here as a Medical Record Confidentiality Act—operating alongside federal SUD rules.

Expungement Procedures for Substance Abuse Records

“Substance abuse records” in the expungement context generally means criminal records tied to drug or substance-related offenses—not confidential treatment records protected by 42 CFR Part 2. Expungement affects what appears on a criminal record certificate and what the public can see, while Part 2 keeps treatment records confidential. ([hhs.gov](https://www.hhs.gov/hipaa/part-2/index.html))

Misdemeanors

• Automatic removal: The Police Commissioner automatically removes a misdemeanor conviction from the criminal record certificate 30 days after completion of the sentence if no new crimes occurred and the person is not listed in certain registries (e.g., sex offenses, corruption, domestic violence). ([poderjudicial.pr](https://poderjudicial.pr/educacion-a-la-comunidad/informacion-sobres-temas-legales/casos-criminales/eliminacion-de-antecedentes-penales/))

Felonies

• Waiting period: Five years after completing the sentence.
• Petition: File in the Court of First Instance with the criminal record certificate, certified judgment, proof of sentence completion, two or more affidavits attesting to good reputation, DNA Data Bank certification, and any supporting documents. A hearing may be held, and the judge issues a decision granting or denying expungement. ([poderjudicial.pr](https://poderjudicial.pr/educacion-a-la-comunidad/informacion-sobres-temas-legales/casos-criminales/eliminacion-de-antecedentes-penales/))
• Implementation: If granted, request the Department of Justice to update and remove the offense. The court may also order the Office of Court Administration to restrict online publicity of specific cases. ([poderjudicial.pr](https://poderjudicial.pr/educacion-a-la-comunidad/informacion-sobres-temas-legales/casos-criminales/eliminacion-de-antecedentes-penales/))

Authority for Puerto Rico’s expungement process appears in Puerto Rico Law No. 254 of 1974, which governs criminal record certificates and expungement pathways for eligible offenses. ([bvirtualogp.pr.gov](https://bvirtualogp.pr.gov/ogp/Bvirtual/leyesreferencia/PDF/Polic%C3%ADa/254-1974/254-1974.pdf?ID=653&utm_source=openai))

Public Access Restrictions to Confidential Records

Puerto Rico’s Right to Information Law (Act 141‑2019) presumes public access but bars disclosure of information expressly classified as confidential by law, regulation, or court determination. That means medical records, SUD treatment records under 42 CFR Part 2, and court‑sealed materials remain off‑limits to public requests. ([bvirtualogp.pr.gov](https://bvirtualogp.pr.gov/ogp/Bvirtual/leyesreferencia/PDF/141-2019.pdf))

Part 2 further restricts use and disclosure: SUD records, or testimony about their contents, cannot be used in civil, criminal, administrative, or legislative proceedings against a patient without specific consent or a compliant court order. These limits apply regardless of general public-records principles. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.22?utm_source=openai))

Employment Protections Related to Substance Use

In the private sector, Puerto Rico’s Act 59‑1997 regulates drug testing. Notably, a first positive drug test does not constitute just cause for termination unless the employer first requires and allows the employee to attend an appropriate rehabilitation program. Employers must also follow strict procedural safeguards for testing and results. ([trabajo.pr.gov](https://www.trabajo.pr.gov/docs/Libreria_Laboral/Guias/Gui%CC%81as%20Legislacio%CC%81n%20de%20Discrimen%20DTRH.pdf))

Puerto Rico’s disability discrimination law (Law 44‑1985), as interpreted and amended, extends protections to registered medical cannabis patients, and Act 59 recognizes exceptions for substances used by prescription or otherwise authorized by law. Federal ADA rules still limit protections for current illegal drug use, and federal contractors must comply with the Drug‑Free Workplace Act. ([trabajo.pr.gov](https://www.trabajo.pr.gov/docs/Libreria_Laboral/Guias/Gui%CC%81as%20Legislacio%CC%81n%20de%20Discrimen%20DTRH.pdf))

Public policy also favors reintegration—the Rehabilitation Preference Mandate in practice. By Law 174‑2011 (amending Law 254‑1974), authorities may issue a Certificate of Rehabilitation and Capacity to Work to qualified individuals, supporting job opportunities after sentence completion. ([lexjuris.com](https://www.lexjuris.com/lexlex/Leyes2011/lexl2011174.htm?utm_source=openai))

Sealed and Expunged Record Protections mean that once a record is expunged and systems are updated, employers generally should not obtain or rely on those entries; Puerto Rico’s judiciary also enables orders to restrict online case publicity. ([poderjudicial.pr](https://poderjudicial.pr/educacion-a-la-comunidad/informacion-sobres-temas-legales/casos-criminales/eliminacion-de-antecedentes-penales/))

Provider Obligations for Consent and Disclosure

Determine Part 2 applicability. If you are a federally assisted SUD program—or you receive and hold Part 2 records—you must give patients a Part 2 privacy notice, train staff on confidentiality, and limit uses/disclosures to those the rule allows. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.22?utm_source=openai))

Use valid written consents. A Part 2‑compliant consent (paper or electronic) must include specific elements (recipient designation, purpose, description of information, expiration, revocation rights, and required statements). The 2024 rule allows a single TPO consent; however, records still cannot be used against the patient in legal proceedings without distinct consent or a qualifying court order. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31?utm_source=openai))

Honor patient access rights and local privacy rules. Puerto Rico law guarantees patients prompt access to their medical records and imposes a strict confidentiality duty for mental health files. Ensure release workflows satisfy both Part 2 and Puerto Rico statutes, including any court‑order prerequisites. ([law.justia.com](https://law.justia.com/codes/puerto-rico/title-twenty-four/part-vii/chapter-132/3049/))

Legal Remedies and Compliance Enforcement

Federal: As of February 16, 2026, OCR enforces Part 2 and may impose civil money penalties under HIPAA’s Enforcement Rule; criminal penalties may apply for knowing violations. Patients can file Part 2 complaints with OCR. ([hhs.gov](https://www.hhs.gov/hipaa/part-2/index.html))

Puerto Rico public records: If access is denied under Act 141‑2019, requesters can file a Special Judicial Review in the San Juan Court of First Instance; courts may order disclosure, and agencies that defy orders can face daily fines up to statutory limits. ([bvirtualogp.pr.gov](https://bvirtualogp.pr.gov/ogp/Bvirtual/leyesreferencia/PDF/141-2019.pdf))

Employment: Employees may bring claims over improper testing practices (Act 59‑1997) or unjust dismissal (e.g., Law 80), depending on the facts. Consult the statute and guidance to assess remedies. ([law.justia.com](https://law.justia.com/codes/puerto-rico/2023/title-twenty-nine/part-i/chapter-8/161a/?utm_source=openai))

Bottom line: Federal Part 2 and HIPAA rules shield treatment information; Puerto Rico law adds robust medical record protections, targeted expungement pathways, and employment safeguards that emphasize rehabilitation and respect Sealed and Expunged Record Protections. ([hhs.gov](https://www.hhs.gov/hipaa/part-2/index.html))

FAQs.

What federal laws protect substance abuse records in Puerto Rico?

42 U.S.C. § 290dd‑2 and 42 CFR Part 2 protect SUD records kept by federally assisted programs. The 2024 final rule permits a single TPO consent, aligns penalties with HIPAA, and—effective February 16, 2026—places enforcement with HHS OCR while preserving the bar on using SUD records against a patient without consent or a qualifying court order. ([hhs.gov](https://www.hhs.gov/hipaa/part-2/index.html))

How does Puerto Rico law regulate medical record confidentiality?

Section 3049 of Puerto Rico’s Patient Bill of Rights requires strict confidentiality, limits disclosures to consent, court order, or specific legal authority, and guarantees timely access to copies. For mental health, Law 408‑2000 imposes a Deber de Guardar la Confidencialidad and penalizes unauthorized disclosures. ([law.justia.com](https://law.justia.com/codes/puerto-rico/title-twenty-four/part-vii/chapter-132/3049/))

What are the criteria for expunging substance abuse records?

For criminal records: certain misdemeanors are removed automatically 30 days after sentence completion if conditions are met; most felonies require a five‑year wait and a court petition with supporting documents. If granted, the Department of Justice updates the record and courts may restrict online case publicity—securing Sealed and Expunged Record Protections. ([poderjudicial.pr](https://poderjudicial.pr/educacion-a-la-comunidad/informacion-sobres-temas-legales/casos-criminales/eliminacion-de-antecedentes-penales/))

Can employers use substance abuse test results to terminate employees?

Under Act 59‑1997, a first positive drug test alone is not just cause for termination; the employer must first require and allow rehabilitation consistent with the statute and its procedures. Additional positives, refusal to test, or policy violations may justify adverse action; federal contractors may also have stricter obligations. ([trabajo.pr.gov](https://www.trabajo.pr.gov/docs/Libreria_Laboral/Guias/Gui%CC%81as%20Legislacio%CC%81n%20de%20Discrimen%20DTRH.pdf))