View Information Collection Request (ICR) Package
Skip to main content
An official website of the United States government
The .gov means it's official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you're on a federal government site.
The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.
Search:
Agenda
Reg Review
ICR
This script is used to control the display of information in this page.
Display additional information by clicking on the following:
All
Brief
Abstract/Justification
Legal Statutes
Rulemaking
FR Notices/Comments
IC List
Burden
Misc.
Common Form Info.
Certification
View Information Collection (IC) List
View Supporting Statement and Other Documents
View ICR - Agency Submission
OMB Control No:
0945-0010
ICR Reference No:
202511-0945-002
Status:
Received in OIRA
Previous ICR Reference No:
202401-0945-001
Agency/Subagency:
HHS/OCR
Agency Tracking No:
Title:
Confidentiality of Substance Use Disorder Patient Records
Type of Information Collection:
No material or nonsubstantive change to a currently approved collection
Common Form ICR:
No
Type of Review Request:
Regular
Date Submitted to OIRA:
12/29/2025
Requested
Previously Approved
Expiration Date
03/31/2027
03/31/2027
Responses
15,178,340
15,178,340
Time Burden (Hours)
672,667
672,667
Cost Burden (Dollars)
0
0
Abstract:
The Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR part 2) implement section 543 of the Public Health Service Act, 42 United States Code (U.S.C.) ยง 290dd-2, as amended by section 131 of the Alcohol, Drug Abuse and Mental Health Administration Reorganization Act (ADAMHA Reorganization Act), Pub. L., 102-321 (July 10, 1992) and section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), Public Law 116-136 (March 27, 2020). The regulations serve to protect the confidentiality of patient records created by federally funded programs for the treatment of substance use disorder. The Department of Health and Human Services has published regulatory changes to implement the CARES Act.
Authorizing Statute(s):
US Code:
42 USC 290dd-2
Name of Law: Confidentiality of Records
Citations for New Statutory Requirements:
PL: Pub.L. 116 - 136 3221 Name of Law: Coronavirus Aid, Relief, and Economic Security (CARES) Act
Associated Rulemaking Information
RIN:
Stage of Rulemaking:
Federal Register Citation:
Date:
0945-AA16
Final or interim final rulemaking
89 FR 12472
02/16/2024
Federal Register Notices & Comments
Did the Agency receive public comments on this ICR?
Yes
Number of Information Collection (IC) in this ICR:
37
IC Title
Form No.
Form Name
500 or More Affected Individuals (investigating and documenting breach)
Accounting of Disclosures - Training
Accounting of Disclosures of Part 2 Records
Attach consent form with each disclosure (electronic records)
Attach consent form with each disclosure (paper records)
Breach Notification - Training
Complaint Procedures & Nonretaliation- Training
Disclosures for Audit & Evaluation - Electronic
Disclosures for Audit & Evaluation - Paper
Disclosures for Research - Electronic
Disclosures for Research - Paper
Documenting Emergency Treatment Disclosures
Individual Breach Notice-Substitute Notice (posting or publishing)
Individual Breach Notice-Written and E-mail Notice (drafting)
Individual Breach Notice-Written and E-mail Notice (preparing and documenting)
Individual Breach Notice-Written and E-mail Notice (processing and sending)
Individual Notice-Substitute Notice (individuals' voluntary burden to call toll-free number for information)
Individual Notice-Substitute Notice (staffing toll-free number)
Less than 500 Affected Individuals (investigating and documenting breach) -- affecting 10-499
Less than 500 Affected Individuals (investigating and documenting breach) -- affecting <10
Media Notice - Breach
Notice to Accompany Disclosure - Updating
Notice to Secretary (notice for breaches affecting 500 or more individuals)
Notice to Secretary (notice for breaches affecting fewer than 500 individuals)
Obtaining Consent - Training
Obtaining Consent for TPO
PDMP Reporting
Patient Notice - Providing to Patient
Patient Notice - Updating
Patient Notice and Right to Discuss - Training
Programs Receiving a Complaint
Reports to the Secretary
Requests for Restrictions - Training
Right to Discuss Patient Notice
Right to Request Restrictions
Training Program Development
Updating Consent Form
ICR Summary of Burden
Total Request
Previously Approved
Change Due to New Statute
Change Due to Agency Discretion
Change Due to Adjustment in Estimate
Change Due to Potential Violation of the PRA
Annual Number of Responses
15,178,340
15,178,340
0
0
0
0
Annual Time Burden (Hours)
672,667
672,667
0
0
0
0
Annual Cost Burden (Dollars)
0
0
0
0
0
0
Burden increases because of Program Change due to Agency Discretion:
No
Burden Increase Due to:
Burden decreases because of Program Change due to Agency Discretion:
No
Burden Reduction Due to:
Short Statement:
Burden reductions occurred due to a statutory change that will reduce the number of written patient consents that programs and lawful holders of part 2 records are required to obtain. Burden increases occurred due to a statutory change that requires programs experiencing a breach of part 2 records to provide breach notification to affected patients, HHS, and at times, the media. Non-recurring burdens increased for one-time changes to update policies and procedures, implement workforce training, and revise the patient confidentiality notice. Please see the Supporting Statement for a full description of all changes to burdens and the justification for each change.
Annual Cost to Federal Government:
$2,214,100
Does this IC contain surveys, censuses, or employ statistical methods?
No
Does this ICR request any personally identifiable information (see
OMB Circular No. A-130
for an explanation of this term)? Please consult with your agency's privacy program when making this determination.
No
Does this ICR include a form that requires a Privacy Act Statement (see
5 U.S.C. §552a(e)(3)
)? Please consult with your agency's privacy program when making this determination.
Yes
Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]?
No
Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]?
No
Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)?
No
Is this ICR related to the Pandemic Response?
No
Agency Contact:
Sherri Morgan 202 774-3042 sherri.morgan@hhs.gov
Common Form ICR:
No
On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).
The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:
(a) It is necessary for the proper performance of agency functions;
(b) It avoids unnecessary duplication;
(c) It reduces burden on small entities;
(d) It uses plain, coherent, and unambiguous language that is understandable to respondents;
(e) Its implementation will be consistent and compatible with current reporting and recordkeeping practices;
(f) It indicates the retention periods for recordkeeping requirements;
(g) It informs respondents of the information called for under 5 CFR 1320.8 (b)(3) about:
(i) Why the information is being collected;
(ii) Use of information;
(iii) Burden estimate;
(iv) Nature of response (voluntary, required for a benefit, or mandatory);
(v) Nature and extent of confidentiality; and
(vi) Need to display currently valid OMB control number;
(h) It was developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected.
(i) It uses effective and efficient statistical survey methodology (if applicable); and
(j) It makes appropriate use of information technology.
If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.
Certification Date:
12/29/2025
An official website of the United States government
The .gov means it's official.
The site is secure.
