In addition to protections of the Health Insurance Portability and Accountability Act (HIPAA), the confidentiality of records of patients receiving substance use disorder (SUD) treatment services from a Penn Medicine SUD Treatment Program (Program) is protected under federal regulations known as Part 2 and applicable state laws.
This Notice describes how your health information protected by Part 2 and related to SUD treatment at this Program: (1) may be used and disclosed, (2) your rights with respect to this information, and (3) how to file a complaint concerning a violation of your rights concerning your information or the privacy or security of your information. You have a right to a copy of this Notice, in paper or electronic form, and to discuss it with the Penn Medicine Privacy Office, which is available at 215-573-4492 or privacy@uphs.upenn.edu if you have privacy questions or requests.
The Program is required by law to maintain the privacy of records and to notify affected patients following a breach of unsecured records. The Program is also required to provide patients this Notice describing its legal duties and privacy practices with respect to records and to abide by the terms of this Notice currently in effect. The Program reserves the right to change the terms of this Notice and to make new notice provisions effective for records that it maintains. The most up-to-date notice will be available through the Penn Medicine notice of privacy practices website pages and at all Program locations. This Notice supplements the information provided in the Penn Medicine HIPAA Notice of Privacy Practices to include protections from Part 2.
Use or disclosure without written consent
Generally, the Program may not disclose information identifying you as an individual who has or has had a substance use disorder or as a patient being treated by the Program without your consent. Part 2 regulations, however, permit the Program to use and disclose SUD information without patient consent in certain situations:
- Within the Program or between the Program and an entity that oversees it when staff need to know the information for patient SUD diagnosis, treatment, or referral
- Medical emergencies
- Scientific research subject to Health and Human Services and Federal Drug Administration requirements
- Management audits, financial audits, and Program evaluation
- With qualified service organization vendors as needed to provide services to the Program
- Reporting to law enforcement a crime or threat of crime at the Program or against Program staff
- Reporting suspected child abuse or neglect
- Subject to a court order that is issued after required notice and opportunity to be heard and that is accompanied by a subpoena or other legal mandate
Use or disclosure with written consent
We will seek and you can provide a single consent to permit all future uses and disclosures for treatment, payment and health care operations purposes. This consent is needed to help us provide and coordinate your care. For example, this will allow your providers to disclose to other treating providers and to payors your information to provide you the care you need, to obtain payment, and to allow for communications for continuity of care and with people helping operate or provide logistical support for the Program and Penn Medicine. If you do not provide this consent for treatment, payment and operations disclosures, Penn Medicine SUD programs may decline to provide SUD services to you. Recipients of your information that are covered by HIPAA or Part 2 are able to re-disclose your information as permitted by HIPAA, except they may not use or disclose the information in civil, criminal, administrative or legislative proceedings against you.
For uses and disclosures of information not described in this Notice, we would need your written consent. You can choose to provide additional consents for us to make disclosures of your SUD information.
You can change your mind and revoke a consent at any time by providing written notification to the Program. A revocation will not apply to any actions Penn Medicine has already taken relying on your consent.
Rights
You have a right to request restrictions of disclosures made with your prior consent for purposes of treatment, payment, and health care operations. We will review your request but are not required to agree unless the request relates to sharing information with your insurance provider, your care is fully paid by another source, and the disclosure is not otherwise required by law.
You have the right to a list of certain disclosures outside Penn Medicine including, if applicable, a list of disclosures by an intermediary, such as exchange or care management organization, for the past three years.
You have a right to elect not to receive fundraising communications. If you wish to opt out of receiving these communications, contact Penn Medicine Development.
You have the right to file a written complaint and will not be retaliated against:
- If you believe your privacy rights have been violated, you can file a complaint with the Program by sending it to the Penn Medicine Chief Privacy Officer, Office of Audit, Compliance & Privacy, St. Leonard’s Court, 3819 Chestnut Street, Suite 214, Philadelphia, PA 19104.
- You can also file a complaint for a violation of the Part 2 regulations with the Secretary of the U.S. Department of Health and Human Services (HHS) in Washington D.C. as described on the HHS website.
This Notice of Privacy Practices Supplement for Penn Medicine Part 2 Substance Use Disorder Treatment Programs is effective February 16, 2026.