Table of contents
Public Health Data Without a Punitive State
Executive Summary
By this point in the series, the argument for reform is no longer just moral or political. It is operational.
Part 16 argued for pilot, measure, scale. Part 19 argued that the country already runs complicated health and controlled-substance systems. Part 24 made the ethical case for regulation. Those pieces create an obvious next question:
How do you measure outcomes without building a surveillance state?
That is the problem this chapter solves.
A serious reform model still needs data. It needs to know whether fatal overdoses are falling, whether nonfatal overdoses are shifting, whether people are entering care, whether follow-up after crisis is improving, and whether public money is buying better outcomes instead of more churn. But none of that requires turning treatment records into open law-enforcement files or building a punitive state around people who already fear care.
That is where public health data privacy matters.
HHS says the 2024 final rule for 42 CFR Part 2 allows de-identified disclosures to public health authorities while still restricting the use of substance use disorder records in civil, criminal, administrative, and legislative proceedings against patients without consent or court order.[1] HHS also says confidentiality protections matter because fear of discrimination or legal trouble can deter people from entering treatment.[1][2] At the same time, CDC’s Overdose Data to Action program shows that overdose surveillance can track fatal and nonfatal overdoses, data linkage, and linkage to care through public-health systems rather than through a punitive dragnet.[3][4][5]
So the point of this chapter is blunt:
• public health data privacy is not the enemy of evaluation
• overdose surveillance does not have to mean a surveillance state
• 42 CFR Part 2 and substance use disorder confidentiality are central to trust
• de-identified health data and the HIPAA minimum necessary rule already provide a usable model
• standardized outcome measures let systems track performance without criminalizing the people they are supposed to help
That is the natural continuation of the series. A humane drug policy reform model still measures results. It just does not do it by treating every patient like a suspect.
The Trust Problem This Chapter Solves
The state has already taught a lot of people a dangerous lesson:
If you tell the truth about drugs, the truth may be used against you.
That lesson kills trust, and trust matters more than policymakers like to admit.
HHS says substance use disorder confidentiality exists because fear of discrimination and fear of prosecution deter people from entering treatment.[1] The current HHS guidance on 42 CFR Part 2 says Part 2 records generally cannot be shared if they would identify someone as having or having had a substance use disorder unless the rule specifically permits it, and it emphasizes that SUD records cannot be used in legal proceedings against patients without consent or a court order and subpoena or similar legal mandate.[2]
That is not bureaucratic trivia.
It is the legal recognition that treatment systems fail when they feel like an arm of punishment.
A serious public health drug policy has to be able to answer two questions at once:
Are we measuring enough to know whether the policy works?
Are we protecting people enough that they will still come in the door?
If the answer to the first question is no, reform becomes rhetoric. If the answer to the second is no, reform becomes self-defeating.
That is why public health data privacy is not a side issue. It is the bridge between measurement and trust. And it is why Part 30 matters so much after Part 29’s discussion of shrinking black markets and Part 24’s ethical case for regulation.
1. Why Public Health Data Privacy Is a Core Part of Reform
A system that wants people to seek treatment cannot behave like every treatment record is raw material for future punishment.
That is the simplest case for public health data privacy.
HHS says the minimum necessary standard under HIPAA requires covered entities to limit use, disclosure, and requests for protected health information to the minimum necessary to accomplish the intended purpose. HHS also says organizations should identify who needs access, what categories of information they need, and under what conditions they should have that access.[6] HHS’s de-identification guidance adds that protected health information can be converted into de-identified health data through either the Expert Determination method or the Safe Harbor method, and that de-identified data are no longer restricted as PHI under HIPAA, even though some small risk of re-identification always remains.[7]
That means public health data privacy is not some abstract wish list. It already has a legal and technical framework.
A good reform model should start there.
It should assume:
• not everyone should see the same data
• not every system needs person-level information
• aggregated trends can answer many policy questions
• some person-level linkage is useful for public health, but it needs hard guardrails
• the burden is on the state to justify access, not on patients to justify privacy
That is also why drug legalization and drug policy reform do not need to fear data. They need to fear bad data governance. The problem is not measurement. The problem is measurement that behaves like criminal intelligence gathering instead of public health.
2. 42 CFR Part 2 and Substance Use Disorder Confidentiality Already Draw the Line
A lot of people talk as if a privacy-protective overdose-response system would require inventing new law from scratch.
It would not.
42 CFR Part 2 already draws a line between legitimate health uses and punitive misuse.
HHS’s updated fact sheet says the 2024 Part 2 final rule allows a single consent for future uses and disclosures for treatment, payment, and health care operations, allows redisclosure by HIPAA-covered entities in accordance with HIPAA after such consent, permits disclosure to public health authorities only if the records are de-identified according to HIPAA standards, and restricts the use of records and testimony in civil, criminal, administrative, and legislative proceedings against patients absent consent or a court order.[1] HHS also states that SUD treatment records cannot be used to investigate or prosecute the patient without written consent or a court order, and that records obtained in an audit or evaluation of a Part 2 program cannot be used to investigate or prosecute patients without those protections.[1]
That is a huge point for substance use disorder confidentiality.
It means the country already has a legal framework saying:
• treatment records are not ordinary evidence
• audits are not supposed to become prosecutorial tools
• de-identified health data can still support public-health action
• privacy is part of treatment access, not a luxury layered on top of it
HHS’s current Part 2 page adds that the 2024 final rule has been effective since April 16, 2024, compliance was required by February 16, 2026, and OCR now enforces Part 2. HHS also says anyone can file a Part 2 complaint beginning February 16, 2026, and that Part 2 programs must report breaches of unsecured records and notify affected individuals, the Secretary of HHS, and in some cases the media.[2]
That matters for two reasons.
First, it strengthens accountability.
Second, it gives patients a clearer reason to trust that substance use disorder confidentiality is not just a decorative promise.
So when policymakers say they want outcomes data, the answer is not “fine, then privacy has to go.” The answer is that 42 CFR Part 2 already shows how to collect, govern, and enforce privacy rules without giving up measurement.
3. Overdose Surveillance Can Work Without a Surveillance State
The term overdose surveillance scares people because “surveillance” sounds like watching named individuals.
But most of the time, public-health surveillance is really about patterns, trends, and rapid detection, not building dossiers.
CDC’s OD2A surveillance page says funded jurisdictions use required overdose surveillance infrastructure, morbidity surveillance, mortality surveillance, and in some places biosurveillance and data linkage to better capture, analyze, and disseminate overdose data.[3] CDC’s OD2A overview says the program supports states and localities in collecting accurate, comprehensive, and timely data on fatal and nonfatal overdoses and using those data to improve prevention strategies, linkage to care, and harm reduction.[4] CDC’s DOSE-SYS dashboard says nonfatal overdose data now come from 47 states and the District of Columbia through syndromic surveillance systems and electronic health record text queries for emergency-department visits.[5]
That is the right way to think about overdose surveillance.
It should answer questions like:
• Are nonfatal overdoses rising or falling?
• Are there new geographic hotspots?
• Are certain drug combinations spreading?
• Are follow-up and linkage to care improving?
• Which communities are bearing the highest burden?
Notice what none of those questions require by default:
• open law-enforcement access to treatment notes
• a criminal database attached to every overdose encounter
• broad sharing of patient identities beyond what public health teams actually need
This is the difference between overdose surveillance and a surveillance state.
A public-health system needs enough information to act. A punitive state wants enough information to control.
Those are not the same thing.
And CDC’s own structure supports that distinction. OD2A includes optional person-level data linkage and linkage-to-care surveillance, but it is housed in a public-health framework centered on prevention, care linkage, health-system engagement, and harm reduction, not on building a police tool.[3][4][8]
4. De-Identified Health Data and Minimum Necessary Beat Dragnet Data Collection
If a government wants to measure outcomes honestly, it should start with the least intrusive data model that still answers the question.
That is where de-identified health data and minimum necessary matter.
HHS says de-identification can be achieved through Expert Determination or Safe Harbor, and that de-identification supports beneficial secondary uses of data such as policy assessment and comparative-effectiveness analysis while mitigating privacy risk.[7] HHS’s Part 2 final rule specifically says de-identified records can be disclosed to public health authorities without patient consent, provided they meet HIPAA de-identification standards.[1] HHS also says the minimum necessary rule requires organizations to take reasonable steps to limit uses and disclosures to what is needed for the intended purpose and to develop policies identifying who needs access and what kinds of information they need.[6]
That gives policymakers a sane hierarchy for data governance:
Use aggregated data when aggregated data are enough
• fatal overdose counts
• nonfatal overdose trends
• region-level hot spots
• demographic disparities
• program-level performance dashboards
Use de-identified health data when analysis needs more precision
• evaluating statewide trends
• comparing hospitals or counties
• assessing whether follow-up care improved
• measuring time to treatment initiation or retention
Use person-level linkage only when there is a clear public-health need
• linking EMS, ED, and mortality data
• measuring repeat overdose risk
• identifying where care linkage is failing
• evaluating whether a program actually reaches people after crisis
That is the opposite of a surveillance state. It is a layered system where the default is public health data privacy, not maximum extraction.
And this is where the article ties back to Part 16’s “pilot, measure, scale” logic. You do not need punitive files to know whether a pilot reduced repeat overdoses, improved initiation of care, or increased 7-day follow-up. You need good data governance, clear indicators, and a firm legal separation between evaluation and prosecution.
5. Standardized Measures Let Systems Track Outcomes Without Criminalizing Patients
One reason public debate gets so sloppy is that people assume outcome measurement means inventing something invasive.
It does not.
A lot of the most useful outcome measures are already standardized.
NCQA’s Initiation and Engagement of Substance Use Disorder Treatment (IET) measure tracks whether a new SUD episode results in treatment initiation within 14 days and engagement within 34 days.[9] NCQA’s Follow-Up After Emergency Department Visit for Substance Use (FUA) measure tracks follow-up within 7 days and within 30 days after an ED visit for SUD or drug overdose.[10] NCQA’s Follow-Up After High-Intensity Care for Substance Use Disorder (FUI) measure tracks follow-up within 7 and 30 days after inpatient, residential, or withdrawal-management care for SUD.[11] CDC’s OD2A program also supports surveillance of linkage to and retention in care using standardized indicators at the local level.[3]
Those measures matter because they show how overdose surveillance and treatment evaluation can stay focused on system performance rather than personal punishment.
A serious reform model can measure:
• initiation
• engagement
• 7-day follow-up
• 30-day follow-up
• linkage to care
• retention in care
• repeat overdose rates
• overdose mortality trends
None of that requires turning treatment databases into law-enforcement resources.
It just requires disciplined data governance and consistent definitions.
This also connects back to Part 23, which warned about outcome ambiguity and system drift. Measuring outcomes without surveillance means not only protecting privacy, but also choosing indicators that are specific enough to matter.
And politically, this helps too. Part 22 argued that public buy-in is built through dashboards, transparency, and visible accountability. Standardized measures like IET, FUA, and FUI are exactly the kind of building blocks that allow that.
6. A Public-Health Dashboard Without a Punitive State
So what does a non-punitive measurement model actually look like?
Something like this.
Population-level dashboard
• fatal overdose rate
• nonfatal overdose ED visit rate
• naloxone administrations
• toxicology and emerging-drug signals
• regional hotspots
• disparities by age, race, and geography
Care-access dashboard
• IET initiation rate
• IET engagement rate
• FUA 7-day and 30-day follow-up rates
• FUI 7-day and 30-day follow-up rates
• time to first treatment appointment
• retention at 30, 90, and 180 days
System-performance dashboard
• program capacity
• medication access
• post-overdose outreach coverage
• percentage of patients linked to treatment on demand
• complaint and breach counts
• audit findings
Privacy and governance dashboard
• use of de-identified health data for public reporting
• person-level linkage approvals and purposes
• breach notifications
• OCR complaints under 42 CFR Part 2
• public notice of privacy practices
• independent evaluation findings
That is real measurement. It is also real public health data privacy.
It tells the public whether the policy is working, tells policymakers where the failures are, and tells patients that the system is still bounded by substance use disorder confidentiality, minimum necessary, and enforceable complaint rights.[2][6][13]
And it fits the rest of the series. A risk-based drug regulation model still needs data. A regulated pharmacy model for the highest-risk lane still needs evaluation. Treatment on demand still needs monitoring. But none of that requires building a punitive surveillance state. It requires separating health measurement from criminal control. That is the key design principle.
The Bottom Line
If reform cannot measure outcomes, it will drift.
If reform measures outcomes like a police operation, people will stop trusting it.
That is why Part 30 matters.
A serious model can protect public health data privacy while still running strong overdose surveillance. It can honor 42 CFR Part 2 and substance use disorder confidentiality while still evaluating outcomes. It can use de-identified health data, the minimum necessary rule, and standardized indicators like IET, FUA, and FUI to measure what matters. And it can do all of that without constructing a punitive surveillance state.
That is not weak government.
That is disciplined government.
Frequently Asked Questions
Why is public health data privacy so important in drug policy reform?
Because people are less likely to enter treatment if they fear their records will be used against them. HHS explicitly says confidentiality protections matter because fear of discrimination or legal trouble deters people from entering SUD treatment.[1][2]
Can overdose surveillance work without identifying everyone?
Yes. CDC’s OD2A and DOSE-SYS systems already use public-health surveillance to track fatal and nonfatal overdoses, hotspots, data linkage, and linkage to care without turning those systems into blanket criminal databases.[3][4][5]
What does 42 CFR Part 2 actually protect?
42 CFR Part 2 protects records that would identify a person as having, or having had, a substance use disorder in federally assisted programs. HHS says those records generally cannot be used in legal proceedings against patients without consent or a court order and subpoena or similar legal mandate.[1][2]
What role does de-identified health data play?
De-identified health data make it possible to analyze trends, evaluate policy, and disclose information to public health authorities while reducing privacy risk. HHS says HIPAA allows de-identification through Expert Determination or Safe Harbor.[1][7]
What does minimum necessary mean in practice?
The minimum necessary rule means organizations should limit access, use, and disclosure to what is needed for the purpose at hand and create policies identifying which workers need which data and under what conditions.[6]
How do treatment on demand and risk-based drug regulation fit here?
They fit because outcome measurement still matters in a humane system. A risk-based drug regulation model and a regulated pharmacy model still need evaluation, and treatment on demand still needs standardized follow-up and retention measures. The difference is that the data system serves care and accountability, not punishment.
References
[1] U.S. Department of Health & Human Services. Fact Sheet: 42 CFR Part 2 Final Rule. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
[2] U.S. Department of Health & Human Services. Understanding Confidentiality of Substance Use Disorder (SUD) Patient Records or “Part 2”. https://www.hhs.gov/hipaa/part-2/index.html
[3] Centers for Disease Control and Prevention. Overdose Data to Action: Surveillance Strategies. https://www.cdc.gov/overdose-prevention/php/od2a/surveillance.html
[4] Centers for Disease Control and Prevention. About Overdose Data to Action. https://www.cdc.gov/overdose-prevention/php/od2a/about.html
[5] Centers for Disease Control and Prevention. DOSE-SYS Dashboard: Nonfatal Overdose Syndromic Surveillance Data. https://www.cdc.gov/overdose-prevention/data-research/facts-stats/dose-dashboard-nonfatal-surveillance-data.html
[6] U.S. Department of Health & Human Services. Minimum Necessary Requirement. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html
[7] U.S. Department of Health & Human Services. Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule. https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
[8] Centers for Disease Control and Prevention. Overdose Data to Action: Prevention Strategies. https://www.cdc.gov/overdose-prevention/php/od2a/prevention.html
[9] NCQA. Initiation and Engagement of Substance Use Disorder Treatment (IET). https://www.ncqa.org/report-cards/health-plans/state-of-health-care-quality-report/initiation-and-engagement-of-substance-use-disorder-treatment-iet/
[10] NCQA. Follow-Up After Emergency Department Visit for Substance Use (FUA). https://www.ncqa.org/report-cards/health-plans/state-of-health-care-quality-report/follow-up-after-emergency-department-visit-for-substance-use-fua/
[11] NCQA. Follow-Up After High-Intensity Care for Substance Use Disorder (FUI). https://www.ncqa.org/report-cards/health-plans/state-of-health-care-quality-report/follow-up-after-high-intensity-care-for-substance-use-disorder-fui/
[12] Centers for Medicare & Medicaid Services. CMS Strengthens Monitoring and Evaluation Expectations for Medicaid 1115 Demonstrations. https://www.cms.gov/newsroom/press-releases/cms-strengthens-monitoring-evaluation-expectations-medicaid-1115-demonstrations
[13] U.S. Department of Health & Human Services. How to File a Health Information Privacy or Security Complaint. https://www.hhs.gov/hipaa/filing-a-complaint/complaint-process/index.html
If you want to follow the full series as it publishes, visit the full Drug Legalization Series. If you prefer audio conversations on recovery, reentry, and purpose, check the podcast page. For program directors building reentry and transition programming, see ReturnPath reentry curriculum. For the personal story behind this work, read A Vision of Hope. To invite Andrew for a keynote or panel, see speaking.