Substance use disorder (SUD) records are protected by federal law (42 CFR Part 2), requiring patient consent for most disclosures, stricter than general HIPAA rules.