HIPAA confidentiality in rehab means federal privacy rules protect your treatment records. However, the level of protection depends on your consent, the record type, and the provider. Many addiction treatment programs must follow HIPAA. Some must also follow 42 CFR Part 2, which is stricter. Exceptions exist for both rule sets. Therefore, rehab records are not always fully confidential.
See our guide to addiction treatment privacy laws for a wider view of how these laws differ. Our editorial team works at a treatment directory. This guide is general information, not legal advice or a review of any specific program.
Which Federal Privacy Laws Cover Rehab Records
Two federal laws guard your privacy during treatment. HIPAA reaches most health care providers, plans, and clearinghouses handling electronic transactions.[1]
42 CFR Part 2 covers federally assisted programs. These programs offer diagnosis, treatment, or referral for substance use disorder.[2]
These laws cover different areas. A provider following HIPAA does not mean Part 2 protects every record. Both can apply to the same treatment. It depends on the provider, record, and situation.
| Law | Who or What Is Covered | General Confidentiality Approach | What a Patient Should Ask |
|---|---|---|---|
| HIPAA | Clearinghouses, plans, and providers using covered electronic transactions[1] | The Privacy Rule protects protected health information in any format; the Security Rule demands safeguards for electronic protected health information.[3][4] | “Are HIPAA rules followed by my provider or plan?” |
| 42 CFR Part 2 | Federally assisted programs giving SUD diagnosis, treatment, or referral[2] | Sets stricter limits on sharing substance use disorder records.[2] Recent updates allow one consent for future uses and disclosures for treatment, payment, and health care operations.[5] | "Is this program subject to Part 2 rules?" |
Knowing these differences helps you see which rights apply to you. Mental health confidentiality laws update often. The 2024 Part 2 final rule compliance date was February 16, 2026.[6] Legal details change, so check current federal sources or ask your provider’s privacy officer for the latest policies.
Getting Copies of Your Own Records
State clearly which records you need and where to send them.
Not all files are shared in the same way. Psychotherapy notes, for example, follow different rules. They are not given to patients automatically, unlike other records.[7] Our section on therapists and notes explains these differences. Substance use disorder records may also have specific federal protections under 42 CFR Part 2.[2]
If a facility rejects your request, they must provide a written reason. You may be able to ask for a review of that decision, depending on the reason.
HIPAA Privacy Rule and Info Sharing
Sharing info under the HIPAA Privacy Rule depends on who asks and why. Everyone does not get the same answer. The table lists general rules. Your case may be different. Ask your treatment program what applies to you.
| Who is asking | General rule | Consent or legal limits | What you can ask |
|---|---|---|---|
| Family or friends | May learn limited info if you agree or don’t object.[8] | If you are unable to speak for yourself, they may share info to help you. | "Can I sign a release so my mom knows my progress?" |
| Employer | Generally won’t get your records just because you work there. | In rare cases, court orders or specific laws may force disclosure. | "Will my boss find out I’m here?" See privacy and workplace rights. |
| Insurer | They can get info for health care operations and payment. | Part 2 rules add extra limits for substance use records. | "What exactly does my insurer see when they pay?" |
| Court | A regular subpoena isn’t enough for Part 2 records.[2] | A special court order meeting strict Part 2 standards is needed.[2] | "Is this a valid Part 2 court order?" See rehab records and background checks. |
Relatives
If you can decide, your provider needs your agreement first.[8] You can say yes, no, or choose what to share. A medical crisis might cause this. It aids your care.
Jobs
Your employer does not automatically get your rehab records. A provider may share info if you sign a valid authorization. Another legal exception may also apply. This is true even if your job pays for treatment. Check what a release form or employer-funded deal covers before signing.
Court Orders and Legal Rules
Requests from the law differ greatly. Federal Part 2 rules protect substance use disorder records. A standard subpoena does not automatically let a facility release them.[2] A separate court order is usually needed for those records. That order must meet stricter legal tests.[2]
Steps to Take Before You Sign a Release
A release of information form lets a rehab center share specific records. It does not guarantee all details are shared or kept private. Recent changes to 42 CFR Part 2 let one consent cover future uses for treatment, payment, and health care operations. However, this only applies to disclosures to HIPAA-regulated entities, not all future recipients.[5] Read the form carefully before you sign it.
You have the right to know what data leaves your record and the reason for it. Ask questions if the language seems vague or too wide.
Part 2 Consent Requirements
Your ticks are saved on this device only.
If you change your mind, ask the program how to cancel permission in writing. Remember that some sharing may have already happened while your consent was valid. Read our guide to rehab admission paperwork for more on forms and starting steps.
Everyday Ways Programs Keep Your Info Private
To keep your data secure, rehab programs use several layers of protection. The Security Rule requires HIPAA-covered entities to use reasonable and appropriate administrative, physical, and technical safeguards for electronic protected health information.[4] This often includes locking file cabinets, using password-protected portals, and restricting which staff members can see your chart.
This does not ensure only care-related staff see your record. Ask the program who can access your files and what rules apply. HIPAA also requires covered entities and business associates to sign contracts. These contracts ensure business associates safeguard protected health information.[3]
HIPAA-covered entities must designate a privacy official to create and carry out privacy policies.[9] Ask if the program follows HIPAA and who to contact with privacy questions.
Use these five practical examples to consider how your privacy is handled. They are not legal rules:
- Ask which staff members are allowed to see your records.Ask about access.
- Ask about digital safeguards. Ask how the program secures online records.
- Ask about vendors. Ask if outside companies handle your data and how they protect it.
- Check communications. Ask how staff verify who they are speaking with before sharing details.
- Find out who to reach if you have a privacy concern.Find the privacy contact.
Privacy Check-In
This self-check is for information only and does not determine whether a law was violated.
Therapist Records and Psychotherapy Notes
HIPAA applies based on the provider's legal status, not the service name. Not all therapists or counseling centers are covered. Some private counselors may follow different state privacy laws instead. If your rehab program is a covered entity, its therapists must follow HIPAA rules.
Knowing the gap between these two record types is useful. HIPAA defines these terms specifically. Your general mental health record differs from psychotherapy notes.
| Feature | Ordinary Mental Health Records | Psychotherapy Notes |
|---|---|---|
| Storage | Stored in the main patient chart. | Kept apart from the main part of the patient’s file.[7] |
| Purpose | Used for billing, coordinating care, and tracking general treatment. | Primarily intended for the personal use of the treating mental health clinician.[7] |
| Access Rights | You generally have a right to view and copy these records. | You are not required to be given access to these notes like other records.[7] |
| Disclosure | Can be shared for treatment, payment, and operations without specific authorization in many cases. | Generally need separate authorization to disclose, with limited HIPAA exceptions.[7] |
Psychotherapy notes get special protection because they are stored separately. They generally require a separate authorization to be shared, but HIPAA allows limited exceptions, including certain uses by the note’s author for treatment, disclosures required by law, health oversight activities, and disclosures to avert serious threats to health or safety.[7] The rules depend on the circumstances, so ask your provider which rules apply.
If you are moving from rehab to outpatient therapy, ask your new provider how they handle these notes. Understanding this distinction can help you manage your privacy while still coordinating mental health care effectively.
Handling a Possible Privacy Breach
Follow these steps if you think your private health information was released without your consent. This guide offers general options. It does not give legal advice.
- Write down the facts. Write down the date, the info you think was disclosed, and who took part. Save any emails or letters linked to the matter.
- Contact the program’s privacy official. Get the person’s name and direct contact details. Explain that you have a privacy concern, then ask how to submit it in writing.
- Ask about their review process. Ask how they plan to investigate, what timeline they use, and how they will notify you of the final result.
- Consider a formal complaint if needed. If the program’s response doesn’t resolve your concern, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). You may also look at your state attorney general’s office for more options. Submitting a complaint does not ensure a set outcome. OCR uses its criteria to decide if it will investigate.
Privacy Limits, Exceptions and State Laws
You might hear that HIPAA has only three exceptions to confidentiality. This claim is not entirely accurate. There is no single, universal list of “three exceptions” that covers every situation.
HIPAA allows sharing with family or others helping with care or payment if the person agrees. It is also allowed if they can object but do not, or if a specific rule applies.[8] Part 2 has separate rules. It does not automatically follow all HIPAA permissions. For Part 2 records, a subpoena usually is not enough. You must also meet the Part 2 requirements for a court order.[2]
HIPAA includes a minimum-necessary standard: protected health information should not be used or disclosed when it is not necessary.[3] HIPAA permits some disclosures without written authorization, including many for treatment, payment, and health care operations; Part 2 and state law may impose additional requirements and exceptions.
Ask each program how state law affects its privacy practices and release forms. You can find confidential treatment programs in our directory to check their practices before starting care.
Frequently Asked Questions
Does HIPAA protect my addiction treatment records?
Your records may fall under HIPAA. A separate law, Part 2, may add more protection. This depends on your program. If Part 2 applies, the program must provide written notice. This notice outlines your rights.
Can rehab tell my family that I am a patient?
This depends on the rules for your situation. Usually, providers cannot give your info to family members. First, they need your consent. Otherwise, another permitted reason must be present. However, family can often give info to the provider. The provider cannot always share back.
Can a subpoena get my rehab records?
A regular subpoena is typically not enough for Part 2 records. A court must issue a specific order. This order follows strict rules. It requires good cause for the request. It also limits the information that can be shared.
How can I get my mental health records released to me?
Ask the program how to request your records. Find out which records are included. HIPAA limits the cost if you pay for copies. You have the right to view and receive copies of your health info.
Does HIPAA apply to therapists?
This depends on their legal status and where they work. A therapist may be employed by a larger group. They may not count as a separate covered entity on their own. Even so, every staff member needs to learn the privacy rules needed for their role.
Can my rehab keep information from my health insurer if I self-pay?
Yes, sometimes, provided you pay the full amount yourself. You can ask them not to share that care with your plan for billing or operations. Check with the program on how to submit this request officially. Keep in mind that other laws may still force some disclosures, even if you ask.
What should I do if I suspect a rehab disclosed my records without permission?
Note the details of the event and list everyone involved. Next, reach out to the program’s privacy officer to report the issue and request a review. If Part 2 applies, you can file a complaint with HHS under federal guidelines.
