Addiction Care · 3 min read · Updated November 13, 2026
Privacy protections for addiction treatment records depend on who holds the records, which laws apply, and why information is being shared. It is safer to ask specific questions than to assume all addiction-related conversations are covered by exactly the same rules. This guide offers general U.S. information, not legal advice about an individual situation.
Ask which rules cover the organization
HIPAA applies to covered health care entities and certain business associates. An additional federal rule, 42 CFR Part 2, protects qualifying substance use disorder records from federally assisted programs. It does not automatically cover every website or referral conversation. HHS: Understanding Confidentiality of Substance Use Disorder Patient Records explains the scope of these protections. Ask the organization whether it is a Part 2 program and request its privacy notice. Our referral-service guide can help clarify who is handling your information.
Read consent forms as decisions about sharing
Under the updated Part 2 rules, a patient may give one consent for future treatment, payment, and health care operations disclosures. That does not mean every possible disclosure is unrestricted. HHS: 42 CFR Part 2 Final Rule Fact Sheet describes protections and specific consent requirements, including for separately maintained substance use counseling notes. Compliance with the updated rule was required by February 16, 2026. Ask what a particular form authorizes, which organizations may receive information, and how to change or revoke permission going forward.
Discuss family involvement deliberately
You may want a partner to help with scheduling while keeping other details private. Ask whether the program can document that distinction and explain any limits. A family member can often provide information even when the provider cannot disclose everything in return; ask the team how its process works. Before signing, identify who may receive updates and what kind. Our guide to family participation and support can help you consider the involvement that feels useful.
Ask about billing and everyday communication
Privacy concerns may involve an insurance explanation of benefits, a voicemail, a shared patient portal, or a mailing address. Ask the provider and insurer about available communication preferences and any limits. Do not assume a request can prevent every disclosure required or permitted by law. If a legal proceeding, custody issue, or employer request is involved, seek advice from a qualified attorney or the organization’s privacy officer rather than relying on general online information.
Know where to take a concern
Request the privacy officer’s contact details and the procedure for a complaint or record-access request. HHS provides information about complaints involving HIPAA and Part 2. Keep copies of forms and a brief record of questions you asked. Privacy law includes exceptions and technical requirements, so a clear explanation matters more than a promise of complete secrecy. You should leave the conversation understanding the organization’s role, your choices, and whom to contact if something seems wrong.
Sources & further reading
- HHS: Understanding Confidentiality of Substance Use Disorder Patient Records
- HHS: 42 CFR Part 2 Final Rule Fact Sheet
General educational information. This guide is not a substitute for advice from a qualified treatment professional.
