HIPAA and Addiction Treatment Privacy Explained

Privacy is one of the most common concerns people raise before entering addiction treatment. This page gives a general, non-legal overview of how HIPAA and related privacy protections generally apply, for guidance on your specific situation, talk to the treatment provider directly or consult an attorney.

What HIPAA Generally Protects

HIPAA (the Health Insurance Portability and Accountability Act) sets national standards protecting the privacy of health information generally, including mental health and substance use treatment records held by covered healthcare providers.

Additional, Stronger Protections for Substance Use Records

Substance use disorder treatment records held by a qualifying "Part 2 program" are also subject to 42 CFR Part 2, a separate federal regulation that in some respects goes beyond standard HIPAA requirements, including, since a 2024 federal rule update, a revised single-consent framework for future treatment, payment, and health-care-operations disclosures, plus new redisclosure and breach-notification rules for recipients of that information. See What Is 42 CFR Part 2? for a fuller look at this specific regulation.

General Limits on These Protections

No privacy protection is absolute, there are specific, legally-defined exceptions (such as certain medical emergencies, court orders, or explicit written consent). Which exceptions might apply in a given situation depends on the specific facts involved, and that determination should come from the treatment provider's compliance team or a qualified attorney, not general information.

How This Plays Out With Employers and Family

These same protections are what generally stand between a treatment provider and disclosure to an employer or family member without your consent. See Can My Employer Find Out I'm in Rehab? for how this applies specifically to workplace situations.

Questions Worth Asking a Treatment Provider Directly

– What is your specific policy on 42 CFR Part 2 and HIPAA compliance?

– Under what circumstances, if any, could my information be shared without my consent?

– How do you handle information requests from employers, family members, or legal entities?

What Happens if You Believe Your Privacy Was Violated

If you believe a provider improperly shared your protected health information, you generally have the right to file a complaint with the provider directly and with the Department of Health and Human Services' Office for Civil Rights, which oversees HIPAA enforcement. Programs are required to provide you with a Notice of Privacy Practices explaining exactly this process, worth reading closely rather than setting aside unread during intake paperwork.

How Telehealth Changes These Protections in Practice

HIPAA protections generally extend to telehealth sessions, but the practical details differ, questions like whether a session is recorded, how video platform data is stored, and what happens if a connection is interrupted mid-session are worth asking about directly. A reputable telehealth provider should be able to explain their specific privacy and security practices clearly, not just point generally to HIPAA compliance as a blanket assurance.

It's reasonable to ask any telehealth provider directly which platform they use and whether it's specifically built to be HIPAA-compliant, rather than a general consumer video app repurposed for healthcare use. Legitimate providers should be able to answer this clearly and without hesitation.

How This Applies to Minors in Treatment

Privacy protections for minors receiving substance use treatment are more complex, and vary significantly by state, since parents or guardians often retain some rights to access a minor's medical information generally. Many states have specific carve-outs allowing minors to consent to substance use treatment confidentially, without parental notification, precisely because requiring parental involvement can otherwise discourage teens from seeking help. If this applies to your family's situation, it's worth asking a provider directly how they handle minor consent and privacy in your specific state, since a general national overview like this one can't cover state-by-state variation accurately.

How HIPAA and 42 CFR Part 2 Work Together

HIPAA sets a general privacy baseline across healthcare, but substance use treatment records specifically get an additional, stronger layer of protection under a separate federal law, 42 CFR Part 2. Where the two overlap, the stronger protection generally applies, which is part of why substance use treatment records are handled more restrictively than most other medical records, even other behavioral health records that aren't specifically substance-use-related. Understanding that there are two federal laws working together here, not just HIPAA alone, helps explain why treatment programs sometimes ask for a more specific, detailed consent form than a typical doctor's office would.