Yes, and by a stricter rule than the one covering the rest of your medical care. Records held by a federally assisted substance use disorder program may be used or disclosed only as one specific federal regulation permits, and may not otherwise be used in any civil, criminal, administrative or legislative proceeding brought by a federal, state or local authority [1].
That is the headline. The detail is where people’s real fear lives, so this page goes through it: how that rule differs from HIPAA, who can be told anything at all, what a release form has to contain and how to keep it narrow, where employers and courts and licensing boards actually stand, what your family will and will not hear, what an insurance claim exposes, the narrow exceptions, and what to do on the very first call to keep your options open. If privacy is the thing holding you back, it is worth reading before you decide. Our page on how to get into rehab covers the rest of the process.
HIPAA and 42 CFR Part 2: two different protections
They are not the same rule, and the difference works in your favor. HIPAA lets a covered health care provider use and disclose your health information to carry out treatment, payment and health care operations without asking you first [4]. That is how a referral letter reaches a specialist and how a claim reaches your insurer.
The substance use rule is narrower. It applies to records held by a federally assisted substance use disorder program — a “part 2 program” in the regulation’s own language [5]. Those records may be used or disclosed only as the regulation permits, and are otherwise shut out of federal, state and local proceedings [1]. Any disclosure that is made must be limited to the information necessary [1].
So two sets of records about the same person can carry different rules. A broken wrist treated at a hospital sits under the ordinary framework. A course of treatment at a program covered by part 2 sits under the tighter one.
One caution worth naming early: not every provider is a part 2 program, because the rule turns on federal assistance and on how the program holds itself out [5]. Ask the program directly whether it is covered. It is a fair question, staff hear it often, and the answer changes what everything below means for you.
Who can be told anything at all
Start from the default, which is nobody. Without your written consent or a court order that authorizes it, a program covered by the rule does not hand your records to anyone [1].
The regulation then closes the doors people usually try. A program may not disclose because the person asking already has the information, or could get it another way, or is a law enforcement officer or other government official, or has produced a subpoena, or offers any other justification the rule does not itself permit [1]. That list exists because each of those arguments has been made.
There is a further protection that surprises people. Where a facility is publicly identified as a place that provides only substance use diagnosis, treatment or referral, staff may not even acknowledge that an identified patient is there, unless you have consented in writing or an authorizing court order is in place [1].
Read plainly, that means a program will not confirm you to a caller who does not have your permission, outside the narrow exceptions in the regulation itself. Not to your employer, not to a relative, not to a reporter. Our page on common barriers to treatment covers the other worries that stop people calling, and our levels of care page explains what each setting involves.
One exception belongs here rather than buried further down, because people hesitate over it at exactly the wrong moment. The regulation allows disclosure to medical personnel in a genuine medical emergency where your prior written consent cannot be obtained [6]. If someone is having a seizure, is unresponsive or has trouble breathing, call 911. For a mental health crisis, call or text 988. Privacy is not a reason to wait.
A release is the switch you control, and the regulation tells you what has to be on it. A written consent may be on paper or electronic, and it must include your name, the name or specific identification of the people or class of people authorized to make the disclosure, and a description of the information that identifies it in a specific and meaningful way [2].
It must also name who is to receive the information, tell you that you may revoke the consent in writing and how to do it, and carry an expiration date or an expiration event [2]. The revocation right has one limit: it does not undo a disclosure already made in reliance on the consent [2].
The practical lesson sits in the word “specific”. A release does not have to be a blanket permission. You can authorize one named person to receive one narrow category of information, and you can set an expiration event rather than a date.
Two questions are worth asking as you sign. What exactly will this person be told, in words? And what happens if I want it withdrawn next month? A program that answers both crisply is easier to work with than one that pushes a standard form across the desk. Our rehab intake process page covers the rest of the paperwork day.
If privacy is the thing you want settled before you commit
Orlando Recovery Center Drug, Alcohol and Mental Health Rehab is our campus in Orlando, Florida, running medical detox, residential or inpatient treatment, inpatient mental health care, a partial hospitalization program and aftercare planning. Ask the admissions team what it will and will not disclose before you give anyone your name.
Check your coverage and admissions
Verify your insurance
Orlando Recovery Center Drug, Alcohol and Mental Health Rehab is part of our family of treatment centers. See the Orlando Recovery Center campus.
Employers, courts and licensing boards
An employer does not get your records because it is your employer. It gets them if you sign a release, and only within the scope you set [2]. That is the whole mechanism, and it is worth knowing before a difficult conversation rather than after one.
Where an employer is paying, or where leave has to be arranged, people often sign a narrow release covering dates of attendance and fitness to return, and nothing about content. That is a legitimate use of the form’s specificity requirement [2]. Our guide to going to rehab and keeping your job covers the employment side in more detail.
Courts are the case people most often misunderstand. A court order under this rule does not compel anyone to hand records over. Its only function is to authorize a disclosure that would otherwise be prohibited, and a subpoena or similar legal mandate has to be issued separately to compel it [3]. In practice both may arrive together, and both are needed.
Licensing boards sit in the same place as employers: what they learn depends on what you authorize, on what a monitoring agreement you signed separately requires, and on your own professional reporting obligations. Those obligations are a question for a lawyer in your state, not for this page. Treat everything here as background and get advice on your own situation.
Family communication and what staff can confirm
Families find this the hardest part, and the honest answer is that an adult’s privacy holds even against people who love them. Without a release or an authorizing court order, staff will not confirm that an adult relative is there [1].
That cuts both ways, and the second direction is the one worth planning for. A family that cannot be told anything also cannot be told that the person arrived safely, or asked to bring a medication list, or included in a family session. Sorting a release out on the first day is what avoids that.
Keep the practical shape in mind. One named person, a defined category of information, an expiration you choose [2]. Many people authorize a single relative to receive confirmation of attendance and to be contacted about discharge planning, and authorize nothing beyond it.
And remember the revocation right is real and is written into the form itself [2]. Deciding who to include on day one is not deciding it forever.
Insurance claims and what they reveal
This is the gap between what the law protects and what a household actually notices. Using a health plan generates a claim, and HIPAA permits disclosures to carry out payment as part of its ordinary operation [4]. A plan that pays for care knows care was delivered.
What that means in a real household depends on whose policy it is. If you are a dependent or a spouse on someone else’s plan, explanation-of-benefit statements and plan portals are the usual route by which a family member notices something. That is an administrative fact rather than a breach of the substance use rule.
Ask the plan directly how it handles communications, because some allow statements to be redirected and some do not, and the answer is specific to the policy rather than to the carrier. Ask the program’s admissions team as well; they make these calls daily and know which questions get a usable answer.
Self-pay changes the calculation for some people, and it is a legitimate reason to ask about cost before benefits. Our pages on whether insurance covers rehab and what rehab costs set out how the numbers are built so you can weigh it honestly.
Records, subpoenas and the narrow exceptions
The exceptions exist, they are narrow, and knowing them is better than imagining worse ones.
A medical emergency is the one most people care about, and it is the exception noted above. Patient identifying information may be disclosed to medical personnel to the extent necessary to meet a genuine medical emergency in which your prior written consent cannot be obtained [6]. That provision is what allows a treating clinician to be told what matters when someone cannot speak for themselves, and it is why nothing on this page is a reason to hesitate over a 911 call.
The court route is the other main exception, and as above, an authorizing order and a compelling mandate are two separate documents [3]. A program that receives a subpoena alone is not thereby permitted to disclose [1].
What does not qualify is the long list the regulation rules out by name: a requester who already has the information, one who could obtain it elsewhere, a government official, or any other justification the rule does not itself allow [1]. Our overview of what the rehab process is like sets the rest of a stay in context.
Protecting your privacy from the first call
You control more of this than you think, starting before you give anyone your last name.
Ask three things on that first call. Is this program covered by the federal substance use confidentiality rule? What will you disclose without my written consent? And who will hold my records afterward? Good answers are specific and quick.
Then decide who you want included, and make it a deliberate choice rather than a default. Sign the narrowest release that does the job, name the person, and set an expiration [2].
Handle the practical leaks yourself, because they are usually where privacy actually goes. Who has access to your phone and your email. Whose plan pays the claim. Who you tell at work, and in what order. None of that is governed by a regulation; all of it is governed by you.
Finally, if the campus you are considering matters to the decision, our directory of our facilities shows where each of ours is, arranged by state, so you can raise these questions with a specific team rather than in the abstract. Where the answer turns out to be a stay rather than a commute, our medical detox and inpatient rehab pages describe what those settings involve.
Frequently Asked Questions
Does sorting out a release of information delay my start date? A release can be signed at admission and take effect immediately, and it can be withdrawn in writing later. The confidentiality protection itself is not something you apply for; it attaches to the records a covered program holds. So the privacy question does not delay a start date. What sets the pace is the clinical assessment and, where a plan is involved, the benefits check.
Does paying with insurance make treatment less private? In one respect, yes. Confidentiality is a legal protection rather than a service you buy, and asking about it costs you no standing with a program. Cost becomes a privacy question only in one place: whether you use a plan, because a claim tells the payer that care happened. If that matters in your household, ask about self-pay and compare before you commit.
Who can be told that I am in treatment? Only the people you authorize in writing, plus the narrow exceptions in the regulation itself. A program covered by the rule will not confirm to a caller that an adult is even there without consent or an authorizing court order. The realistic exposure is not the program; it is an insurance statement arriving at a shared address, so settle that question early.
Can I revoke a release after I have signed it? You may revoke a consent in writing, and the form has to tell you how. The one limit is that revoking does not reach back and undo a disclosure already made in reliance on the consent. So a release is a decision you can reverse going forward but not retroactively, which is the argument for signing the narrowest one that does what you need.
Can I ask a program about an adult relative? Yes, and people do it constantly. You can describe the situation, ask about levels of care, availability and cost, and get a realistic picture. What staff cannot do is tell you whether an adult is already a patient, or discuss one, without that person’s written consent. Consent for another adult’s treatment is not something a relative can give either.
Sources
- Legal Information Institute. 42 CFR 2.13 – Confidentiality restrictions and safeguards. Cornell Law School. https://www.law.cornell.edu/cfr/text/42/2.13
- Legal Information Institute. 42 CFR 2.31 – Consent requirements. Cornell Law School. https://www.law.cornell.edu/cfr/text/42/2.31
- Legal Information Institute. 42 CFR 2.61 – Legal effect of order. Cornell Law School. https://www.law.cornell.edu/cfr/text/42/2.61
- Legal Information Institute. 45 CFR 164.506 – Uses and disclosures to carry out treatment, payment, or health care operations. Cornell Law School. https://www.law.cornell.edu/cfr/text/45/164.506
- Legal Information Institute. 42 CFR 2.12 – Applicability. Cornell Law School. https://www.law.cornell.edu/cfr/text/42/2.12
- Legal Information Institute. 42 CFR 2.51 – Medical emergencies. Cornell Law School. https://www.law.cornell.edu/cfr/text/42/2.51
This page is for general information and is not medical advice. Only a licensed clinician who knows your history can tell you what is right for you. If you or someone you know is in immediate danger, call 911. For free, confidential support 24/7, call or text 988.
Author
Chief Medical Officer,
The Recovery Village
