Yes. HIPAA generally protects addiction treatment records when they are held by a health care provider, health plan, or business associate covered by the HIPAA Rules. Many substance use disorder treatment records also receive additional federal confidentiality protection under 42 CFR Part 2.
The two laws overlap, but they are not identical. HIPAA is a broad health-information privacy law. Part 2 is a specialized federal rule for qualifying substance use disorder records.
What addiction treatment information does HIPAA protect?
HIPAA protects individually identifiable health information held by covered entities and their business associates. In addiction treatment, that can include diagnoses, treatment plans, medication information, laboratory results, billing records, appointment information, and other protected health information.
HHS explains that mental and behavioral health information receives the same HIPAA protections as other protected health information, subject to the Privacy Rule’s permitted uses and disclosures.
Does HIPAA mean rehab records can never be shared?
No. HIPAA allows health information to be used or disclosed for treatment, payment, and health care operations and in other situations specifically permitted by the Privacy Rule. Patients can also authorize additional disclosures.
When 42 CFR Part 2 applies, the treatment program must also comply with Part 2’s more specific requirements for substance use disorder records.
How is HIPAA different from 42 CFR Part 2?
HIPAA protects a broad range of health information across the health care system. Part 2 applies specifically to records from qualifying federally assisted substance use disorder programs and imposes additional confidentiality rules.
HHS updated Part 2 in 2024 to align parts of the rule more closely with HIPAA, including allowing a single consent for certain future treatment, payment, and health care operations uses and disclosures. However, Part 2 retains special restrictions on using SUD records in legal proceedings against a patient.
Can rehab share my information with family?
Not automatically. A treatment program may ask you to sign a release of information identifying who may receive updates and what may be shared. HIPAA has limited exceptions that allow certain disclosures without authorization, and Part 2 may add additional requirements when SUD records are involved.
Can my employer get my addiction treatment records?
Your employer does not automatically receive your treatment records simply because you have employer-sponsored health insurance. HIPAA limits how a health plan can share protected health information with an employer acting as plan sponsor, and the plan sponsor cannot use protected health information for employment-related actions when it receives information for plan administration under HIPAA’s rules.
An employer may separately ask you for limited medical documentation when administering leave, disability, or accommodation programs. That does not give the employer unrestricted access to your rehab chart.
Can I get copies of my own rehab records?
Generally, yes. HIPAA gives individuals a right to access protected health information in a designated record set, subject to limited exceptions. HHS states that this can include medical records, billing records, laboratory reports, and other information used to make decisions about the individual.
How quickly must a HIPAA-covered provider respond to a record request?
HIPAA generally requires action within 30 calendar days of a valid access request. The provider may have limited ability to extend the deadline when the rule’s requirements are met.
What if I think my privacy rights were violated?
You can raise the issue with the provider’s privacy contact and may also file a complaint with the HHS Office for Civil Rights. OCR now handles complaints involving both HIPAA and 42 CFR Part 2.
Frequently asked questions
Does HIPAA protect the fact that I went to rehab?
Yes, when that information is protected health information held by a HIPAA-regulated entity. If Part 2 applies, the fact of receiving SUD treatment may receive additional protection.
Can a rehab send records to another doctor?
Potentially. HIPAA allows many treatment-related disclosures, but Part 2 requirements may also apply to SUD records.
Can family members access my records because they pay for treatment?
Not automatically. Payment alone does not create unrestricted access to an adult patient’s protected health information.
Does HIPAA protect employment records?
No. HIPAA generally does not regulate an employer’s employment records, even when those records contain health-related information. Other employment and disability laws may provide confidentiality protections.
Authoritative sources
- HHS: Summary of the HIPAA Privacy Rule
- HHS: Mental and Behavioral Health Information Under HIPAA
- HHS: Confidentiality of Substance Use Disorder Patient Records
- HHS: HIPAA Right of Access
This article provides general privacy information, not legal advice. Trinity Behavioral Health’s current adult privacy and records procedures should be confirmed directly when a specific disclosure or records request is involved.