Article
Is Addiction Treatment Confidential? What Federal Law Says
Federal law gives addiction treatment records extra privacy protection, with specific limits. Here is what 42 CFR Part 2 covers, when records can be shared and what to ask about consent forms.
By Mile High Treatment & Recovery8 min read
Is addiction treatment confidential? Under a federal rule called 42 CFR Part 2, records from a covered substance use disorder program get more privacy protection than ordinary medical records. The rule also lists specific exceptions, so it helps to know them before you sign a consent form.
This is general information, not legal advice.
What is 42 CFR Part 2?
42 CFR Part 2 is the federal regulation on the confidentiality of substance use disorder patient records. It restricts the use and disclosure of records that would identify someone as having, or having had, a substance use disorder. [Source: 42 CFR 2.12, eCFR 2026]
The rule states its purpose plainly. A patient in treatment should not be "made more vulnerable" by their record than someone with the same condition who never seeks treatment. [Source: 42 CFR 2.2, eCFR 2026] That matters. The National Institute on Drug Abuse notes that stigma often factors into why people who need help do not seek care. [Source: National Institute on Drug Abuse 2025]
Records, in the rule, means any information a program creates or receives about a patient, including billing information, emails, voicemails and texts. A patient includes anyone who has applied for treatment, and former patients as well as current ones. [Source: 42 CFR 2.11, eCFR 2026]
Who does 42 CFR Part 2 cover?
It covers federally assisted programs that present themselves as providing substance use disorder diagnosis, treatment or referral for treatment, and that do provide it. A program counts as federally assisted if it operates under a federal license, certification or registration, receives federal funds or has tax-exempt status. [Source: 42 CFR 2.11, eCFR 2026] [Source: 42 CFR 2.12, eCFR 2026]
A licensed methadone clinic fits that description. Every opioid treatment program needs a current federal certification and a federal registration to dispense medication for opioid use disorder. [Source: 42 CFR 8.11, eCFR 2026] Federal treatment standards also require these programs to keep all records confidential under applicable federal and state law. [Source: 42 CFR 8.12, eCFR 2026]
How does Part 2 compare with HIPAA?
HIPAA is the general federal privacy rule for health plans and for health care providers that conduct certain transactions electronically. Part 2 gives substance use disorder records additional protection, especially against use in legal proceedings against a patient. [Source: U.S. Department of Health and Human Services 2024]
The everyday difference is consent. Under HIPAA, a covered provider may share health information for treatment, payment and health care operations without written permission. [Source: 45 CFR 164.506, eCFR 2026] Under Part 2, sharing records outside the program for those purposes generally needs the patient's written consent. One consent can now cover all of it going forward, until you revoke it in writing. [Source: 42 CFR 2.33, eCFR 2026]
That single consent came from a 2024 update. HHS, the U.S. Department of Health and Human Services, issued it to carry out changes Congress made in the CARES Act. Programs had to comply by February 16, 2026. [Source: U.S. Department of Health and Human Services 2024] Here is what else changed.
| Change | What it means |
|---|---|
| Sharing onward | A HIPAA-covered provider or plan that gets your records this way may share them as HIPAA allows, except in legal proceedings against you. |
| Counseling notes | A counselor's separate notes on what was said in a session need their own consent, with narrow exceptions. |
| Legal proceedings | Consent to use your records in a legal proceeding cannot be combined with any other consent. |
| Enforcement | Violations carry HIPAA's civil and criminal penalties, and breach notification rules apply. |
| Complaints | You can complain to the program or to HHS, and the program may not retaliate. |
When can a program share information without your consent?
Only in specific situations the rule lists, and only the information needed for that purpose. [Source: 42 CFR 2.12, eCFR 2026] [Source: 42 CFR 2.13, eCFR 2026] In general, an exception allows sharing but does not require it. [Source: 42 CFR 2.2, eCFR 2026] The main exceptions are below.
| Situation | What the rule allows |
|---|---|
| Inside the program | Staff may share with each other when their duties in patient care require it. |
| Service providers | Outside services such as labs or billing may get what they need, under a written agreement binding them to Part 2. |
| Medical emergencies | Medical staff may get what they need for a genuine emergency when your consent cannot be obtained first. |
| Suspected child abuse or neglect | Reports under state law may be made, but the original treatment records stay protected. |
| Crimes at the program | Staff may tell law enforcement about a crime or threat on the premises or against staff, limited to the incident. |
| Research and audits | Researchers and auditors may have access under conditions the rule sets out. |
| Public health | Public health authorities may receive records only in de-identified form. |
| Court orders | A court may authorize disclosure through a special process, and a subpoena is still needed to compel it. |
Emergency disclosures must be documented in your record right away. [Source: 42 CFR 2.51, eCFR 2026]
What should you ask about a consent form?
Ask what it lets the program share, with whom, why and for how long. Every Part 2 consent must spell out each of those points. [Source: 42 CFR 2.31, eCFR 2026]
- What will be shared? The form must describe the information in a specific and meaningful way.
- Who gets it? It must name the recipients or a class of them, such as your treating providers and health plans.
- Why? Each purpose must be described.
- When does it end? It needs an expiration date or event, though "none" can be enough for a treatment, payment and operations consent.
- How do I cancel it? It must explain your right to revoke it in writing. Revoking does not undo sharing already done in reliance on it. A consent tied to a criminal justice referral can only be revoked after a set time or event. [Source: 42 CFR 2.35, eCFR 2026]
- What if I say no? A treatment, payment and operations consent must state the consequences of refusing. It must also state that records shared under it could be redisclosed and lose Part 2 protection.
Separate counseling notes need their own consent, and a program may not make your treatment depend on it. You can also ask a program to limit sharing for treatment, payment and operations. It does not have to agree, with one exception. If you paid for a service in full, it must agree not to tell your health plan about it, unless the law requires that. [Source: 42 CFR 2.26, eCFR 2026]
You should also get a plain-language privacy notice by your first service, with contact details for questions. [Source: 42 CFR 2.22, eCFR 2026]
How Mile High Treatment & Recovery can help
We are a CARF-accredited opioid treatment program providing methadone at 6310 E. Exposition Ave in Denver.
- Hours. Weekday dosing runs from 5:30 AM to 12:30 PM, and we are open Saturday from 9 to 11 AM.
- Your first visit. Call ahead or walk in before 11:30 AM. Every new patient has an assessment before treatment begins; see what to expect.
- Coverage. We accept Medicaid and Medicare, including Health First Colorado, Colorado Access, Colorado Community Health Alliance and Rocky Mountain Health Plans. We also offer a sliding scale for self-pay. See the plans we accept and our Medicaid page.
- Care beyond medication. Alongside methadone therapy, we offer individual counseling, group counseling and care coordination.
- Moving or traveling. Our services include transfers from other programs and guest dosing for visitors enrolled elsewhere.
Is addiction treatment confidential? Common questions
Can my family or employer find out I am in treatment?
Part 2 generally bars a program from telling anyone, including family or an employer, that you are a patient without your written consent. The exceptions above still apply. Some facilities are publicly identified as providing only substance use disorder care. There, staff may confirm someone is a patient only with written consent or a court order. If a request is not allowed, the answer must not affirmatively reveal that the person is or was in treatment. [Source: 42 CFR 2.13, eCFR 2026] No one may require you to carry a card that identifies you as a patient outside the program. [Source: 42 CFR 2.18, eCFR 2026]
Can police or a court get my treatment records?
Not with a subpoena alone. A program may not disclose Part 2 records in response to a subpoena unless a court enters a special authorizing order under the rule. For a criminal investigation or prosecution of a patient, one of the court's required findings is that the crime is extremely serious. The rule's examples involve causing or directly threatening loss of life or serious bodily injury. Without your consent or such an order, records cannot be used against you in criminal, civil, administrative or legislative proceedings. [Source: 42 CFR 2.61, eCFR 2026] [Source: 42 CFR 2.65, eCFR 2026]
Will my insurance company see my treatment records?
It can, through a consent that covers payment. Billing a health plan means sharing some information with it, and one signed consent can cover treatment, payment and health care operations. A plan that receives records this way may share them further as HIPAA allows, but not for legal proceedings against you. If you pay for a service in full yourself, you can ask the program not to tell your plan about it. The program must agree unless the law requires that disclosure. A plan covering patients at the program may also review records as an auditor, with strict limits on further use. [Source: 42 CFR 2.53, eCFR 2026]
Where to go from here
Records from covered addiction treatment programs are strongly protected under federal law, with exceptions you can learn ahead of time. For advice about your own situation, talk with a lawyer.
If Denver works for you, call us at 720-756-7162 or get in touch with your questions before your first visit. Our FAQ covers other common questions.
Keep Reading
Related Articles
Ready to Take the Next Step?
Call us and we will book your assessment and explain exactly what happens at it. You can also send a message if you would rather start in writing.
Visit Us
Hours
Mon to Fri: 5:30 AM to 12:30 PM
Saturday: 9:00 AM to 11:00 AM
Sunday: Closed