The short answer
Yes, in most cases. A federal rule called 42 CFR Part 2 and HIPAA, the main federal health privacy law, limit what treatment programs can share. In general, a covered program can’t share information that identifies someone as having a substance use disorder without that person’s written consent, with limited exceptions.
The U.S. Department of Health and Human Services (HHS) says these rules exist because fear of discrimination or legal trouble can keep people from seeking treatment. You can read more on the HHS page on Part 2.
This page is general information, not legal advice. For your exact situation, talk with a Florida attorney.
Part 2 and HIPAA in plain words
| 42 CFR Part 2 | HIPAA | |
|---|---|---|
| What it protects | Substance use disorder treatment records | Health information more broadly |
| Who must follow it | Federally assisted programs that provide substance use diagnosis, treatment or referral | Most health care providers and health plans |
| Basic rule | Generally needs written consent to share, with limited exceptions | Allows sharing for treatment, payment and health care operations, and limits most other sharing |
| Who enforces it | The HHS Office for Civil Rights (OCR) | The HHS Office for Civil Rights (OCR) |
What Part 2 does
HHS describes three main protections for people in treatment:
- Limits on sharing. With limited exceptions, such as emergency medical treatment, records may be shared only with the patient’s written consent or a court order and subpoena (or a similar legal mandate).
- Consent you control. A patient can give one consent covering future use for treatment, payment and health care operations. Once a provider or health plan under HIPAA receives records that way, it can generally share them again as HIPAA allows, but not for legal proceedings against the patient.
- Protection in legal cases. Records can’t be used to investigate or prosecute a patient without written consent or a court order.
The HHS fact sheet on the Part 2 rule adds that a clinician’s separately kept counseling notes need their own specific consent. Patients also have the right to get a notice of their privacy rights, and programs have to report breaches of unsecured records.
The limits to know about
- Not every provider is a Part 2 program. The rule applies to federally assisted programs. Ask a program whether it follows Part 2. HIPAA may still apply if it doesn’t.
- Emergencies. Records can be shared for emergency medical treatment.
- Courts. A court order and subpoena that meet the rules can allow disclosure. If your loved one is in a Marchman Act guide case or another court case, ask an attorney how that works.
- Insurance. If your loved one uses a health plan, the plan will see claims. The person who holds the policy may get statements too. Ask the plan how to request privacy.
- Program reporting. Ask the program what it must report by law, and when. It should be able to tell you clearly.
What this means for your family
If your loved one is an adult
- The program may not be able to tell you whether they are even there
- They can sign a written consent so staff can talk with you
- They can choose exactly who gets what
- You can still share what you know with the program
If you are the one getting care
- Read any consent form before you sign, and ask what it allows
- Ask for the program’s privacy notice
- Ask who sees your records, including any outside billing company
- Ask how group members are asked to treat what they hear
Worried about work? Read do I have to tell my employer I’m going to rehab. It covers what to say and who needs to know.
If you think privacy was broken
Ask the program first
Tell the program what happened, and ask who handles privacy complaints.
File a complaint
HHS says that since February 16, 2026, anyone can file a Part 2 complaint with OCR if they believe records were shared in a way that breaks the rule.
Get legal advice if needed
If it affected a job, a court case or a license, talk with an attorney.
Choosing a program?
Add privacy to your list of questions for each program.
Questions about rehab and privacy
Can a rehab tell my family I’m there?
Generally not without your written consent, if the program is covered by Part 2. You choose who can be told. Many people choose to include someone they trust, since family support can help.
Will rehab show up on my medical record?
It may, depending on how care is delivered and what you consent to. Under the newer rule, one consent can cover treatment, payment and health care operations. Ask the program how its records connect with your other doctors.
Can police get my rehab records?
HHS says treatment records can’t be used to investigate or prosecute a patient without written consent or a court order that meets the rules. If there is an open case, talk with an attorney.
Is what I say in group therapy private?
Programs ask group members to keep what they hear private, and staff are bound by the privacy rules. Other group members aren’t staff, so share at your own pace. Ask how the program handles this.
Is it private to go to AA or NA?
Anonymity is a core part of those groups, but they aren’t treatment programs covered by these rules. Learn more in AA and NA meetings in Jacksonville, or see our other rehab questions.