Q: Are addiction treatment records more private than therapy records?

A: Yes, when the treatment came from a program covered by the federal rule known as 42 CFR Part 2 — and the protection is stronger than HIPAA in a way that matters most when it matters most. Absent your specific written consent or a special court order, such a record, or testimony about what is in it, "may not be disclosed or used in any civil, criminal, administrative, or legislative proceedings… against a patient," and the statute spells out what that forecloses: it cannot go into evidence, cannot form part of the record in an agency proceeding, cannot be used for a law enforcement purpose or investigation, and cannot be used in an application for a warrant.¹ That restriction follows the record to whoever ends up holding it, however they got it.²

A subpoena, by itself, gets nothing. The regulation is unusually blunt: the special court order it describes "does not compel use or disclosure" — it only authorises it — and a person holding these records "may not use or disclose the records in response to the subpoena unless a court of competent jurisdiction enters an authorizing order."³ A covered program also may not confirm you exist: an impermissible request must be answered "in a way that will not affirmatively reveal that an identified individual has been, or is being, diagnosed or treated for a substance use disorder."⁴

And the orders are hard to get. What you actually said to a counselor can be ordered disclosed only where it is necessary to protect against an existing threat to life or serious bodily injury, in the investigation or prosecution of an "extremely serious crime, such as one which directly threatens loss of life or serious bodily injury," or where you yourself put the content in evidence.⁵ An order to investigate or prosecute you has a five-part test that begins with the crime being extremely serious — homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, child abuse.⁶ Ordinary drug offences do not qualify.

Now the limit that surprises everyone: not every provider is covered. The rule reaches a "part 2 program" — broadly, someone who holds themselves out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment (or an identified unit or identified staff doing that inside a general medical facility), and who is federally assisted in any of several very common ways.⁷ Federal assistance is nearly always satisfied — Medicare participation, a DEA registration used in this treatment, tax-exempt status, any federal grant.⁷ The question that decides it is the holding-out one.

So: your ordinary therapist, who writes in the chart that you have been drinking more, is not covered by this rule and does not become covered by writing it down. The regulation says so directly — recording information about a substance use disorder and its treatment "does not by itself render a medical record… subject to the restrictions of this part."⁸ The federal health department has also said a provider does not become a part 2 program "simply because they provided screening, brief intervention, and/or referral to treatment within the context of general health care."⁹ Those records are protected by HIPAA and by California's own confidentiality law — real protection, but not this protection.

What changed as of February 2026. A rewritten version of the rule took full effect on 16 February 2026.¹⁰ Practically:

  • One consent can now cover treatment, payment and operations going forward, until you revoke it in writing.¹¹ That is more convenient and it is a real trade — records shared this way can be redisclosed under HIPAA rules. The legal-proceedings shield travels with them anyway: the redisclosure permission expressly excludes "uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient."¹¹
  • You may ask a program to restrict disclosures, and there is one restriction it must honour: where you paid in full yourself for the item or service, a program must agree not to disclose that record to a health plan for payment or operations.¹²
  • Breach notification now applies to covered programs the way it does to HIPAA-covered entities,¹³ and violations are now enforced under the HIPAA penalty framework rather than the old criminal-fine model.¹⁴
  • One right on the books is not yet enforceable: the accounting-of-disclosures provision has had its dates tolled until the corresponding HIPAA rule is revised, which had not happened as of August 2026.¹⁵

Two more provisions worth knowing. Federal law bars discrimination against you on the basis of information from a disclosure of these records — in health care, in hiring, firing or terms of employment, in housing, in access to courts, and in government benefits.¹⁶ And if treatment is a condition of your release, probation or a court disposition, the consent you sign for reports back to the court is irrevocable for a stated period, and those recipients may use it only to carry out their duties regarding your conditional release.¹⁷

The gap families run into. There is no family exception in this rule. The emergency provision permits disclosure to medical personnel to meet a bona fide medical emergency — not to your spouse, parent or partner.¹⁸ For anyone in your life to be told anything, you have to sign a consent naming them. If that matters to you, sign it while things are calm.

In California, state law can only make this stricter, never looser. The federal rule says state law may not authorise or compel a disclosure the rule prohibits, while a stricter state prohibition still stands.¹⁹ California has its own confidentiality statute for state-assisted alcohol and drug programs, with its own short list of exceptions and its own bar on using the records to initiate or substantiate criminal charges.²⁰

Do this: ask the program directly, "Are you a part 2 program?" — it is a term of art they will recognise, and the answer decides which rules cover you. Then read any consent form before you sign it, especially one that names a general category of recipients rather than a person. What confidentiality covers in ordinary therapy → · Can my records be subpoenaed? →

Sources

  1. 42 U.S.C. §290dd-2(c) — uscode.house.gov; implemented at 42 C.F.R. §2.13(a).
  2. 42 C.F.R. §2.12(d)(1) — the restriction "applies to any person who obtains the record from a part 2 program, covered entity, business associate, intermediary, or other lawful holder, regardless of the status of the person obtaining the record or whether the record was obtained in accordance with subpart E" — ecfr.gov.
  3. 42 C.F.R. §2.61(a) and (b)(1) — ecfr.gov. §2.13(b) adds that the rules apply whether or not the requester "has obtained a subpoena, or asserts any other justification."
  4. 42 C.F.R. §2.13(c)(2) — ecfr.gov.
  5. 42 C.F.R. §2.63(a)(1)–(3).
  6. 42 C.F.R. §2.65(d) — five criteria, beginning with a crime that is "extremely serious, such as one which causes or directly threatens loss of life or serious bodily injury." Non-criminal orders under §2.64 require notice to the patient, an opportunity to be heard, a fictitious name in the application, a closed hearing, and a good-cause finding that other means are unavailable and the public need outweighs the injury to the patient and the treatment relationship.
  7. 42 C.F.R. §2.11 (definitions of "part 2 program" and "program") and §2.12(b) (federal assistance) and §2.12(e)(1) (coverage examples, including the emergency-room counterexample) — ecfr.gov.
  8. 42 C.F.R. §2.12(d)(2)(ii).
  9. U.S. Department of Health & Human Services, final rule preamble, 82 Fed. Reg. 6052, 6066 (18 January 2017), which also defines "holds itself out." In 2024 the department confirmed it did not change the definition and that the question "is a fact-specific inquiry" (89 Fed. Reg. 12472, 12503).
  10. "Confidentiality of Substance Use Disorder (SUD) Patient Records," 89 Fed. Reg. 12472 (16 February 2024), effective 16 April 2024, with compliance required by 16 February 2026 — federalregister.gov. It implements section 3221 of the CARES Act.
  11. 42 U.S.C. §290dd-2(b)(1)(B)–(C); 42 C.F.R. §2.31(a)(4)(i) and §2.33(a)(2); the exclusion of proceedings against the patient from onward redisclosure is at §2.33(b)(1). A consent of this kind must also state that records may be redisclosed by the recipient and no longer protected (§2.31(a)(10)).
  12. 42 C.F.R. §2.26(a)(1) and (a)(6) — a program "must agree" where the disclosure is for payment or health care operations, is not otherwise required by law, and the record "pertains solely to a health care item or service for which the patient, or person other than the health plan on behalf of the patient, has paid the part 2 program in full." No other requested restriction has to be granted (§2.26(a)(2)).
  13. 42 C.F.R. §2.16(b), applying the HIPAA breach-notification rules; 42 U.S.C. §290dd-2(j). Informal caregivers who hold records are not subject to those requirements (§2.16(a)(2)).
  14. 42 C.F.R. §2.3 — penalties under sections 1176 and 1177 of the Social Security Act, with the HIPAA enforcement procedures at 45 C.F.R. part 160 applied.
  15. 42 C.F.R. §2.25, with the tolling explained at 89 Fed. Reg. 12476 and 12536 — the dates are tolled until the HIPAA accounting-of-disclosures standard at 45 C.F.R. §164.528 is revised to address disclosures for treatment, payment and operations through an electronic health record. That revision had not been made as of August 2026. A related right that is operative: §2.24, a list of disclosures made by an intermediary under a general designation, on written request, covering three years, answered within 30 days.
  16. 42 U.S.C. §290dd-2(i) — no discrimination on the basis of information received through an inadvertent or intentional disclosure, in admission to or treatment for health care, hiring, firing or terms of employment, workers' compensation, sale or rental of housing, access to courts, or access to government social services and benefits. This one is statutory only; it was not codified in the regulation.
  17. 42 C.F.R. §2.35(c)–(d).
  18. 42 C.F.R. §2.51(a) and (c) — disclosure "to medical personnel to the extent necessary to meet a bona fide medical emergency in which the patient's prior written consent cannot be obtained," with contemporaneous documentation of who, when and the nature of the emergency — ecfr.gov. Part 2 contains no analogue to the HIPAA permission for persons involved in a patient's care; see §2.14 for minors and §2.15 for personal representatives.
  19. 42 C.F.R. §2.20 — "no state law may either authorize or compel any use or disclosure prohibited by the regulations in this part," while a state-law prohibition on a use the rule would permit still applies.
  20. Health & Safety Code §11845.5, as amended by AB 2995 (Stats. 2024, Ch. 847), effective 1 January 2025 — confidentiality for programs conducted, regulated or assisted by the state department, with disclosure without consent limited to communications between qualified professionals in the program, bona fide medical emergencies, research and audit without identifying individuals, written designation by a parent, guardian or conservator, and a court order on probable cause; subdivision (d) bars use of the records "to initiate or substantiate any criminal charges against a client or to conduct any investigation of a client" — leginfo.legislature.ca.gov.

All federal and state provisions read 17 August 2026. This page describes the rules; it is not legal advice.

In crisis? Call or text 988 — free, 24/7.