Addiction treatment records have extra federal protection under a rule called 42 CFR Part 2, on top of HIPAA.12 For an adult, a program usually can’t tell you anything, sometimes not even whether your loved one is there, until they sign a written consent naming you.3 Staff can still listen to what you tell them.
Why won’t the program even confirm my loved one is there?
Part 2 protects the fact that someone is in addiction treatment, along with everything that happens there. A facility publicly identified as providing only addiction treatment generally can’t acknowledge that a person is a patient without that person’s written consent or a court order.3 So “I can’t confirm or deny” is staff following the rule. It tells you nothing about how your loved one is doing.
Which privacy rules apply: HIPAA or 42 CFR Part 2?
Many addiction programs must follow both, and Part 2 is the stricter one. It covers “federally assisted” substance use programs, a broad category that includes programs that bill Medicare, receive other federal funds, are registered with the DEA to treat addiction with controlled medications, or are tax-exempt.23 HIPAA covers health care more broadly, including hospitals and regular doctors.
| HIPAA (most health care) | 42 CFR Part 2 (addiction programs) | |
|---|---|---|
| Can they talk to family without written consent? | Sometimes. A provider may share what’s relevant to your role in their care if your loved one doesn’t object, or if they’re unable to agree and it’s in their best interest.4 | Generally no. Written consent is needed, with narrow exceptions such as a medical emergency.3 |
| Can they confirm someone is a patient? | Sometimes, such as through a hospital’s patient directory, unless your loved one opts out4 | Generally no, without consent, at facilities publicly identified as addiction-only3 |
That’s why an ER nurse may talk with you while the rehab your loved one goes to next won’t. A hospital unit that presents itself as an addiction treatment unit can fall under Part 2 too, so ask which rules apply.3
What changed in 2026?
Programs had to comply with an updated Part 2 rule by February 16, 2026.1 The update, finalized in February 2024, made Part 2 work more like HIPAA:13
- Patients can sign one consent covering future treatment, payment and health care operations, so records move more easily among providers and insurers.
- Records generally can’t be used against the patient in civil, criminal, administrative or legislative proceedings without their consent or a court order.
- Counseling notes kept separately by a clinician need their own consent.
- HHS can now enforce Part 2 with the same kinds of penalties used for HIPAA.
None of this gives families a right to be told things, and neither does paying the bill or carrying the insurance.3 A consent for treatment and billing doesn’t cover you. You need to be named in a release.
What is a release of information, and what should it say?
A release of information (ROI) is a signed form that lets the program share specific information with specific people. Most programs have their own. Under Part 2, a valid consent must include, among other things:3
- The patient’s name and who is allowed to share (the program)
- Who receives the information, such as “my mother, Ana Ruiz”
- How much and what kind of information can be shared
- The purpose, such as “to support my treatment and discharge planning”
- When the consent ends, as a date or an event
- A statement that your loved one can revoke it in writing and how, plus their signature and the date
Your loved one decides how much to share. Attendance and the discharge plan without therapy details is a common middle ground. Revoking it doesn’t undo anything the program already did in reliance on it.3
Release of information checklist
- Before admission
- What the release could cover
- Details to confirm
How do I ask my loved one to sign a release?
Bring it up before admission day if you can, keep it short, and frame it around support. Pressure at intake tends to backfire. If you’re still choosing a program, add the release to your questions to ask before admission.
What to say instead
“You have to sign this so I know what you’re up to.”
“Would you be OK with me talking to your counselor? It would help me support you and plan for when you come home.”
“If you don’t sign, I’m not paying.”
“You decide what they share. Even just your discharge plan would help me.”
“Why won’t you let me in?”
“That’s OK. If you change your mind, you can sign it anytime.”
A no at intake often isn’t final. Their counselor may raise it again once treatment is underway.
What can I do if there’s no release?
Call or write to the team with what you know: past withdrawal problems, overdoses, medications, mental health history or suicide risk. Staff may take it in without confirming anything.34 Questions about the program itself, like visiting rules, phone policies and family program times, aren’t patient information, so ask away. You can also ask the counselor to pass on a message, such as “I love you, and I’d like to join family sessions if you’re willing.”
Family groups and counseling help whether or not your loved one lets you in. See support groups and counseling for families.
Can a program talk to parents of a teen?
It depends on your state’s consent law. Under Part 2, if state law lets a minor agree to addiction treatment on their own, generally only the minor can consent to sharing information, including with parents.3 If state law requires a parent’s consent for treatment, both the minor and a parent must consent before information is shared.3 There is one narrow exception: if the program director judges that a minor can’t make a rational choice about consent and there is a substantial threat to the life or physical well-being of the minor or someone else, the program may tell a parent the facts needed to reduce that threat.3
Ask the program in writing what applies at your child’s age in your state, and how releases are handled once they turn 18. See choosing treatment for teens and young adults.
Frequently asked questions
Does a power of attorney or guardianship change things?
It can. If a court has found your loved one unable to make their own health care decisions, a personal representative with legal authority to make those decisions, such as a court-appointed guardian, can generally give consent under Part 2.3 Whether a health care power of attorney covers these records depends on its wording and your state’s law. Ask a lawyer before relying on one.
Can the program share information with a court or probation officer?
Generally only with your loved one’s written consent or a special court order.3 When the court or probation made treatment a condition of their case, that consent works differently: it may not be revocable until a set time or event.5 See court-ordered treatment for more.
Sources
- HHS — Fact Sheet: 42 CFR Part 2 Final Rule (February 2024; compliance date February 16, 2026). hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-c… — accessed Oct 2026
- SAMHSA — Substance Use Disorders: Statutes, Regulations, and Guidelines (42 CFR Part 2 section; updated May 2026). samhsa.gov/substance-use/treatment/statutes-regulations-guidelines — accessed Oct 2026
- eCFR — 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records (current text, including §§ 2.3, 2.11–2.15, 2.31 and 2.51). ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2 — accessed Oct 2026
- eCFR — 45 CFR § 164.510(b), Uses and disclosures for involvement in the individual's care (HIPAA Privacy Rule). ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/s… — accessed Oct 2026
- eCFR — 42 CFR § 2.35, Disclosures to elements of the criminal justice system which have referred patients (as amended February 2024). ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2/subpart-C/sect… — accessed Oct 2026