Privacy in addiction treatment: what the law protects, and what we add.

Authored by the MLJ Clinical Team. Reviewed under board-certified psychiatric oversight. Last updated September 2026.

• HIPAA sets the floor for every health record; it lets your provider share information for treatment, payment, and operations without asking you each time.
• 42 CFR Part 2 is a stricter federal rule written specifically for substance use disorder records, and it generally requires your written consent before those records move.
• Neither law binds your employer, your family, or the people who notice you are gone; those gaps are managed by planning, not by statute.
• What a program adds on top of the law is operational: how many people are in the building, who answers the phone, and how staff are trained to treat your identity.
• Every spoke in this library covers one specific privacy question in depth, from FMLA paperwork to what your spouse can be told.

• Why privacy is a clinical question, not a marketing one
• Layer one: HIPAA, the floor under every health record
• Layer two: 42 CFR Part 2, written for exactly this
• Layer three: what a six-bed residence adds
• Where the law runs out
• The privacy library

Why privacy is a clinical question, not a marketing one.

Ask the people who waited years to get help what they were waiting for, and a surprising number will not say money or denial. They will say they were afraid of who would find out. A partner at a firm, a physician with a license, a showrunner three weeks from a table read: for these people the fear of exposure is not vanity. It is a rational assessment of what a rumor can do to a career that took twenty years to build.

That fear delays treatment, and delay is where the damage compounds. So we treat privacy as part of the clinical work, the same way we treat sleep or nutrition. It is the perimeter around the four domains of the Rebuild Method, and it is the reason this library exists. If you understand exactly what is protected, by whom, and how far, you can make a decision about treatment based on facts rather than dread.

There are three layers. Two are federal law. One is us. They are worth understanding separately, because they protect against different things.

Layer one: HIPAA, the floor under every health record.

The HIPAA Privacy Rule applies to health plans, health care clearinghouses, and providers that bill electronically, which in practice means nearly every treatment program in the country. It sets national limits on how your protected health information can be used and disclosed, gives you the right to see and amend your record, and requires providers to tell you in writing how they handle your information. The HHS Office for Civil Rights summary is the authoritative plain-language source.

What people often miss is what HIPAA permits. A provider may share your information for treatment, payment, and health care operations without asking you first. That is how your insurer learns you were admitted, how a lab gets your order, and how a referring psychiatrist receives a discharge summary. HIPAA is a set of guardrails on a moving system, not a lock on the file.

Two HIPAA rights matter more than the rest for someone in treatment. You may ask that communications reach you in a particular way or at a particular place, and a provider must accommodate reasonable requests. And if you pay for a service entirely out of pocket, you may require the provider not to tell your health plan about it; the provider must agree. Both are in 45 CFR 164.522, and both come up on nearly every admissions call we take. Our own HIPAA notice describes how we apply them.

Layer two: 42 CFR Part 2, written for exactly this.

Congress decided in the 1970s that a record of addiction treatment was so dangerous to the person it described that ordinary medical confidentiality was not enough. The result is 42 CFR Part 2, a rule that applies to federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral. Because the definition of federal assistance is broad, taking Medicare, holding certain federal registrations, or being tax-exempt each qualify, the majority of licensed treatment providers fall under it.

The central difference from HIPAA is consent. A Part 2 program generally may not disclose that you are a patient, or anything in your treatment record, without your written consent, even for many purposes HIPAA would allow on its own. A program publicly known as an addiction treatment facility cannot confirm to a caller that you are there. Your record cannot be used against you in a criminal, civil, or administrative proceeding without your consent or a specific kind of court order. A 2024 final rule from HHS brought Part 2 closer to HIPAA in several respects, and its compliance date passed in February 2026, so the current rules are the ones described in our plain-language Part 2 explainer. The regulation itself is at eCFR Title 42, Part 2.

Part 2 is the strongest privacy law most people will ever benefit from. It is also narrower than people assume: it protects records held by a Part 2 program, and it has exceptions for medical emergencies, mandated child abuse reporting, and crimes on program premises. We explain each of these in the spoke, because an honest map of the rule includes its edges.

Layer three: what a six-bed residence adds.

The law governs records. It does not govern the number of people who see your face at breakfast. A sixty-bed facility can be perfectly HIPAA-compliant and still put you in a group room with fifty-nine strangers, some of whom will recognize you. This is the gap that the size and shape of the residence closes, and it is where our own commitments live.

We hold six beds, never more. The street address of the Encino home is not published and is shared only at admissions intake. One clinical team follows you from detox through residential care, PHP, IOP, and transitional living, so your story is not retold to a new set of staff at each step. And every person on that team is trained to treat your identity, your work, and your reputation as sensitive by default, without being asked. Nobody on staff needs to be told that a name is a big deal; the assumption is built in.

These are operational facts, not legal guarantees, and we are careful to describe them that way. What they do is shrink the number of people who could ever know, which is the variable the law cannot touch. The spoke on how six beds changes anonymity walks through the arithmetic.

Where the law runs out.

A privacy library that only listed protections would be a brochure. Here is what neither HIPAA nor Part 2 controls, so you can plan for it.

Your employer is not a covered entity. If you take leave, the paperwork moves under the Family and Medical Leave Act and, in California, state leave law, which have their own confidentiality rules but are not HIPAA. What HR actually receives, and what a manager may ask, is covered in Can my employer find out? If you use insurance, the plan's subscriber typically receives an explanation of benefits; who that person is, and what the document says, is the subject of insurance versus private pay. A thirty-day absence is visible to anyone who expects to see you. No statute hides that, and treatment without telling anyone is candid about what is and is not realistic.

Finally, the law does not bind the people you choose to tell. Another client is not a covered entity. Neither is a friend. This is why we talk about phones, photography, and social media as clinical policy rather than etiquette, and why the number six matters more than any signature on a form.

The privacy library.

Each page below answers one question in full. Read the one that is keeping you awake first.

• 42 CFR Part 2, explained. The federal rule written specifically for addiction records, in plain language.
• Can my employer find out?. What the paperwork actually says and what a manager can legally ask.
• How six beds changes anonymity. Why headcount is the privacy variable the law cannot fix.
• For professionals. Treatment designed for people whose work and reputation cannot be set aside.
• Our facility. The Encino residence, and why its size is a clinical decision.
• Executive and professional addiction treatment in Los Angeles. A post on why discretion and clinical depth belong together.