Insurance or private pay: what each path reveals, and to whom.

Authored by the MLJ Clinical Team. Reviewed under board-certified psychiatric oversight. Last updated September 2026.

• An explanation of benefits lists the provider, dates, and service categories for each claim, and it is addressed to the policyholder, who may not be you.
• HIPAA and California law both give you the right to ask a health plan to send communications about sensitive services directly to you, and plans must honor a reasonable request.
• An employer that sponsors a health plan is legally walled off from individual claims; the risk from insurance is a household risk, not a workplace one.
• Paying out of pocket removes the insurer from the picture entirely and gives you a HIPAA right to keep that service off your plan's records, but it does not erase the treatment record itself.
• Neither path is the "private" one in every situation; which is quieter depends on who holds your policy and what you plan to do afterward.

• The document nobody thinks about
• Who holds the policy
• Redirecting the mail: your rights
• Employer-sponsored, individual, and integrated plans
• What the insurer itself learns
• What private pay changes, and what it does not
• Side by side
• Deciding without being sold to

The document nobody thinks about.

Every time a health plan processes a claim, it generates an explanation of benefits, usually called an EOB. It is not a bill. It is a statement that tells the policyholder what the plan was asked to pay, what it agreed to pay, and what remains the patient's responsibility. Most people throw them away unread, which is why they rarely think about what one contains.

A typical EOB names the provider, lists dates of service, describes the service in a category or a billing code, and shows the billed, allowed, and paid amounts. For a residential stay it may show weeks of consecutive dates and a provider whose name or category makes the nature of the care plain. Some plans print codes rather than descriptions; some print both. Either way, an EOB for a thirty-day stay at an addiction treatment program is not a mystery to a curious reader.

None of that is a problem if the only person who receives the EOB is you. The whole privacy question about insurance reduces to a single fact: whose name is on the policy.

Who holds the policy.

If you are the subscriber on your own plan, the EOB comes to you, by mail or through an online portal you control. Your insurer knows, and we return to what that means below, but no one in your household learns anything from the paperwork.

If you are covered as a spouse or domestic partner on someone else's plan, the default is different. The subscriber is the plan's customer, and communications about claims, including yours, are typically addressed to them. If you are under twenty-six and on a parent's plan, the same applies, and the parent is often the one with the portal login. In both cases the plan is doing exactly what it is designed to do; it simply was not designed with your situation in mind.

This is the place where insurance and privacy genuinely collide, and it is the reason the question comes up on so many admissions calls. Whether the collision matters depends entirely on whether the policyholder already knows. For a spouse who drove you to the door, an EOB is a piece of mail. For a spouse you have not told, it is the conversation you were trying to postpone. We address both cases honestly in treatment without telling anyone.

Redirecting the mail: your rights.

You are not stuck with the default. Two sets of law let you change where plan communications go.

Under the HIPAA Privacy Rule at 45 CFR 164.522(b), you may ask any covered entity to communicate with you by alternative means or at an alternative location. A health care provider must accommodate any reasonable request without asking why. A health plan must accommodate a reasonable request if you state clearly that disclosure of the information could endanger you. That word, endanger, is a real threshold, and not every household situation meets it, which is why the second set of rules matters more for many Californians.

California's Confidentiality of Medical Information Act, in Civil Code section 56.107, requires health plans to honor a request for confidential communications about sensitive services, a category that expressly includes mental health and substance use disorder care, and to direct those communications to the individual who received the care rather than the policyholder. The plan may not require you to give a reason. The request can be made by phone, in writing, or through the plan's online process, and it stays in effect until you revoke it. Every insurer we work with, including Aetna, Anthem, Cigna, Kaiser Southern California, and UnitedHealthcare, has a procedure for this. Ask for it by name, confirm the mailing address and portal settings, and do it before the first claim is filed, because a request cannot recall an EOB that has already gone out.

Two practical cautions. Shared online portals are a common weak point; a spouse who set up the family login can often see every dependent's claims regardless of where paper is mailed, so ask the plan how the confidentiality request affects portal access. And the federal rule and the state rule sit on top of each other; when you call, invoke both.

Employer-sponsored, individual, and integrated plans.

The other fear about insurance is that the company paying part of the premium can see what it buys. It cannot, in any way that reaches your manager. The Privacy Rule permits a group health plan to share individual health information with the employer as plan sponsor only for plan administration, only under plan documents that promise not to use it for employment decisions, and only with the specific employees who perform those functions. The HHS summary of the HIPAA Privacy Rule covers the plan-sponsor provisions. In a fully insured plan, the employer typically receives only aggregate or de-identified reports. In a self-funded plan, a handful of benefits administrators may see claims, and they are legally required to keep that information away from everyone else in the building. The employer spoke covers the rest of the workplace picture.

An individual or marketplace plan has no employer in the chain at all. And an integrated system like Kaiser Southern California keeps your records inside one organization; the substance use portions of that record are still protected by 42 CFR Part 2 when they originate with a Part 2 program, and by Kaiser's own obligations as a covered entity otherwise. We verify benefits for all of these plan types before admission, and the verification itself is a conversation between us and the plan that generates no mail to your home.

What the insurer itself learns.

Whatever you do about the EOB, the plan that pays for your care will know it paid for your care, and it will know more than the EOB shows. Authorizing residential treatment involves utilization review: a clinician on our side describes your condition to a reviewer on their side, at admission and periodically during the stay, to establish medical necessity. That exchange happens under the payment consent you sign at intake, which under Part 2 must be in writing, and the insurer is bound by HIPAA and by Part 2's redisclosure limits in what it does with the information. Insurers are heavily regulated covered entities, and the risk of an insurer leaking your record to a third party is small.

The longer-horizon consideration is different. Applications for individually underwritten life or disability insurance commonly ask about treatment history and request authorization to obtain medical records. A Part 2 program cannot release your record to an underwriter without your consent, but the application itself will ask you the question, and answering it untruthfully is its own problem. This is not a reason to avoid insurance for treatment; the claims history and the honest answer would exist either way. It is simply part of a complete picture, and we would rather you hear it from us.

What private pay changes, and what it does not.

Paying directly removes the insurer from the transaction. There is no claim, no utilization review, no EOB, and no entry in a plan's claims history. It also activates a specific HIPAA right: under 45 CFR 164.522(a)(1)(vi), if you pay for an item or service in full out of pocket and ask the provider not to disclose it to your health plan, the provider must agree. That restriction is one of the few in HIPAA that a provider cannot refuse.

What private pay does not do is make the treatment disappear. The record still exists, held by us, protected by Part 2, and available to you. If you take leave from work, the FMLA certification is completed the same way regardless of who pays. If you later ask us for a superbill to submit for reimbursement, the insurer re-enters the picture and so does the EOB. And private pay does not change what happens inside the residence, which is where the more important privacy work of a six-bed program actually occurs; the headcount question is the same on either payment path.

Some clients choose private pay for reasons that have nothing to do with secrecy: they want to avoid utilization review dictating length of stay, or the plan's network does not include the level of care they need. Others choose it purely because the policyholder is someone they are not ready to tell. Both are legitimate. The private pay page in the paying-for-treatment library describes how it works in practice.

Side by side.

Deciding without being sold to.

We accept both, and we have no stake in which you choose. A useful way to decide is to answer two questions in order. First, who is the policyholder, and do they already know? If it is you, or a spouse who knows, insurance carries almost no privacy cost and the EOB is paperwork. If it is someone you have not told, decide whether a confidentiality request solves the problem or whether you would rather remove the variable entirely. Second, do you anticipate needing anything from the insurer later, such as reimbursement or continued authorization for outpatient care after residential? If so, the insurer will learn about the episode eventually, and the privacy argument for paying the first stage privately weakens.

Whatever you decide, decide before admission, because the sequence matters: confidentiality requests go in before the first claim, and private-pay restrictions are set up at intake. Our admissions team will walk through your specific plan with you on the phone, and the paying for treatment library covers the financial side in the same plain terms.

• Privacy in treatment — the hub, with HIPAA and Part 2 explained side by side.
• Treatment without telling anyone — for the situation where the policyholder is the person you have not told.
• Can my employer find out? — the workplace channels, from FMLA forms to what a manager may ask.
• In-network, out-of-network, and single-case agreements — the financial mechanics behind the insurance path.
• Verify your insurance — a confidential benefits check that generates no mail to your home.
• Does insurance cover addiction treatment? — a post on coverage basics under parity law.