Why Won't the Treatment Center Tell Me Anything? A Family Guide to Addiction Treatment Records

You find out from a friend of a friend that your 26-year-old son checked into a treatment center three days ago. You call the number, give his name, and the person on the other end says, in a careful, level voice: "I'm not able to confirm or deny that anyone by that name is a patient here."

You are his mother. You have his insurance card in your wallet. And you are being told, politely, that you are nobody.

It does not feel like a rule. It feels like a wall. But it is a rule — two rules, layered on top of each other — and understanding them is the difference between being shut out and being let in.

Two laws, not one — and why rehab is stricter than a hospital

Most people have heard of HIPAA and assume it is the whole story. It is not. Addiction treatment records sit under a second, older and tighter set of federal rules: 42 CFR Part 2, the Confidentiality of Substance Use Disorder Patient Records regulations.

HIPAA's Privacy Rule (45 CFR Part 164) governs how most health care providers handle your information, and it has exceptions built in. Notably, 45 CFR 164.510(b) lets a provider share information with a family member, relative, or close friend directly relevant to that person's involvement in the individual's care — including, when the patient cannot be asked, whatever a clinician judges to be in the patient's best interests. That is why, when your father has a heart attack, the hospital will talk to you.

Part 2 is not HIPAA with a different label. It is stricter in exactly the place families care about most: it has no equivalent of the HIPAA family-involvement permission. There is no provision that lets a program share with you because you are close to the patient and involved in their care. It does not exist.

Part 2 applies to a part 2 program: an entity other than a general medical facility that holds itself out as providing — and does provide — substance use disorder diagnosis, treatment, or referral for treatment, and that receives some form of federal assistance. That test is broad: Medicare participation, authority to dispense controlled substances for addiction treatment, any federal grant money, even tax-exempt status can satisfy it. What Part 2 protects is records identifying someone as having, or having had, a substance use disorder — essentially, the diagnosis itself.

And 42 CFR 2.2(b)(1) supplies the logic underneath all of it: a permitted circumstance removes the prohibition but creates no obligation. A program is never required to tell you anything; it is only ever allowed to, in defined situations. So "we can't share that" is often literally true — and "we're choosing not to" is also legal.

What the rules actually forbid

The prohibitions sit in 42 CFR 2.13, and they are unusually absolute.

No workarounds. The restrictions apply "whether or not the part 2 program believes that the person seeking the information already has it, has other means of obtaining it, is a law enforcement agency, has obtained a subpoena, or asserts any other justification."
Not usable against the patient. Records may not be used in any civil, criminal, administrative, or legislative proceeding against the patient — and under 42 CFR 2.12(d)(1) that restriction follows them into anyone's hands.
State law cannot loosen it. Under 42 CFR 2.20 a state may prohibit disclosures Part 2 permits, but "no state law may either authorize or compel any use or disclosure prohibited by the regulations." Part 2 is a floor, not a ceiling.

"I can't even confirm he's a patient here"

One narrow rule produces most of the frustrating phone calls, and it is frequently over-applied.

Under 42 CFR 2.13(c)(1), the presence of an identified patient at a facility publicly identified as a place where only substance use disorder diagnosis, treatment, or referral is provided may be acknowledged only with written consent or a court order. At a dedicated addiction treatment center with that purpose on the signage, the receptionist genuinely cannot say "yes, he's here" — or "no such name," which is the same disclosure in reverse.

But acknowledgment is permitted when the facility is not publicly identified as SUD-only and the acknowledgment does not reveal that the patient has a substance use disorder — a hospital-based detox unit that does not advertise itself as such, for instance. So ask directly: "Is this program publicly identified as a substance use disorder treatment facility, and can you acknowledge whether my son is here without revealing that he has a substance use disorder?"

Consent is the door. A patient's written consent converts a prohibited disclosure into a permitted one, and 42 CFR 2.31(a) specifies what the form must contain: who may make the disclosure; the information to be disclosed, in a "specific and meaningful fashion"; who may receive it; each purpose; a statement of the right to revoke it in writing, and how; an expiration date or event ("end of the treatment" or "none" suffices for treatment, payment, and health care operations); the patient's signature, plus a parent's or guardian's where state law requires parental consent for a minor; and, for consents covering treatment, payment, and health care operations, two further statements — that the information may be redisclosed and lose Part 2 protection, and what refusing to sign means.

"At the request of the patient" is a sufficient purpose statement. And a consent covering all future treatment, payment, and health care operations disclosures may name recipients generically: "my treating providers, health plans, third-party payers, and people helping to operate this program."

Because the recipient and the information must be described meaningfully, the consent you want is not a blanket hospital-style release. It names you as recipient ("my mother, Jane Doe, and my father, Robert Doe"); the information ("my diagnosis, treatment plan, medications and dosages, appointment schedule, discharge plan, and any change in my level of care"); the purpose ("to let my parents support my treatment, attend family sessions and treatment team meetings, and coordinate my care after discharge"); and an expiration ("one year from the date of signature"). A dated consent matters: "end of the treatment" can outlive the episode, while a fixed term gives the patient a natural off-ramp.

Two things almost nobody knows

SUD counseling notes are harder to reach. 42 CFR 2.31(b) covers notes by a SUD or mental health professional documenting or analyzing a private or family counseling session, kept separate from the rest of the record. Consent for them must be separate, and a program may not condition treatment, payment, enrollment, or eligibility for benefits on the patient signing one. And a deficient consent is no consent: under 2.31(c) none may rest on a consent that has expired, substantially fails to meet the requirements, is known to have been revoked, or is materially false, and under 2.31(d) a consent covering a legal proceeding cannot be combined with one for any other purpose.

What happens after you sign

Every consent-based disclosure must carry a written statement of the record's federal protection (42 CFR 2.32(a)), plus a copy of the consent or an explanation of its scope — so if you receive information about your loved one, you are entitled to see the consent authorizing it. From there the information can travel: a covered entity or business associate receiving the record for treatment, payment, or health care operations may redisclose it under HIPAA, except in proceedings against the patient (42 CFR 2.33(b)(1)). The patient keeps two levers — a right to request a restriction on disclosures even after signing (2.26(a)(1)), and a right the program must grant, blocking disclosure to a health plan for a service paid in full out of pocket (2.26(a)(6)).

Part 2 has a closed list of disclosures that need no consent. Knowing it matters, because a family told "it's against the law to tell you" deserves to know which law and which exception is being invoked.

Medical emergencies (42 CFR 2.51). Information may be disclosed to medical personnel as necessary for a bona fide medical emergency in which prior written consent cannot be obtained — and when a program is closed during a declared emergency. The program must document it afterward: recipient, discloser, date, time, and the nature of the emergency.
Public health (42 CFR 2.54). Records may go to a public health authority only if the information has been de-identified so no patient can reasonably be identified. Research (2.52) and audit or program evaluation (2.53) have their own conditions.
Suspected child abuse and neglect (42 CFR 2.12(c)(6)). Reporting under state law is not restricted — but the original treatment records stay protected, including in any proceeding arising from the report.
Crimes on program premises (42 CFR 2.12(c)(5)). Staff may tell law enforcement about a patient's crime on the premises or against staff, or a threat to do so — limited to the incident, the person's patient status, name and address, and last known whereabouts.
Prescription drug monitoring programs (42 CFR 2.36). A program may report SUD medications it prescribes or dispenses to a state PDMP if state law requires it, but must obtain consent under 2.31 first.

Court orders are not a shortcut. Subpart E sets separate procedures and criteria for criminal-investigation orders, noncriminal orders, and orders permitting undercover agents or informants. And the patient notice required by 42 CFR 2.22 must state that a court order must be accompanied by a subpoena or similar legal mandate before the record is disclosed.

And what is not on the list: being a parent, being next of kin, being the person who pays the bills. Painful, and also liberating — the wall in front of you is not a judgment about you, and the way through is a signature, not an argument.

Parents, minors, and adult children

Age changes everything, and this is the part that catches families most off guard.

Under 18. 42 CFR 2.14 does not create a parental right to a minor's addiction records. If your child, acting alone, has the legal capacity under your state's law to apply for and obtain SUD treatment, any written consent may be given only by the minor — and the regulation says this explicitly includes disclosure to a parent for the purpose of obtaining reimbursement. Your fifteen-year-old can consent to their own treatment in many states and can then refuse to let the program tell you anything, including for billing. Where state law requires parental consent, the consent must be signed by both the minor and the parent, and the fact of the minor's application may be shared with a parent only in narrow circumstances — including when the program director determines under 2.14(c) that the minor lacks capacity to make a rational choice and the situation poses a substantial threat to the life or physical well-being of the minor or another person. Ages of consent vary enormously by state, so ask at intake — not during a crisis — what your state permits.

At 18. You have no standing unless your adult child signs a consent, or a court has adjudicated them as lacking capacity to make their own health care decisions, in which case their personal representative may consent (42 CFR 2.15(a)(1)). One narrow middle case exists: if an adult patient has a condition that prevents knowing or effective action on their own behalf and no court has adjudicated them, the program director may exercise the patient's right to consent solely to obtain payment (42 CFR 2.15(a)(2)) — a billing workaround, not a family-information pathway. Negotiate consent at the front end, while everyone is still cooperating.

After a death, and for veterans. Where a written consent is required to disclose information identifying a deceased patient, 42 CFR 2.15(b)(2) lets the personal representative give it — so ask, rather than accepting a reflexive "we can't discuss a former patient" (see our guide to grief after an overdose death). And 42 CFR 2.12(c)(1) exempts SUD records maintained by the Department of Veterans Affairs, which are governed by 38 U.S.C. 7332 instead.

Getting the records anyway — the right that never goes away

This is the lever most families never think to use. Under 42 CFR 2.23(a), Part 2 does not prohibit a program from giving a patient access to their own records — including the opportunity to inspect and copy anything the program maintains about them — and no consent is needed for that. HIPAA adds teeth: under 45 CFR 164.524 a provider must act on a request for access within 30 days, extendable by no more than another 30 days with a written statement of reasons; must provide access in the form and format requested if readily producible; and must transmit a copy directly to another person the individual designates.

So if your adult child will not authorize the program to talk to you but is willing to request their own records and hand them over — or to direct the program to send them to you — you can be fully informed of everything in the chart. It needs one willing signature: theirs. (Information obtained this way stays subject to the restriction in 42 CFR 2.23(b) on using it to initiate criminal charges or a criminal investigation.)

What changed in 2026

February 16, 2026. The compliance date for HHS's final rule at 89 FR 12472 — which rewrote Part 2 to implement section 3221 of the CARES Act — has passed. Programs now operate under amendments that allow one consent covering all future treatment, payment, and health care operations disclosures; let covered entities and business associates redisclose under HIPAA, except in proceedings against the patient; require a Patient Notice; apply HIPAA-scale penalties (42 CFR 2.3(c)); and align breach notification with HIPAA, while 42 CFR 2.16(a)(2) exempts family and informal caregivers who hold records from the formal security-policy requirements.

What did not change is the part that matters most to you. There is still no general permission to share with involved family. The 2026 rules made addiction records easier to move within the health care system; they did not make them easier for a family to obtain.

September 2026 — state Medicaid agencies. Under the interim final rule at 91 FR 33348 (effective July 31, 2026), states must implement a Medicaid community engagement requirement — work, community service, or half-time study — for certain adults aged 19 to 64, with exclusions for people who are medically frail or in qualifying treatment, no later than January 1, 2027. That raised a question: may a state Medicaid agency use someone's addiction treatment records to verify an exclusion? In September 2026, HHS's Office for Civil Rights issued guidance answering yes, in two ways: either the program already obtained the patient's consent covering all future treatment, payment, and health care operations and passed a copy along with the records, so the state agency may use them without asking again; or the state agency obtains consent directly, meeting 42 CFR 2.31, including telling the person they may revoke it. The lesson for anyone signing a consent today is that "treatment, payment, and health care operations" now reaches into state eligibility systems.

Scripts for the phone call

Families freeze in these conversations. Language that works, in order:

Lead with the limits, not the demand. "I understand you may not be able to confirm anything, and I'm not asking you to break the rules. Can you tell me what my son would need to sign for you to be able to talk to me?"
Ask which rule they are citing. "Is that the SUD confidentiality rule, 42 CFR Part 2? Is this program publicly identified as a SUD-only facility?"
Ask for the release form in advance. "Can you email me the consent form you use, so he can sign it and we don't lose three days?" The blank form is not protected information.
Name the designations up front — both parents; diagnosis, treatment plan, medications, discharge planning, family sessions — so you are not refused twice.
Ask separately about the emergency-contact field and discharge planning. Get the patient to update the emergency contact; it routes around consent for exactly one purpose. Discharge is where families most need information and most often get none — our guide to planning a successful discharge covers what to request.

If it goes badly, escalate in writing. 42 CFR 2.4 gives any person the right to file a complaint with the Secretary for a violation by a program, covered entity, business associate, qualified service organization, or lawful holder, in the same manner as a HIPAA complaint — and prohibits a program from retaliating against a patient who exercises these rights, or requiring patients to waive the right to complain as a condition of treatment.

Bottom line

The silence you are getting is almost never about you. It is the predictable output of two overlapping statutes and one very narrow acknowledgment rule, applied by staff trained to refuse rather than to explain. Consent is the door, and the consent you want is specific — named recipients, named information, dated expiration. The patient's own right of access is a second door, and it needs only their cooperation. And 42 CFR 2.4 gives you a complaint process if a program has genuinely broken the rule rather than simply followed it. If the reason you need information is payment or coverage, that is usually an easier door: programs will normally verify benefits with whoever is paying (verify insurance coverage, Medicaid treatment).

Where to get help now: SAMHSA National Helpline 1-800-662-4357 (free, confidential, 24/7, English and Spanish); 988 Suicide and Crisis Lifeline; FindTreatment.gov; Poison Help 1-800-222-1222.