You can request your rehab medical records in writing from the facility’s health information or medical records staff. Under HIPAA, the facility generally has up to 30 calendar days to respond. Those records are protected by two federal privacy layers, HIPAA and a stricter rule for addiction treatment called 42 CFR Part 2. Treatment in rehab is not something that becomes public because you went.
This guide covers how to ask for your records, how a family member or attorney can get them, what stays confidential, what happens when treatment is court-ordered, and how long records are kept.
TL;DR
- Ask the facility’s health information staff for your records in writing. HIPAA gives the facility up to 30 calendar days to respond, and many respond sooner.
- Addiction treatment records get extra protection under 42 CFR Part 2. In general they cannot be shared without your written consent or a court order with a subpoena or similar legal mandate.
- A family member or lawyer needs your signed consent, or legal authority such as a health care power of attorney, to receive your records.
- Therapy (psychotherapy) notes are treated differently from the rest of your chart, and the right of access does not cover them.
- HIPAA does not set how long records are kept. State law does.
Table of Contents
- How to request your own rehab records
- Who else can request your records
- What a valid consent form contains
- How HIPAA and Part 2 work together
- Therapy notes versus the rest of your chart
- Court-ordered treatment and legal proceedings
- How long rehab records are kept
- Our perspective
- If you need treatment now
- FAQ
- Sources
How to request your own rehab records
Start with the facility where you were treated. Most programs have a health information or medical records department, and many post a request form on their website. Typical forms ask for your full name, date of birth, dates of treatment, what you want (the full chart, discharge summary, lab results, medication records) and where to send it.
Put the request in writing even if you also call. A dated written request starts the clock and gives you something to refer back to.
What the law gives you
The HIPAA Privacy Rule gives you a legal, enforceable right to see and get copies of the information in your records held by most health care providers. The same HHS guidance says the provider must give access no later than 30 calendar days after receiving your request. It may extend that once by up to 30 more days if it tells you in writing why. HHS encourages providers to respond as soon as possible, and your provider often can send records much sooner than the outer limit.
You can also ask that a copy be sent to someone you name, such as a new doctor, a therapist or an attorney. That right is part of the same HHS guidance.
A note on Part 2 and your own access
Part 2 limits what a program can share with others. It does not take away your access. The American Medical Association’s Patient Records Electronic Access Playbook explains that Part 2 does not itself create a right of access, but it fully permits a provider to disclose health information to the patient. When you ask for a copy of your own records, following HIPAA and any state access law is sufficient.
The picture changes when the records go to a third party. According to the same AMA guide, a provider sending the part of the record that identifies a substance use disorder to someone else must have a signed consent that meets Part 2 requirements.
A practical checklist
- Confirm which facility holds the record. If a program closed or merged, ask the new owner or your state health department where the records went.
- Get the facility’s request form, or write a letter with your name, date of birth and dates of care.
- Say exactly what you need. A discharge summary is faster to produce than a full chart.
- Include a photo ID copy if the form asks for one.
- Ask how the records will be delivered (portal, secure email, paper, disc) and whether there is a fee.
- Note the date you submitted the request and follow up when two weeks have passed.
Who else can request your records
Family members
Families often call first, especially when a loved one is in detox or has just finished treatment. A program that is covered by Part 2 generally cannot even confirm that a person is a patient without permission. The reason is that, in general, Part 2 programs cannot share identifying information about a person’s substance use disorder unless the rule specifically permits it. Disclosure is generally allowed only with written patient consent or a court order and subpoena (or similar legal mandate), with limited exceptions such as emergency medical treatment.
If you are a parent, spouse or adult child, the practical path is simple: the patient signs a consent naming you. That is a normal part of admission in many programs, and the patient can decide how much you may see.
Personal representatives
Some people can act for the patient. HHS explains that a personal representative under HIPAA is someone with authority under applicable law to make health care decisions. For an adult, that includes a health care power of attorney, a court-appointed guardian, or a general or durable power of attorney that covers health care decisions. For an unemancipated minor, it includes a parent, guardian or someone acting in loco parentis. For a deceased person, it can include an executor or administrator of the estate.
HHS also answers a common question about powers of attorney. If a health care power of attorney is currently in effect, the named person has the same access rights as the patient, including the right to request a complete record with mental health information. A provider may decline to treat someone as a personal representative if it believes the patient has been or may be subject to violence, abuse or neglect by that person and decides, in professional judgment, that it is not in the patient’s best interests.
Attorneys, employers and insurers
An attorney, employer, probation officer or insurer does not get records because they ask. They need either your written authorization or a qualifying court order. Even with consent, each disclosure should come with notice to the recipient that further disclosure is not allowed unless the consent or Part 2 permits it. That requirement is stated in Massachusetts’ guide to disclosing confidential information.
What a valid consent form contains
A signed consent is the key that opens a Part 2 record to other people. A court-system training document on Part 2 lists the required elements of a written consent, including:
- the name or general designation of the program making the disclosure
- the name of the person or organization receiving the information
- the patient’s name
- the purpose of the disclosure
- a description of the information to be shared
- a statement of the patient’s right to revoke the consent
- the patient’s signature and the date
That document dates from 2012, and the rule was amended in 2024, so ask the program for its current form rather than using an old template.
The 2024 final rule did change one useful thing. HHS’s fact sheet on the Part 2 final rule says a patient can give a single consent for all future uses and disclosures for treatment, payment and health care operations. HIPAA covered entities that receive records under that consent may redisclose them in line with HIPAA. The same fact sheet describes new patient rights to an accounting of disclosures and to request restrictions on certain disclosures, with a separate compliance date for the accounting right.
The eCFR text of 42 CFR Part 2 adds that a single consent for treatment, payment and operations can be relied on until the patient revokes it in writing. If you sign one, you can end it later. Put the revocation in writing and keep a copy.
How HIPAA and Part 2 work together
Most people have heard of HIPAA. Fewer know about Part 2, which was written because stigma and legal risk kept people from seeking addiction care.
HHS’s Office for Civil Rights says that when an entity is subject to both, it must follow the more protective Part 2 rules as well as HIPAA. Part 2 generally provides stricter privacy protection than HIPAA. Washington State’s Health Care Authority puts it this way: HIPAA sets minimum protections for all health information, while federal law and Part 2 control use and disclosure of applicable SUD information, and state law may add protections.
Part 2 applies to records held by an individual or entity that is federally assisted and provides alcohol or drug diagnosis, treatment or referral for treatment, according to Massachusetts’ guidance. The AMA’s playbook adds a nuance for general medical providers. If a hospital or clinic offers many services, Part 2 covers only the portions of the record that identify you as having or having had a substance use disorder, and HIPAA and state law cover the rest.
Does rehab become a public or permanent record?
No. A treatment record is a confidential health record, not a public record. It is not posted anywhere and not searchable by neighbors, landlords or employers. It is released only through your consent, a court order with a subpoena or similar mandate, or a narrow exception such as emergency medical care, as HHS describes in its Part 2 overview. A HIPAA-covered program also cannot hand your record to an employer on request.
Two things are worth keeping apart. Your treatment chart is one thing. Court records from a criminal or civil case are another, and those can be public depending on the court and the state. If a judge ordered you into treatment, the case file is separate from the clinical chart. A local attorney can tell you what is sealed or can be sealed where you live.
The Part 2 final rule also lets records go without patient consent to public health authorities, as long as the records are de-identified under HIPAA standards. De-identified means the information no longer points to you.
For a deeper look at current privacy rules, see our article on HIPAA and Part 2 changes for rehab privacy.
Therapy notes versus the rest of your chart
Your chart includes assessments, diagnoses, medication orders, lab results, progress notes, treatment plans and discharge summaries. These are what most requests bring back.
Psychotherapy notes are a narrower category. HHS says the Privacy Rule distinguishes psychotherapy notes from information in the medical record and does not provide a right of access to them. They are generally the treating professional’s own notes, kept for personal use. A therapist may still choose to share or summarize them.
In practice, the information you most likely need, such as diagnoses, medications, treatment plan, attendance and discharge summary, is in the ordinary chart you can request. Ask for those items by name.
Court-ordered treatment and legal proceedings
When treatment is ordered by a judge or required by probation, the court usually wants proof of attendance or progress. That does not mean the court can read your whole chart.
HHS states that Part 2 prohibits using or disclosing records in legal proceedings against a patient without consent or a court order and subpoena (or similar legal mandate). The 2024 final rule keeps that protection for civil, criminal, administrative and legislative proceedings. The eCFR says a court order must be accompanied by a subpoena or other similar legal mandate compelling disclosure. The statute itself, 42 U.S.C. § 290dd-2, bars use of records and testimony against a patient except by consent or a qualifying court order.
The common route is a consent form. The patient signs a release naming the court, attorney or probation officer and the kind of information, often limited to attendance, compliance and discharge status. That keeps clinical details such as therapy content out of the court file.
Drug test results are part of the record as well. If you want to know how testing works inside a program, this overview of drug testing in rehab centers explains panels and how often tests run. Our own page on drug testing in rehab and privacy covers what patients and families can expect.
Families and attorneys coordinating a placement may find these guides useful:
- Court-ordered rehab documentation checklist
- How to document rehab attendance for court
- Probation rehab compliance roadmap
- The role of treatment centers in legal cases
How long rehab records are kept
There is no single national answer. HHS says the HIPAA Privacy Rule does not include retention requirements. State law generally governs how long records are kept, and HIPAA requires safeguards for as long as the records exist, including when they are destroyed.
Two examples show how it varies:
| State | Minimum retention at licensed facilities | Minors |
|---|---|---|
| California | Seven years after discharge (Cal. Code Regs. tit. 22, § 77143) | At least one year after age 18, and never less than seven years |
| New York | Six years after the last date of service (10 NYCRR § 751.7) | Six years after last service or three years after reaching majority, whichever is longer |
Other states set their own periods. If you need an old record, ask early. Records from a closed program may be held by a successor or custodian, and your state health department can often point you to them. Always ask the facility for its current retention policy, because the number can also depend on the type of license.
Our perspective
Privacy is not an add-on to treatment. It is part of why people walk in the door. Many of the people we hear from are afraid of what a record might do to a job, a custody case or a family relationship. Part of our work is to explain, in plain words, who can see what and why.
We keep Sylmar small on purpose. With six beds, our staff know each client, and that matters for records as much as for care. Assessments, care plans and medication decisions are individualized, and the documentation should reflect the person, not a template. We are licensed by California DHCS and accredited by the Joint Commission, and we ask clients early who they want involved and what they want shared.
For families and legal professionals, our advice is the same. Get the consent right at the start, be specific about what is released and to whom, and keep copies. It saves time later and respects the client’s control over their own story.
Jim
If you need treatment now
If you are reading this because you or someone you love needs treatment, the records questions can be answered at admission. Sylmar Treatment Center is a six-bed residential facility with 24/7 admissions support. We treat substance use and co-occurring mental health conditions together, and we work with courts and legal professionals on court-directed placements. Learn more about medical detoxification, residential treatment and dual diagnosis support, or contact our admissions team.
For legal placements, see our court-directed placements page.
FAQ
Can I get a copy of my rehab records if I left treatment early?
Yes. Your right of access applies for as long as the facility maintains your record, not only if you completed the program. Submit a written request to the facility’s health information staff and expect a response within 30 calendar days, with one possible 30-day extension.
Can my family see my records without my permission?
Generally no. Addiction treatment records are protected by Part 2, so a program usually needs your written consent to share them. Exceptions are narrow, such as a medical emergency, or a person with legal authority to act for you, such as a health care power of attorney.
Can I get my therapy notes?
Not as a matter of right. HIPAA’s right of access does not cover psychotherapy notes kept separately by the therapist. You can request the rest of your chart, including diagnoses, treatment plans, medications and discharge summary.
How long will the facility keep my records?
It depends on state law, because HIPAA sets no retention period. California requires at least seven years after discharge for licensed facilities, and New York requires at least six years after the last date of service. Ask the facility for its policy.
Sources
- HHS: Understanding Confidentiality of SUD Patient Records (Part 2)
- HHS: Fact Sheet, 42 CFR Part 2 Final Rule
- HHS: Individuals’ Right under HIPAA to Access their Health Information
- HHS: Your right to access your health information
- HHS: Personal Representatives
- HHS: Health care power of attorney and access to records
- HHS: Additional FAQs on Sharing Information Related to Treatment
- HHS: Psychotherapy notes FAQ
- HHS: HIPAA and medical record retention
- eCFR: 42 CFR Part 2
- Cornell LII: 42 U.S.C. § 290dd-2
- AMA: Patient Records Electronic Access Playbook
- Washington State HCA: SUD Information Guide
- Mass.gov: Guide on the disclosure of confidential information, Appendix D
- Part 2 written consent elements (court training document)
- California Code of Regulations, Title 22, § 77143
- New York 10 NYCRR § 751.7
- Drug testing in rehab centers: panels and cadence