Which Patient Records Receive Extra Confidentiality Protections?
Meta description: Learn which patient records may receive heightened confidentiality protections under HIPAA, federal substance use rules, and state law—and what those protections mean.
Most medical records are private, but some receive additional legal protections because disclosure could expose a person to stigma, discrimination, or other harm. In the United States, the rules depend on the type of information, the provider, the purpose of a disclosure, and the state involved. Psychotherapy notes and certain substance use disorder records have specific federal protections. HIV, genetic, reproductive health, and minor consent records may also receive heightened protection under state law. Knowing the distinctions helps patients understand their rights and helps organizations handle sensitive information appropriately.
What “Higher Confidentiality” Means
The Health Insurance Portability and Accountability Act (HIPAA) sets a federal baseline for protecting identifiable health information held by covered health care providers, health plans, and their business associates. HIPAA’s Privacy Rule generally calls this information protected health information, or PHI. It limits many uses and disclosures, but it does not treat every medical diagnosis as a separate, specially protected category.
“Higher confidentiality” usually means that another federal or state rule adds restrictions beyond the general HIPAA baseline. That may require a distinct authorization, limit redisclosure, give a patient more control, or restrict access by certain people. The additional rule may apply only to specific records or circumstances—not to every document in a patient’s chart.
HIPAA also allows certain disclosures without a patient’s written authorization, such as disclosures for treatment, payment, and health care operations, subject to applicable limits. Other laws can be stricter. When federal and state requirements differ, covered organizations generally must follow the applicable, more protective rule where federal law permits it.
Psychotherapy Notes
Psychotherapy notes are among the clearest examples of records with extra federal protection under HIPAA. These are a mental health professional’s separately maintained notes documenting or analyzing the contents of a counseling conversation. They are not simply any record that mentions mental health treatment.
HIPAA generally requires a patient’s authorization before a covered provider uses or discloses psychotherapy notes. The rule has limited exceptions, including certain disclosures by the note’s author for treatment, uses in the author’s training program, and disclosures needed to defend against a legal action brought by the patient. Separate rules may apply to disclosures required by law or to prevent a serious and imminent threat.
Routine mental health records do not automatically qualify as psychotherapy notes. A diagnosis, medication list, treatment plan, appointment date, test result, or summary of progress is generally not a psychotherapy note merely because it concerns behavioral health. These records remain PHI under HIPAA and may have additional protections under state law, but they are treated differently from separately maintained therapy notes.
For practical purposes, patients can ask a provider whether a document is part of the ordinary medical record or is maintained as psychotherapy notes. Providers should also avoid assuming that every mental health document can be withheld or released under the same rule.
Substance Use Disorder Treatment Records
Records from certain federally assisted substance use disorder (SUD) programs are protected by 42 CFR Part 2, a federal confidentiality regulation. Part 2 applies to records that identify a person as having or having had a substance use disorder and are created or received by a federally assisted Part 2 program. Not every record about substance use is automatically a Part 2 record; the program and record must meet the rule’s requirements.
Part 2 has historically imposed strict limits on disclosure, generally requiring written patient consent unless a specific exception applies. Examples of limited exceptions include certain medical emergencies, qualifying audits and evaluations, and court orders that meet the regulation’s standards. A general medical authorization does not necessarily satisfy Part 2’s requirements.
Changes to the federal rule were finalized in 2026. The revised regulation permits a patient to give a single consent for future treatment, payment, and health care operations disclosures, aligning some practices more closely with HIPAA. It retains special protections, including restrictions on using Part 2 records in legal proceedings against a patient without the required consent or court order. The compliance date for the updated rule is February 16, 2026, so requirements and implementation may depend on the date and setting.
Part 2 records may be included in an electronic health record, but that does not erase their legal protections. Providers and health information exchanges need procedures to identify protected information, respect consent choices, and prevent unauthorized redisclosure.
HIV and Other Communicable Disease Records
HIPAA protects HIV-related information as PHI, but it does not establish a special nationwide HIV confidentiality rule for every situation. Many states and territories have separate laws governing HIV test results, diagnoses, or related information. Depending on the jurisdiction, those laws may require specific written consent for disclosure, restrict access, or set special rules for reporting and partner notification.
State protections vary, and exceptions may permit disclosures for public health reporting, treatment, or other legally defined purposes. A patient’s rights can therefore depend on where the care was provided, where the record is held, and the purpose of the proposed disclosure. Similar state-specific provisions may cover sexually transmitted infections, tuberculosis, or other communicable diseases.
Patients seeking access or asking a provider to share these records can request the organization’s notice of privacy practices and ask which state confidentiality rules apply. A health care provider should not assume that a general HIPAA authorization resolves every state-law requirement.
Genetic Information and Genetic Test Results
Genetic test results and other identifiable genetic information are generally PHI when held by a HIPAA-covered organization. The Genetic Information Nondiscrimination Act (GINA) adds protections in specific settings: it generally restricts health insurers from using genetic information for eligibility or underwriting decisions and prohibits covered employers from using it in employment decisions, with defined exceptions.
GINA does not create a universal rule that every genetic record must be kept in a separate file or disclosed only with special consent. It also does not cover every type of insurance. For example, its protections do not generally extend to life, disability, or long-term care insurance. State laws may provide additional safeguards, and rules governing research participation or genetic testing can add separate consent requirements.
Genetic counseling notes, laboratory reports, and family history may each contain sensitive information, but their legal treatment depends on the context and applicable law. Patients can ask a testing provider how results may be shared with other clinicians, health plans, research programs, or family members.
Reproductive Health and Pregnancy-Related Records
Reproductive health information—including contraception, pregnancy, abortion, fertility care, and related diagnoses—is protected PHI when handled by a HIPAA-covered entity. HIPAA’s general privacy rules apply, but the information does not automatically receive one uniform, nationwide special confidentiality status simply because it concerns reproductive health.
State laws can provide additional restrictions or create different requirements for consent, disclosure, and parental access. Federal protections may also apply in particular circumstances. In 2026, the U.S. Department of Health and Human Services issued a HIPAA rule addressing certain disclosures of reproductive health care information. A federal court later vacated that rule in part in 2026. Because the legal landscape has changed and may continue to change, organizations and patients should consult current HHS guidance and applicable state law rather than rely on outdated summaries.
When a record could be requested by a family member, another state, law enforcement, or a third party, the key questions include whether the requester has legal authority, whether the disclosure is permitted under HIPAA, and whether a stricter state or federal rule applies.
Minors’ Records and Sensitive Services
Parents or guardians often have a right under HIPAA to access a minor child’s medical records as the child’s personal representative. That is not an absolute rule. HIPAA recognizes situations in which a minor may consent to care independently under state law, a court or another authorized person directs care, or a parent agrees to a confidential relationship between the minor and provider.
State laws commonly address minors’ ability to consent to services such as contraception, pregnancy care, sexually transmitted infection testing, mental health treatment, and substance use treatment. Those laws may affect whether a parent can access related records. The answer can differ by service, age, circumstances, and state; a minor’s ability to consent to a service does not always settle every question about insurance statements or electronic portal access.
Providers and health plans may need to prevent sensitive details from appearing in a parent-accessible portal or explanation of benefits when the law requires confidentiality. Patients can ask the provider’s privacy officer how records, billing notices, and online access are handled.
Other Records That May Have Special Rules
- Research records: Research participation may involve informed-consent terms, institutional review board requirements, a Certificate of Confidentiality, or other protections. Research records are not automatically exempt from every legal process.
- Genetic, mental health, or SUD records held by schools: Records maintained by a school may be governed by education privacy laws such as FERPA rather than HIPAA, depending on the organization and record.
- Public health and abuse-related information: Reporting laws can require disclosure of certain conditions or suspected abuse. These duties may coexist with privacy protections.
- Legal or forensic records: Records created for a court, correctional facility, or legal evaluation may be subject to specialized statutes, court orders, or professional rules.
These examples show why a sensitive subject alone does not determine the legal status of a record. The custodian, purpose, funding, consent, and governing law all matter.
How Patients Can Protect Sensitive Medical Information
Patients can take practical steps to understand and manage access to confidential records:
- Ask the provider which records are covered by special federal or state confidentiality rules.
- Request a copy of the organization’s notice of privacy practices and ask how to submit a restriction or confidential-communication request.
- Check patient portal proxy settings, shared-device access, and notifications that may reveal appointment or test details.
- Ask how billing statements and explanations of benefits may disclose a service to another person who holds the insurance policy.
- Use a specific, written authorization when sharing sensitive records with an employer, attorney, family member, or other third party, and review its scope and expiration.
- Contact the organization’s privacy officer if information appears to have been disclosed improperly. HIPAA complaints can also be submitted to the HHS Office for Civil Rights.
A request to restrict disclosure does not guarantee that a provider must agree in every circumstance. HIPAA gives patients certain rights to request restrictions and confidential communications, while other laws may impose stronger obligations.