Guides
Rehab, privacy and your job: what the rules generally protect
Federal rules limit how health plans and treatment providers share your health information, and records from many substance use treatment programs have extra protection under 42 CFR Part 2. But HHS says the HIPAA Privacy Rule generally does not apply to employers or your employment records, so there is no guarantee an employer will never learn about treatment — especially if you request leave or workplace rules require reporting.
Published by the NYSHIP.rehab editorial resource · Updated
What does HIPAA cover — and not cover?
HIPAA's Privacy Rule applies to health plans, most health care providers and their business associates. HHS explains that it does not protect your employment records, even health-related ones, and in most cases does not apply to the actions of an employer (HHS: employers and health information (opens in a new tab)).
HHS also notes that your employer can ask you for a doctor's note or other health information for things like sick leave, but if your employer asks your provider directly, the provider generally cannot share it without your authorization.
How does 42 CFR Part 2 add protection?
Part 2 protects the confidentiality of records from federally assisted substance use disorder treatment programs. HHS finalized a rule on February 8, 2024 that aligns parts of Part 2 with HIPAA and adds patient rights, with a compliance date of February 16, 2026 (HHS fact sheet (opens in a new tab)). Whether Part 2 applies depends on the program, so ask.
Does the ADA protect people in treatment?
ADA.gov says the ADA protects people in recovery from opioid use disorder who are not engaging in illegal drug use, including those taking medication prescribed by their doctor to treat OUD. It also states the ADA does not protect people who are currently illegally using drugs. Whether protection applies depends on the facts, the job and conduct (ADA.gov (opens in a new tab)).
When might an employer learn something?
| Situation | What may be shared |
|---|---|
| Requesting FMLA or other leave | Medical certification of a serious health condition — see medical leave for rehab |
| Doctor's note for sick leave | What you choose to provide; HHS says employers may ask you for it |
| Employee assistance program (EAP) | Depends on the EAP's own policies; ask before you share |
| Safety-sensitive jobs or testing programs | Results may be reported under workplace or federal rules |
| Your written authorization | Whatever you agree to release |
Health plan claims themselves are handled by the plan, which is covered by HIPAA. Explanation-of-benefits statements may be mailed to the enrollee, which matters for adult dependents on a parent's or spouse's plan.
What should you ask before sharing anything?
Questions to ask
- Program: Is this program covered by 42 CFR Part 2? What will you send my health plan?
- Program: What exactly goes on a leave certification form if I request one?
- HR: Who sees medical certification, and where is it stored?
- EAP: Is anything reported back to my supervisor?
- Union or attorney: How do my contract and any workplace substance policy apply?
This is general information. For your situation, consider a labor or employment attorney or your union representative.
Related guides
- GuidesCan you take medical leave for rehab?Can you take FMLA leave for rehab? DOL's treatment-vs-use distinction, eligibility requirements, employee protections and questions for HR.
- GuidesHow to help a loved one with NYSHIP coverage get treatmentPractical, respectful steps for families: how to talk about treatment, what Empire Plan information to gather, privacy limits, and when to seek emergency help.
- TreatmentOpioid use disorder treatment and NYSHIP coverageHow opioid use disorder is treated — FDA-approved medications, counseling and naloxone — and questions to ask about Empire Plan network care and certification.
Sources and source dates
- HHS — Employers and health information in the workplace (opens in a new tab) — Accessed October 17, 2026
- HHS — HIPAA for individuals (opens in a new tab) — Accessed October 17, 2026
- HHS — Fact sheet: 42 CFR Part 2 final rule (opens in a new tab) — Dated February 8, 2024, updated January 30, 2026; accessed October 17, 2026
- ADA.gov — Opioid use disorder and the ADA (opens in a new tab) — Accessed October 17, 2026
- U.S. Department of Labor — Fact Sheet #28A: Employee Protections under the FMLA (opens in a new tab) — Accessed October 17, 2026
Plan guides are summaries and can change. Your Empire Plan Certificate and Certificate amendments control. This page is general education, not medical, legal or benefits advice. Read our editorial standards.