Author: A. Ant, CADC-II, Licensing & Accreditation Expert.
Disclaimer: This content is provided for general informational purposes only and should not be construed as medical, clinical, legal, financial, tax, accounting, insurance, licensing, accreditation, regulatory, billing, employment, or compliance advice. Requirements change often. Consult qualified professionals or contact Continued Compliance, Inc. at (213) 864-8554 for guidance specific to your situation. If your program is served with a subpoena or court order, contact legal counsel immediately — this article explains the framework, not what to do in your specific case.
Photo: A police officer holds papers while examining a document, illustrating the kind of subpoena or legal paperwork a program may be served with.
Short answer: yes, 42 CFR Part 2 protects your client, and a subpoena by itself does not override that protection — not from police, not from a prosecutor, not from anyone. A subpoena is one of the most common documents used to try to get around Part 2, and it is also one of the least effective on its own. Knowing the difference between a subpoena and what Part 2 actually requires is the single most important thing front-desk staff, clinicians, and administrators need to understand before law enforcement ever shows up.
The Short Version
A subpoena, a search warrant, an arrest warrant, or a general court order is not, by itself, legal authority to disclose a client’s substance use disorder treatment records or even to confirm that person is a client. Under 42 CFR Part 2, disclosure requires either the client’s specific written consent or a special court order issued under Part 2’s own procedures (Subpart E) — and even that special order does not compel disclosure on its own. This rule applies regardless of what the requesting party believes, already knows, or asserts as justification. The regulation is explicit that it does not matter whether the person seeking records “has obtained a subpoena, or asserts any other justification” — the Part 2 restrictions still apply.
Why a Subpoena Alone Doesn’t Work
A subpoena is a demand to appear or produce documents. It is not, by itself, a judicial finding that disclosure of Part 2-protected records is appropriate. Part 2 draws a sharp line between an authorizing court order (which permits disclosure that would otherwise be prohibited) and a subpoena or similar legal mandate (which compels someone to actually act). Under the regulation, an authorizing court order “does not compel use or disclosure” by itself — a subpoena or similar mandate must also be issued, and even then, only after the authorizing order exists. In practice, that means a program that receives a bare subpoena, with no accompanying Part 2-compliant court order, is not permitted to disclose the records and should not do so.
What an Actual Part 2 Court Order Requires
Getting a court order that actually authorizes disclosure under Part 2 is a deliberately high bar. Before a judge can issue one, the regulations require:
- Notice to the patient and the program that the order is being sought.
- An opportunity to be heard, including the right to be represented by counsel independent of counsel for a law enforcement applicant.
- Use of a fictitious name for the patient in the proceeding, to avoid disclosing identity during the process itself.
- Confidential proceedings — held in the judge’s chambers or in a manner that keeps patient-identifying information from anyone who is not a party, the patient, or the record holder.
- A finding of good cause, meaning the judge has weighed the public interest and need for disclosure against the potential injury to the patient, the treatment relationship, and the program’s services.
The Even Higher Bar: Criminally Investigating or Prosecuting the Patient
If law enforcement wants Part 2 records specifically to investigate or prosecute the patient, the standard climbs further. Under 42 CFR Section 2.65, the court must additionally find that the crime under investigation is extremely serious — the kind that threatens loss of life or serious bodily injury, among other factors — that the records will provide substantial value to the investigation or prosecution, and that law enforcement has no other reasonably available means of obtaining the information. The court must also weigh the potential harm to the provider-patient relationship. If an order is granted, it must be narrowly limited to the law enforcement officials responsible for that investigation or prosecution, and the program should only disclose the specific parts of the record that fulfill the order’s stated objective.
You Cannot Even Confirm the Client Is There
This surprises a lot of front-desk staff: at a facility that is publicly identified as a place providing only substance use disorder diagnosis, treatment, or referral, staff cannot acknowledge that a specific person is present or being treated there — not even a simple “yes” or “no” — unless the patient has given written consent or a qualifying court order has been entered. Confirming presence is itself a disclosure under Part 2.
A Note on the 2024 Rule Change
The 2024 Part 2 Final Rule (see 42 CFR Part 2 in 2026: What Changed, What Didn’t, and What’s Now Enforced for the full breakdown) did not weaken the subpoena/court-order framework described above. It did, however, change one related point: patients can now provide written consent authorizing disclosure of their own records for the purpose of a criminal investigation or prosecution of themselves, where previously that specific type of disclosure generally required the special court order process rather than consent alone. This makes it more important than ever to read any consent form carefully rather than assume its scope, since a signed consent covering that purpose could authorize what the court-order process used to be the only path to.
What to Actually Do When It Happens
If a police officer or other law enforcement official arrives at your program with a subpoena, search warrant, or arrest warrant:
- Do not forcibly resist an officer’s attempt to enter the premises. Compliance with a physical presence is not the same as consenting to disclosure.
- Do not disclose records or confirm a client’s presence based on a subpoena, warrant, or verbal assertion of authority alone.
- Contact legal counsel immediately — before responding substantively to the request, not after.
- Document exactly what was presented, by whom, and what was requested, so counsel has the complete picture.
- Check whether a Part 2-compliant court order actually exists and, if so, whether it is accompanied by a subpoena or similar mandate that compels action — the order alone does not.
Every program should have a written policy covering exactly this scenario, with a named point of contact, a documented escalation path to legal counsel, and staff training so that whoever answers the door on a given day is not making this judgment call alone, on the spot, for the first time.
Continued Compliance helps behavioral health and substance use disorder providers build the policies, training, and response procedures that protect clients when law enforcement comes calling. If we partner, we will guarantee in writing to get your facility licensed, accredited, or certified, or your money back. Period. For a free consultation, contact Continued Compliance through our website or call (213) 864-8554.
Frequently Asked Questions
Does a subpoena require my program to release a client’s records?
No. A subpoena alone is not sufficient legal authority to disclose Part 2-protected records. Disclosure requires either the client’s written consent or a Part 2-compliant court order, and even that order does not compel disclosure without an accompanying subpoena or similar mandate.
Can we tell police whether someone is a client at our facility?
Generally, no, if your facility is publicly identified as providing only substance use disorder services. Acknowledging a client’s presence is itself a disclosure and requires the client’s written consent or a qualifying court order.
What makes a court order valid under 42 CFR Part 2?
It must follow Part 2’s specific procedures: notice to the patient and program, an opportunity to be heard with independent counsel, use of a fictitious name, confidential proceedings, and a judicial finding of good cause. A general court order that does not follow this process is not sufficient.
Is there a higher standard when law enforcement wants records to prosecute the patient?
Yes. Under 42 CFR Section 2.65, the court must find the crime is extremely serious, that the records provide substantial value to the investigation, and that no other means of obtaining the information exists, while weighing harm to the treatment relationship.
Leave a Reply