Wisconsin Virtual Opioid Treatment Provider Privacy Laws: A Compliance Checklist

Virtual care does not reduce your privacy obligations. If you provide opioid use disorder treatment to Wisconsin patients, build your compliance process around the records you create, the laws that apply to your program, and the way information moves through telehealth platforms and vendors.

Use this checklist to assess 42 CFR Part 2, HIPAA, Wisconsin confidentiality laws, telehealth consent, opioid treatment program recordkeeping, and patient authorizations. It is especially important to distinguish an opioid treatment program (OTP) from a general medical practice that offers opioid use disorder treatment: OTP certification requirements do not automatically apply to every virtual prescriber.

Federal Confidentiality Rules for Substance Use Disorder Records

Start by determining whether your organization is a Part 2 program. 42 CFR Part 2 generally applies to federally assisted programs that provide substance use disorder diagnosis, treatment, or referral and maintain records identifying a person as having or having had a substance use disorder. Treating a patient for opioid use disorder alone does not automatically make every individual practitioner a Part 2 program.

For programs subject to Part 2, the updated federal rule has required compliance since February 16, 2026. A patient may give one written consent covering future uses and disclosures for treatment, payment, and health care operations (TPO). A covered entity or business associate that receives records under a valid TPO consent may generally redisclose them as HIPAA permits, but the records remain protected from use against the patient in legal proceedings unless the patient gives specific consent or the disclosure meets Part 2’s court-order requirements.

• Document whether your organization is a Part 2 program and identify which records are covered.
• Use a written consent that clearly describes the permitted disclosure and its scope. Keep consent for legal proceedings separate from consent for other purposes.
• Obtain separate consent before disclosing SUD counseling notes where Part 2 requires it.
• Train staff not to treat a general HIPAA permission as automatic authority to disclose Part 2 records.
• Document any disclosure made under a specific exception, including the legal basis, recipient, information shared, and date.

Part 2 permits certain disclosures without patient consent in limited circumstances. These can include disclosures needed during a bona fide medical emergency when prior consent cannot be obtained, specified internal communications, and certain disclosures for audits, evaluations, research, or to qualified service organizations under applicable safeguards. Disclosures must stay within the scope of the exception; for example, an emergency disclosure should be limited to information needed to address the emergency.

HIPAA Privacy and Security Requirements

Determine whether your practice is a HIPAA covered entity, business associate, or both. If HIPAA applies, the Privacy Rule governs permitted uses and disclosures of protected health information, while the HIPAA Security Rule requires safeguards for electronic protected health information. HIPAA may permit many treatment, payment, and health care operations disclosures without a separate HIPAA authorization, but that permission does not remove stricter Part 2 or Wisconsin requirements.

For virtual services, assess the full path that electronic information takes: scheduling, video visits, messages, prescribing, billing, storage, and vendor support. The HIPAA Security Rule calls for administrative, physical, and technical safeguards, including a risk analysis and reasonable measures to protect the confidentiality, integrity, and availability of electronic protected health information. A platform’s marketing claim alone does not establish compliance. Review vendor access and responsibilities, and put a business associate agreement in place when required.

• Inventory the systems and devices that create, receive, store, or transmit patient information.
• Use role-based access, individual accounts, authentication, audit controls, secure transmission, and workforce training appropriate to your risk assessment.
• Review business associate agreements and define how vendors will safeguard information and report incidents.
• Maintain a breach-response process that covers HIPAA and Part 2 notification duties.
• Provide and maintain the privacy notices required for your organization. Since February 16, 2026, HIPAA covered entities that create or maintain Part 2 records must include required information about those records in their Notice of Privacy Practices; Part 2 programs must also provide the required patient notice.

Wisconsin Health Records Confidentiality Laws

Assess both Wisconsin Statutes Chapter 51 and Wisconsin Statutes Section 146.82. Chapter 51 protects treatment records related to substance use and other covered services; Section 146.82 addresses the confidentiality of patient health care records. Depending on the provider and record, both state provisions may matter alongside HIPAA and Part 2. Wisconsin’s treatment-record rules provide for written informed consent and also identify specific circumstances in which disclosure may be allowed without it.

For a disclosure requiring informed consent under Chapter 51, check that the authorization identifies the patient and recipient, states the purpose or need and the specific information to be released, sets an effective period, and includes the date and the signature of the patient or legally authorized person. Do not assume that a broad release or a consent to receive virtual care meets these requirements.

Wisconsin law contains defined exceptions, including certain disclosures for current treatment and medical emergencies. Each exception has conditions and limits. Before relying on an exception, confirm that it applies to the type of record, recipient, and purpose at issue, and that the disclosure is not barred by Part 2 or another applicable rule. Apply the requirement that affords the patient the greater protection when laws overlap.

• Classify substance use treatment records separately where needed so staff can identify heightened confidentiality requirements.
• Use a Wisconsin-compliant authorization when written consent is required, and record its scope and expiration.
• Limit disclosures to the information the applicable permission or exception allows.
• Set access controls and confidentiality procedures for electronic records, not only paper files.

Telehealth Consent and Documentation

Do not assume Wisconsin has one universal consent form or rule that applies identically to every telehealth profession and program. Requirements can depend on the clinician’s profession, applicable standards of care, treatment type, and payer or program rules. Consent to receive treatment by telehealth is also different from authorization to release a patient’s records.

For physicians, Wisconsin’s telemedicine rules require the same standards of practice and conduct, including confidentiality and recordkeeping, whether services are provided in person or by telemedicine. The rules also require informed consent for certain online treatment recommendations and a documented patient evaluation and health care record. OTPs have an additional federal requirement: patients must voluntarily choose medication treatment, receive an explanation of relevant information, and provide informed consent to treatment.

Document the patient’s agreement to the treatment and, where applicable, the telehealth modality. Your record should identify the date and participants, the method of communication, the patient’s location when relevant, the clinical assessment, the plan, and any limitations or follow-up arrangements. Explain privacy risks that matter to the visit, such as who may be present at either end, and agree on a practical plan for disconnection or an emergency.

• Verify the patient’s identity and location at the start of the encounter.
• Explain how the virtual visit will work, including relevant limits and alternatives to remote care.
• Document consent to treatment and any separate consent required by the clinician’s professional rules or program.
• Keep release-of-information authorizations separate from telehealth consent forms.
• Confirm that the patient can participate privately and can contact the care team if technology fails.

Opioid Treatment Program Recordkeeping

An OTP is a specific federally regulated program, not simply any practice that treats opioid use disorder virtually. OTPs must meet federal certification, accreditation, and registration requirements to operate in that capacity. A virtual service model does not remove those requirements. If your organization is not an OTP, determine its obligations under the rules that actually apply rather than assuming OTP certification rules cover every prescriber.

Federal OTP standards require a recordkeeping system adequate to document and monitor patient care, with records kept confidential under applicable federal and state requirements. Maintain records that support the clinical decisions made, such as assessments, treatment plans and updates, informed consent, medication decisions, care coordination, referrals, and relevant telehealth encounters. Make sure the record shows who made an entry and when, and correct errors through a traceable process rather than obscuring the original documentation.

• Maintain clear procedures for creating, accessing, correcting, transferring, and disposing of records.
• Document clinical decisions and their basis, including significant changes to medication or the treatment plan.
• Record consent forms, releases, relevant patient communications, referrals, and follow-up.
• Keep a retention schedule that accounts for applicable Wisconsin, federal, licensing, and contractual requirements. Do not assume a single retention period applies to every record.
• Plan for secure record access and continuity of care during a technology outage, vendor change, or program closure.

Patient Access and Disclosure Authorizations

Create a process for receiving, verifying, tracking, and responding to patient requests for records. HIPAA gives individuals access rights when it applies, and Wisconsin law also addresses access to treatment records. Review any applicable limits, such as protections for another person’s information, before fulfilling a request. Provide access through a secure method and document the response.

Use a disclosure authorization that clearly identifies the recipient, purpose, information, and effective period. Record when the authorization is signed, track whether it has been revoked or expired, and verify that the planned disclosure falls within its scope. A valid Part 2 TPO consent may support future disclosures for those purposes, but it does not create blanket permission for every use, disclosure, or legal proceeding.

• Set a consistent workflow for patient access requests, including identity verification and secure delivery.
• Check the law and the authorization before sharing records with another clinician, family member, payer, employer, or other third party.
• Keep a disclosure log where required and make the documentation available to staff who handle privacy requests.
• Train staff to escalate subpoenas, court orders, law-enforcement requests, and other unusual disclosures for review.
• Review access permissions and authorizations regularly, especially when staff roles, vendors, or care arrangements change.

In practice, your compliance checklist should identify which laws apply, secure every virtual-care system, document treatment and telehealth consent separately from record-release permissions, and review every disclosure against the applicable rule. Revisit the checklist when your services, technology, or legal requirements change.

FAQs

Do Wisconsin virtual opioid treatment providers have to comply with 42 CFR Part 2?

They must comply when they are Part 2 programs or otherwise handle records covered by Part 2. The fact that a clinician provides opioid use disorder treatment virtually does not, by itself, decide whether Part 2 applies. Determine whether the organization meets the federal program criteria and identify which records it maintains in that capacity.

When can a provider disclose opioid treatment records without patient consent?

Only when an applicable law permits the specific disclosure. Part 2 includes limited exceptions, such as disclosures needed for a bona fide medical emergency when prior consent cannot be obtained, and certain disclosures for internal communications, audits, research, or qualified service organizations. Wisconsin law also provides defined exceptions. Confirm the conditions for the particular exception, disclose only what it allows, and document the basis.

Does Wisconsin require consent for telehealth treatment?

Do not treat telehealth consent as one uniform requirement for every profession and service. Wisconsin’s rules and professional standards can vary; for example, physician telemedicine rules address informed consent for certain online treatment recommendations, and OTP rules require informed consent to medication treatment. Check the requirements applicable to your clinician and program, and document the patient’s agreement when required. A telehealth consent does not authorize disclosure of treatment records.

How do HIPAA and Wisconsin law apply to virtual opioid treatment records?

HIPAA applies when the provider is a covered entity or business associate, and its Privacy and Security Rules govern applicable uses, disclosures, and safeguards for electronic information. Wisconsin Statutes Chapter 51 and Section 146.82 may add confidentiality and consent requirements, while Part 2 may protect records held by a covered substance use disorder program. Apply each rule that covers the provider or record, and do not rely on HIPAA permission alone when a stricter rule applies.