Who can see your ADHD diagnosis and prescriptions in New York

Concern about who will find out keeps some adults from seeking an ADHD evaluation, particularly because the usual medications are controlled substances tracked by the state. The rules are more protective than many people assume, and they also have limits worth knowing. This article describes them as of October 2026. It is general information, not legal advice. For a specific concern, ask your clinician's office for its notice of privacy practices or consult a health care attorney.

Who can see what: a summary

What HIPAA does and does not do

The general federal rule is that a covered health care provider may not use or disclose protected health information without a valid authorization, except as the regulations permit or require (45 CFR 164.508). A separate section, 45 CFR 164.506, permits use and disclosure for treatment, payment and health care operations, which is why your pharmacy and your insurer receive information without a separate form each time.

HIPAA is aimed at providers and health plans. The federal Department of Health and Human Services puts the employer question this way:

• "In most cases, the Privacy Rule does not apply to the actions of an employer," and it does not protect employment records even when they contain health information.
• Your employer can ask you for a doctor's note or other health information for sick leave, workers' compensation, wellness programs or health insurance.
• If your employer asks your provider directly, the provider "cannot give your employer the information without your authorization unless other laws require them to do so."

So an employer learns of an ADHD diagnosis in practice when you tell them or sign a release. What the employer must then do with the information is governed by disability law, covered in telling your employer about ADHD.

Psychotherapy notes are a narrow category

HIPAA gives extra protection to psychotherapy notes, and people often assume this shields everything in a psychiatric chart. It does not. The regulation defines psychotherapy notes as a mental health professional's notes analyzing the contents of a counseling session that are kept separate from the rest of the record. The definition expressly excludes "medication prescription and monitoring," session start and stop times, the modalities and frequencies of treatment, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis and progress (45 CFR 164.501).

For an adult with ADHD, that means the diagnosis, the stimulant prescription and the medication follow-up notes are ordinary protected health information. They are still confidential under the general rule. They simply do not receive the stricter psychotherapy-note treatment.

There is a mirror-image effect on your own access. Under 45 CFR 164.524 you have a right to inspect and copy your record, except for psychotherapy notes and information compiled for legal proceedings.

New York records laws: which one applies

Two state statutes are often confused.

Mental Hygiene Law 33.13 protects clinical records kept by facilities licensed or operated by the Office of Mental Health or the Office for People With Developmental Disabilities, and certain providers funded or approved through them. Those records are not public and may be released only as the statute lists, for example with the patient's consent or under a court order. By its terms it does not govern a solo private psychiatric office that is not licensed by those agencies.

Public Health Law 18 covers licensed health care practitioners, hospitals and other providers. It gives you these rights:

• an opportunity to inspect your records within ten days of a written request;
• copies within a reasonable time, with paper copies capped at 75 cents per page;
• no denial of access solely because of inability to pay.

A practitioner may withhold personal notes and observations, and access can be denied where release could reasonably be expected to cause substantial and identifiable harm. A denied request can be taken to a medical record access review committee at no charge. When records go to a third person, the chart must hold a copy of your written authorization or a notation of who received them and why.

The Prescription Monitoring Program registry

Stimulants are Schedule II controlled substances. In New York, pharmacies report each controlled-substance dispensing to the state, and according to the Department of Health a patient's registry report shows all controlled substances dispensed in New York and reported for the past year.

Since August 27, 2013, most prescribers have been required to consult the registry when writing prescriptions for Schedule II, III and IV drugs (Public Health Law 3343-a). The same statute says registry information "is accessible only by practitioners, pharmacists or their designees" for the listed purposes, that designees must work for or under contract with the same practice or pharmacy, and that the Department must monitor and record every access.

Public Health Law 3371 lists the other permitted disclosures. They include:

• Department of Health employees carrying out the controlled substances law;
• a judicial subpoena or court order in a criminal investigation or proceeding;
• agencies that license or supervise people authorized to handle controlled substances;
• the Medicaid fraud control unit, for investigations of fraud, waste or abuse in the Medicaid program;
• a medical examiner or coroner;
• the individual, for his or her own controlled substance history.

Employers and private health insurers do not appear in either section. Police have no direct lookup, but it would be wrong to say they can never obtain the data: a subpoena or court order in a criminal matter is one route, and the Department may notify law enforcement when it has reason to believe a diversion crime has been committed. A cross-referenced section, 3371-a, was not reviewed for this guide and may add recipients.

You can see your own history. The simplest route is to ask your prescriber for a copy of your registry report. The Bureau of Narcotic Enforcement's own request procedure could not be confirmed for this guide. How the registry affects prescribing day to day is explained in I-STOP and the Prescription Monitoring Program.

Limits on confidentiality

• Risk of serious harm. Under Mental Hygiene Law 9.46, a treating mental health professional who determines that a person is likely to engage in conduct that would result in serious harm to self or others must report it to the county director of community services. The trigger is that clinical judgment, not any diagnosis, and only non-clinical identifying information is passed on to the state. Diagnosing or treating ADHD does not by itself trigger a report.
• Forms you sign. Some applications include broad record releases. Read them before signing. See does an ADHD diagnosis affect a professional license or security clearance.
• Court orders can require disclosure in some proceedings.

If you are in crisis, call or text 988.

Where to go from here

Privacy at work depends mostly on your own choice to disclose. The next article to read is the comparison of trade-offs in should you tell your employer about ADHD. For how an evaluation itself is conducted and recorded, see the adult ADHD evaluation page.