Treatment staff are prohibited by HIPAA and 42 CFR Part 2 to disclose clients’ confidences to criminal justice professionals