.svg){kind=logo}
Privacy Red Flags for a Sober Companion for Celebrities
Key Takeaways
- Access creep happens quietly as staff, drivers, and family absorb details no one authorized; counter it with role-based minimum-necessary access, aliases, and a written, revocable recipient list 3, 9.
- Personal phones and consumer messaging apps around a public figure invite exposure; require unique logins, multifactor authentication, encryption, password-protected clinical platforms, and a written retention and deletion schedule 6, 12.
- Verbal promises to handle a leak discreetly are not a plan; demand a written incident-response document naming first-hour contacts, a documented risk assessment, and a template notification letter 5, 11.
- Selfies, follows, and friend-of-the-family drift signal boundary failure; the agency should have a written social-media policy and consistent procedures that limit information flow and preferential treatment 8, 9.
- Résumé reviews and reference calls are thin screening for anyone with direct access; expect fingerprint-based state and national criminal-history checks, registry searches, documented suitability decisions, and equivalent vetting of every subcontractor 13, 4.
Why a Signed NDA Is Not the Privacy Plan
If you are vetting a sober companion for a public figure you love, you are probably exhausted, and you are probably being handed nondisclosure agreements as proof of safety. A signed NDA is a starting point. It is not a privacy plan.
What actually leaks around a high-profile principal is rarely the contract. It is the group chat an assistant forgot to mute, the household staffer who mentions a recovery associate to a friend, the lost phone with a week of unencrypted messages, the vendor who was never told the alias on the calendar invite. Confidentiality rules exist because stigma and fear of prosecution have long kept people from reaching for help in the first place 10. For someone whose face is public, those stakes multiply.
A privacy-mature engagement treats information the way a thoughtful general counsel would: with defined consent, minimum-necessary access, documented device hygiene, a written incident-response plan, and screened personnel 3, 4, 5. A peer-reviewed 2002 clinical article on celebrity care, whose principles are worth pairing with current digital-security guidance, went further and named information management, not clinical skill, as the central nonclinical issue, recommending aliases and tightly limited recipients of any health information 9.
The rest of this guide walks you through the specific red flags, in the order they tend to appear. You do not need to become a compliance officer. You do need language sharp enough to ask the next question.
What Actually Protects a High-Profile Client's Information
The Legal Frameworks That May (or May Not) Apply
Before you can spot a red flag, you need to know which rules are actually in play. This is where a lot of vetting conversations go sideways: a company gestures at HIPAA, you nod, and no one defines what that means for the person who will be sitting on your loved one's couch at 2 a.m.
Two federal frameworks matter most. HIPAA governs protected health information held by covered entities, such as hospitals, clinicians, health plans, and their business associates, and sets out administrative, physical, and technical safeguards for electronic records 4. 42 CFR Part 2 adds a stricter layer of confidentiality for records tied to substance-use-disorder diagnosis, treatment, or referral when they come from a federally assisted Part 2 program or when a non-program receives those protected records 1. A standalone recovery associate agency often sits outside both definitions. That does not mean the rules are irrelevant. It means the agency's contract has to carry the weight those rules would otherwise impose.
The 2024 Part 2 Final Rule tightened and modernized this landscape. It took effect on April 16, 2024, with required compliance by February 16, 2026, and it permits a single patient consent covering future uses and disclosures for treatment, payment, and health-care operations; applies HIPAA-style breach-notification rules to Part 2 records; and gives patients the right to an accounting of disclosures and to request restrictions 2. Ask any companion organization whether, and how, it is preparing for that compliance window, especially if it exchanges information with a Part 2 treatment program during your loved one's engagement.
If a service cannot clearly tell you whether HIPAA or Part 2 applies to its own work and name the specific contractual commitments that fill the gap when they do not, that uncertainty is itself the first red flag.
Consent, Redisclosure, and the Paper Trail You Should See
Consent is where discretion is either built or lost. You want to see it written down, specific, and revocable, not folded into a boilerplate intake form.
Ask who the recovery associate is authorized to speak with, in what detail, and for what purpose. A thoughtful service will offer tiered consents: one for clinicians involved in your loved one's care, a separate one for family members by name, and a narrower one for business or legal advisors who only need logistics, not clinical content. Under the 2024 Part 2 Final Rule, a single patient consent can cover future disclosures for treatment, payment, and health-care operations, which simplifies care coordination but makes the scope of that consent even more important to read carefully 2. If the paperwork hands blanket permission to anyone who asks, that is not convenience; that is exposure.
Redisclosure is the second place to look. When information leaves the companion and lands with a therapist, a nutritionist, a case manager, or a family office, what stops the next recipient from forwarding it? For Part 2 records, redisclosure is restricted unless specifically permitted 1. For everything else, the contract has to do the work: written redisclosure limits, a prohibition on casual verbal updates, and documentation of every outbound share.
You should also expect an accounting of disclosures on request and a clear process to revoke or narrow consent as circumstances change 2. The paper trail should feel almost boring in its precision. If a company resists putting any of this in writing, you have your answer.
Red Flag 1: Access Creep Around the Principal
Walk through the house of a public figure in recovery and count the people who can see something. The chef sees the grocery list. The driver sees the therapist's address on the calendar. The assistant sees the pharmacy delivery. The nanny sees the recovery associate on the kitchen stool at 6 a.m. By Thursday, more people know what is happening than anyone signed off on.
This is access creep, and it is the quietest red flag on the list because nothing feels wrong until it does. HIPAA's minimum-necessary standard asks organizations to limit use, disclosure, and requests for health information to what is reasonably necessary for the stated purpose 3. A privacy-mature recovery associate agency applies that same principle to a household: define each role, decide what each role actually needs to know, and gate the rest.
A 2002 peer-reviewed article on celebrity care is blunt about this and, while its digital-security specifics should be read alongside current guidance, its core principles still hold up. Information management, not clinical skill, is the central nonclinical issue, and the recommended practice is a closely guarded alias plus a tightly limited group of nonmedical recipients for any clinical information 9. In practice, that means the chef knows there is a dietary plan, not why. The driver knows the pickup window, not the address labeled 'therapy.' The assistant books the calendar under the alias and does not see the clinical notes. Family members receive updates by name on a tiered consent, not by default.
Ask the agency to walk you through its information map before anyone signs. Who learns the real name? Who learns only the alias? Who hears clinical content, and who hears logistics only? If the answer is a shrug or a reassurance that everyone on the team is discreet, you have found access creep already baked in. Discretion is not an access policy. A named recipient list, written down and revocable, is.
Red Flag 2: Device, Message, and Platform Hygiene
The second place leaks happen is in your loved one's pocket, and in the pocket of every person around them. Phones, laptops, smartwatches, group chats, shared calendars, cloud backups, the voice assistant on the kitchen counter. The recovery associate is in all of it, whether anyone planned for that or not.
Ask the agency what it actually does with devices. A privacy-mature answer will sound specific: unique logins for each staff member, multifactor authentication, strong encryption on anything that touches your loved one's information, and a password-protected platform for any video or voice sessions with clinicians 6, 12. If the recovery associate is texting updates from a personal phone over iMessage or WhatsApp, that is not a communication plan. That is a search warrant waiting to happen.
HHS guidance for remote care goes further and asks organizations to confirm who is present on every call, use unique user identification, protect devices with passwords, delete mobile files on a schedule, keep backups, and submit to independent security evaluation 7. Translate that into your household: Is the assistant silently added to the therapy video link? Is the recovery associate's phone wiped between engagements? Is there a written retention schedule, so messages about your loved one are not sitting in a cloud backup three years from now?
Group chats deserve their own flag. Family group threads, assistant threads, security threads, publicist threads. Every added participant is another endpoint. Ask the agency for a written communication map: which channel carries clinical content, which carries logistics only, who is on each thread, and what gets said out loud in a car or kitchen where a voice assistant may be listening. SAMHSA's current behavioral-health guidance treats encryption, multifactor authentication, and collection of only necessary data as table-stakes expectations, not premium add-ons 11.
If the service cannot describe its device and messaging rules in plain language, assume there are none. You are not being paranoid. You are being precise.
Red Flag 3: No Written Incident-Response Plan
Things will go sideways. A phone will be left in an Uber. A text meant for the clinician will land in the family group thread. A new household staffer will overhear a call and tell their roommate. The question is not whether a privacy event will happen during a long engagement with a public figure. The question is whether anyone has written down what happens next.
SAMHSA's current behavioral-health guidance names incident-response planning alongside encryption and multifactor authentication as baseline expectations for a mature organization, not a specialty service 11. If the agency's answer is some version of "we would deal with it quickly and discreetly," that is discretion as marketing, not as process. You want names, timelines, and a template notification letter you could read today. Silence after a leak is how a one-phone incident becomes a tabloid cycle.
Red Flag 4: Fuzzy Professional Boundaries and Social-Media Behavior
The recovery associate who takes a selfie in your loved one's kitchen, even without posting it, is already a problem. The one who follows your principal's publicist on Instagram the week they start the engagement is a bigger one. Boundaries in celebrity care are not a vibe. They are a set of written rules the agency should be able to recite.
Ask what the agency's social-media policy actually says. AMA ethics guidance is directed to physicians rather than nonclinical companions, but it offers a useful professional benchmark: separate personal and professional accounts, maintain appropriate online boundaries, protect identifiable information in every environment, and refuse to speculate publicly about any person's condition 8. Translating that benchmark into practical rules for a nonclinical companion, we suggest that the recovery associate not follow, like, comment on, or screenshot anything connected to your loved one or their inner circle. No photos inside the residence. No check-ins at the hotel. No cryptic posts about a "long week with a tough client."
Boundaries extend offline too. Celebrity environments pull staff toward preferential treatment, blurred friendships, favors for the inner circle, and gradual loss of objectivity, which is why the 2002 clinical article on celebrity care treats consistent procedures and limited information flow as central safeguards 9. A privacy-mature agency rotates thoughtfully, debriefs its associates, and names a supervisor you can call. If the person on the couch starts acting like a friend of the family, the engagement has already drifted.
Red Flag 5: Thin Personnel Screening for Direct-Access Staff
The person who will sit in your loved one's kitchen at midnight, ride in the back of the SUV to the clinician, and know which bedroom door is closed when, deserves more vetting than a reference call and a résumé scan. Ask the agency what its screening actually looks like, and compare the answer against a real benchmark.
CMS's background-check framework for direct-patient-access workers is a useful yardstick, even if a private recovery associate agency is not legally bound by it. The program calls for written disclosures and authorization from the candidate, fingerprint-based state and national criminal-history checks, searches of applicable registries, documented suitability decisions, and a procedure for the candidate to challenge inaccurate results 13. A privacy-mature agency will describe its own process in roughly that shape: identity verification, fingerprinting rather than name-only database scans, registry searches, and a written suitability standard the person on the couch actually had to meet.
Push on the edges. Who screens the subcontractors, the relief associate who covers a weekend, the driver the agency subcontracts for sober transport, the overnight coverage pulled from a partner roster? HIPAA's Security Rule treats business associates and their subcontractors as part of the privacy perimeter, requiring written assurances that each will apply equivalent safeguards and report incidents 4. Translate that into your engagement: every person with direct access should have passed the same screening, signed the same confidentiality terms, and be nameable on request.
If the agency cannot tell you who screened the person walking through your front door, assume no one did.
Baseline NDA Contract vs. Privacy-Mature Engagement
If you want one page to hand your attorney or family office before signing, this is the one. The question is not whether a recovery associate agency has a confidentiality clause. The question is what sits in the contract next to it.
| Control | Baseline NDA contract | Privacy-mature engagement |
|---|---|---|
| Consent structure | Blanket confidentiality clause; informal verbal updates to whoever asks | Tiered, written consents by named recipient and purpose, revocable in writing, with an accounting of disclosures on request 2 |
| Access to information | Whole team and household can see schedules, locations, and clinical content | Minimum-necessary access by role, alias on calendars and vendor-facing records, named recipient list for anything clinical 3, 9 |
| Device and communication hygiene | Personal phones, consumer messaging apps, no retention or deletion rules | Unique logins, multifactor authentication, strong encryption, password-protected video platforms, written deletion and retention schedule 6, 12 |
| Incident response | Verbal promise to "handle it discreetly" | Written plan with named roles, first-hour contacts, documented risk assessment, and a template notification letter, consistent with the breach-presumption standard 5 |
| Personnel screening | Résumé review and reference calls | Identity verification, fingerprint-based state and national criminal-history checks, registry searches, documented suitability decisions, and a dispute procedure 13 |
| Subcontractor obligations | Not addressed; relief staff and transport drivers brought in ad hoc | Written assurances that every subcontractor with access applies equivalent safeguards, signs equivalent confidentiality terms, and reports incidents on the same timeline 4 |
Read the two columns side by side, then ask the agency which column its current contract actually matches. If the honest answer is the left column with a promise to behave like the right one, ask for the right column in writing before anyone walks through your loved one's front door.
Questions to Ask on the Vetting Call
You will probably have thirty minutes on the phone. Spend them on the questions that actually predict a leak, not on résumé theater. Here is what to ask, and what a good answer sounds like.
On consent and paperwork. "Walk me through the consent forms. Who is the recovery associate authorized to speak with, in what detail, and how do we narrow or revoke that in writing?" A privacy-mature agency will describe tiered, named consents and an accounting of disclosures on request 2.
On access. "Who in our household and professional circle will learn the real name, and who will only see the alias? Can you send me the written recipient list before we sign?" The answer should sound like minimum-necessary access, not blanket discretion 3, 9.
On devices and messaging. "What platform will clinical content move on, what deletion schedule do you follow, and what happens if a staff phone is lost?" Expect unique logins, multifactor authentication, encryption, and a password-protected video platform 6, 12.
On incident response. "Can you send me your written incident-response plan, and tell me who gets called in the first hour?" If there is no document, that is the answer 5.
On personnel. "What screening did the person coming to our home actually complete, and does every subcontractor pass the same bar?" Listen for fingerprint-based state and national checks and equivalent subcontractor obligations 13, 4.
If any answer is vague, ask once more. The second answer is usually the real one.
If You're the Principal Reading This Privately
If you are the person in recovery, reading this on a locked phone late at night, a quick word just to you. You are allowed to ask these questions directly. You do not need to route them through a manager, a parent, or an attorney to be taken seriously.
Ask who will know your real name and who will only see your alias. Ask what the recovery associate is permitted to say to your family, and what you can narrow in writing today 2, 9. Ask where messages about you live, who else is on the thread, and when they get deleted 6. Ask what happens, in writing, if something leaks 5.
Discretion that works for you is specific, revocable, and yours to adjust. If an agency cannot meet you there, keep looking. Your recovery is allowed to be quiet.
Starting a Confidential Conversation
Vetting a recovery associate for someone whose face is public is tiring work, and you are doing it well by asking these questions at all. The red flags above are not a test anyone passes perfectly. They are the vocabulary that lets you tell the difference between a service built on discretion and a service built on hoping nothing goes wrong.
At Next Level Wellness & Behavioral Health, our approach, shaped by founder Amanda Marino, is to put consent, access, and incident response in writing before a wellness associate ever walks through your loved one's door. We work with families and principals privately from Boca Raton, nationally and internationally, before, during, after, or in place of treatment.
When you are ready, call us for a confidential conversation. No pressure, no paperwork on the first call. Just a quiet discussion about what you need, what you want protected, and what Creating Lasting Change could look like for the person you love.
Frequently Asked Questions
Is a sober companion for a celebrity covered by HIPAA or 42 CFR Part 2?
Often, no. HIPAA covers health plans, clinicians, hospitals, and their business associates, while 42 CFR Part 2 covers federally assisted substance-use-disorder programs and anyone who receives those protected records 1, 4. A standalone recovery associate agency may sit outside both. Ask the service to tell you in writing which rules apply and what contract language it uses to carry the same obligations when they do not 2.
What privacy protections should the contract include beyond a nondisclosure agreement?
Look for tiered, written consents by named recipient and purpose, revocable at any time, with an accounting of disclosures on request 2. Require minimum-necessary access by role, written device and messaging rules, a documented incident-response plan, fingerprint-based personnel screening, and equivalent safeguards for every subcontractor who touches your loved one's information 3, 4, 5, 13. A confidentiality clause alone leaves most of the real risk unaddressed.
How should a recovery associate handle phones, messaging apps, and group chats around the principal?
Expect unique logins, multifactor authentication, strong encryption, and a password-protected platform for any video or voice sessions with clinicians 6, 12. Updates should move on a defined channel, not a personal iMessage thread. The agency should confirm who is on every call, keep a written retention and deletion schedule, and keep clinical content off any group chat that includes assistants, drivers, or publicists 7, 11.
What background screening should the companion and any subcontractors complete?
A credible benchmark is the one CMS uses for direct-patient-access workers: written disclosure and authorization from the candidate, fingerprint-based state and national criminal-history checks, applicable registry searches, a documented suitability decision, and a procedure to dispute inaccurate results 13. Every subcontractor with access, including relief associates and transport drivers, should pass the same bar and sign equivalent confidentiality terms under written assurances to the agency 4.
What should happen if a leak, lost device, or unauthorized conversation occurs?
HHS treats any impermissible use or disclosure of unsecured protected health information as a presumed breach unless a documented risk assessment shows a low probability of compromise, considering what was disclosed, who received it, whether it was viewed, and how it was contained 5. A mature agency will name who gets called in the first hour, who runs the assessment, how the device or thread is contained, and how you are notified in writing 11.
Can household staff, assistants, or family members be told what the companion is doing?
Only on a need-to-know basis your loved one has consented to in writing. HIPAA's minimum-necessary principle limits use and disclosure to what is reasonably required for the stated purpose, and clinical guidance on celebrity care recommends an alias plus a tightly limited group of nonmedical recipients for any clinical information 3, 9. As a practical matter, we recommend naming family members on a tiered consent and limiting staff and vendors to logistics rather than clinical content.
References
- Understanding Confidentiality of Substance Use Disorder (SUD) Patient Records or “Part 2”. https://www.hhs.gov/hipaa/part-2/index.html
- Fact Sheet 42 CFR Part 2 Final Rule. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
- Minimum Necessary. https://www.hhs.gov/hipaa/for-professionals/faq/minimum-necessary/index.html
- Summary of the HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
- Breach Notification. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
- Getting started | Telehealth.HHS.gov. https://telehealth.hhs.gov/providers/best-practice-guides/privacy-and-security-telehealth/getting-started
- Telehealth Privacy Tips for Providers. https://telehealth.hhs.gov/documents/Telehealth+Privacy+Tips+for+Providers.pdf
- 121 2017 Annual Meeting Ethical and Judicial Affairs Opinion. https://www.ama-assn.org/sites/ama-assn.org/files/corp/media-browser/public/hod/a17-ceja-reports.pdf
- Celebrity Patients, VIPs, and Potentates. https://pmc.ncbi.nlm.nih.gov/articles/PMC315491/
- FREQUENTLY ASKED QUESTIONS - SAMHSA. https://www.samhsa.gov/sites/default/files/faqs-applying-confidentiality-regulations-to-hie.pdf
- 2025 National Guidelines for a Behavioral Health Coordinated System of Care. https://library.samhsa.gov/sites/default/files/national-guidelines-crisis-care-pep24-01-037.pdf
- Cybersecurity Performance Goals. https://hhscyber.hhs.gov/Documents/cybersecurity-performance-goals.pdf
- Welcome to the CMS Background Check Pilot Program web page. https://www.cms.gov/medicare/provider-enrollment-and-certification/surveycertificationgeninfo/downloads/bc_generalinfo.pdf
Insight Beyond Treatment
At Next Level Wellness & Behavioral Health, we believe meaningful change starts with perspective, not just protocols.
That philosophy is directly led by Amanda Marino, whose voice in behavioral health extends beyond clinical settings into leadership, culture, and personal growth.
Through keynote speaking and live events, Amanda explores the deeper themes that show up in recovery, family systems, and life transitions: authenticity, resilience, accountability, and the courage to change. Her work invites audiences to move past labels and into honest conversations that create lasting impact.
A Voice Shaping the Conversation
The topics explored here—change, self-awareness, recovery, and growth—are the same themes Amanda Marino brings to audiences nationwide through speaking engagements and live events.
Known for her appearances on A&E’s Intervention and Digital Addiction, Amanda speaks to organizations, communities, and leadership teams about navigating adversity, embracing vulnerability, and building lives rooted in purpose. Her message resonates far beyond treatment, offering insight that applies to families, professionals, and anyone standing at a crossroads.
Heal on your terms—any time, anywhere.