Behavioral Health Records: 42 CFR Part 2 and the HIPAA Security Rule

Behavioral health providers that treat substance use disorders often operate under two sets of federal rules at once: the HIPAA Privacy, Security, and Breach Notification Rules, and the confidentiality rules for substance use disorder patient records at 42 CFR Part 2. The two have moved much closer together, and as of February 16, 2026, the updated Part 2 rules are fully in effect.

This post focuses on the security side: what Part 2 requires for protecting records, how it lines up with the HIPAA Security Rule, and how a behavioral health organization can run one security program that satisfies both. It is not legal advice on consent, disclosure, or whether your program is covered by Part 2. Your counsel should confirm that.

What changed in Part 2

In February 2024, HHS finalized a rule implementing section 3221 of the CARES Act, which required aligning parts of Part 2 with HIPAA. According to the HHS fact sheet, persons subject to the regulation had to comply by February 16, 2026. HHS's Office for Civil Rights now enforces Part 2, accepts complaints, and receives breach notifications for Part 2 records, with penalties aligned to HIPAA.

For security and IT leaders, the most relevant change is in the security section of the rule.

What 42 CFR 2.16 requires

The security provision, 42 CFR 2.16, requires a Part 2 program or other lawful holder of patient identifying information to have formal policies and procedures to reasonably protect against unauthorized uses and disclosures, and against reasonably anticipated threats or hazards to the security of that information.

Those policies must address:

• Paper records: transferring and removing them, destroying them so information is non-retrievable, storing them securely in a locked room, cabinet, or similar, controlling access to workstations and storage areas, and de-identification.
• Electronic records: creating, receiving, maintaining, and transmitting them, destroying them including sanitizing media, using and accessing them, and de-identification.

The section also applies HIPAA's breach notification provisions, at 45 CFR Part 160 and Subpart D of Part 164, to breaches of unsecured Part 2 records in the same manner they apply to covered entities and protected health information.

How it lines up with the HIPAA Security Rule

If your organization is also a HIPAA covered entity, much of what 2.16 asks for is already required by the HIPAA Security Rule for electronic records:

• Risk analysis and risk management under 164.308(a)(1) address reasonably anticipated threats.
• Access controls under 164.312(a) and information access management under 164.308(a)(4) address who can use and access records.
• Transmission security under 164.312(e) addresses records sent electronically.
• Device and media controls under 164.310(d) address disposal and media reuse.
• Workstation use and security under 164.310(b) and (c) address the workstation side.

The main areas where 2.16 adds weight are paper records, which the HIPAA Security Rule does not cover because it applies only to electronic PHI, and the explicit requirement for documented procedures covering both formats.

Running one program for both

The practical approach is a single security program built on the HIPAA Security Rule, extended to cover what Part 2 adds:

1. Identify where Part 2 records live. That includes the EHR, but also scanned intake documents, billing systems, email, shared drives, and paper charts. Part 2 records are often mixed with other records, which affects how you protect and disclose them.
2. Include Part 2 records in your risk analysis. Treat them as a distinct category with heightened sensitivity. Our post on what an accurate and thorough risk analysis means for a small practice covers the process.
3. Write procedures for paper. Locked storage, controlled access, sign-out for removal, and destruction methods that make information non-retrievable, with records of destruction.
4. Tighten access. Role-based access in the EHR, unique logins, MFA, and regular access reviews. Know who can see SUD treatment records and why.
5. Plan for breach notification. Update your incident response plan so a breach of Part 2 records follows the HIPAA breach notification process, as 2.16(b) now requires.
6. Cover your vendors. EHR vendors, billing services, and IT providers with access to Part 2 records need appropriate agreements. Our post on what a BAA covers and what it does not covers the HIPAA side. Have counsel confirm what Part 2 adds for your arrangements.
7. Train staff on the difference. Staff need to recognize Part 2 records and understand that they carry additional disclosure restrictions.

Telehealth and remote work

Many behavioral health organizations deliver care remotely and have clinicians working from home. That extends the security boundary to home networks, personal spaces, and sometimes personal devices. Make sure remote access uses MFA, devices are managed and encrypted, sessions use platforms covered by appropriate agreements, and paper notes do not end up in home offices without secure storage.

A note on the proposed HIPAA changes

HHS proposed a significant overhaul of the HIPAA Security Rule in January 2025. It remains a proposal, with final action projected on the federal regulatory agenda for July 2027. The current Security Rule and the current Part 2 rule are what apply today.

How we help

TRNSFRM works with behavioral health and healthcare organizations across Cleveland and Columbus on risk analysis, access controls, and documentation, and we sign BAAs with our healthcare clients. See our behavioral health page, healthcare page, and HIPAA overview. Take the free compliance checklist, or book your free risk review.