42 CFR Part 2 & HIPAA Readiness Checklist

Since February 16, 2026, OCR enforces 42 CFR Part 2 against substance-use-disorder programs directly — with HIPAA-level penalties. The first thing they request in any complaint or audit is your written risk analysis. Score yourself honestly against what they'll ask to see.

How to use this: check a box only if you could produce the document or demonstrate the control today — not "we're working on it." What you can't produce is exactly what an auditor's letter will ask for first. Your unchecked boxes are your remediation roadmap.

Risk analysis on file: ✗ Part 2 rule items: 0/6 Total: 0/30

Section 1

The documents OCR asks for first

In an investigation, these are requested at the door. What you can't produce is itself the finding.

A current written Security Risk Analysis — completed within the last 12 months and mapped to the HIPAA Security Rule (not a generic checklist)The single most-cited OCR deficiency, and the first document requested in any investigation.
A risk management plan showing the risks you found are being remediatedAs of 2026, OCR wants proof you acted on the analysis, not just that you did one.
Written security and privacy policies & procedures
Breach notification procedures and an incident log
A Business Associate Agreement on file with every vendor touching PHI (EHR, billing/RCM, IT/MSP, e-fax, labs, shredding, answering service)
A named Security Official and Privacy Official
Workforce security-training records with dates and attendance
A contingency/backup plan with a tested restore — with a date

Section 2

Access & accountability

Knowing exactly who accessed which SUD record is the heart of Part 2.

Every staff member logs in under their own account — no shared or generic loginsShared logins destroy the audit trail and individual accountability.
MFA enforced on email and the EHR (or SSO federated to an MFA-protected identity provider)
Workstations auto-lock; staff don't stay logged in at unattended stations
Role-based, least-privilege access — billing staff can't see clinical notes
Terminated staff lose access the same day, via a documented offboarding process
Someone reviews EHR and email access logs on a set schedule

Section 3

Network & endpoints

The cloud EHR doesn't cover the network around it — you're liable for that.

Clinical/EHR systems are segmented from guest and patient Wi-Fi — not one flat networkA patient's phone on the room Wi-Fi should never be able to reach a clinical system.
Cameras, IoT, and physical-security systems are isolated from clinical systems
Full-disk encryption on every laptop and device
Managed endpoint protection (EDR), centrally monitoredAntivirus alone isn't EDR — an EDR has a central console someone actually watches. If you're not sure, that's a finding.
No PHI sent by unencrypted email or text message
A real firewall/gateway enforcing the segmentation — not just a modem and a switch

Section 4

Part 2 rule — enforced since Feb 16, 2026

The 2024 Final Rule items. Consent-form and notice wording are legal work — flag them to a healthcare attorney.

Notice of Privacy Practices updated with the required Part 2 language attorney
A single consent for treatment, payment & operations (TPO) adopted and content-compliant with §2.31 attorney
The EHR's consent / release-of-information module configured for the new consent model — not paper or manual
Outbound SUD records carry the redisclosure-prohibition notice (§2.32)
Breach procedures explicitly cover Part 2 records
Staff trained on the new consent and redisclosure workflows

Section 5

Physical safeguards

The findings anyone can see by walking your hallway.

Server and network gear in a locked room
Workstation and monitoring screens not visible to patients or the public (placement / privacy filters)
Paper PHI in locked storage; shredding with a certificate of destruction
Doors to clinical and records areas have enforced access control

Why "we're too small" no longer holds

OCR now takes complaints against Part 2 programs directly — a single unhappy patient or former employee is the trigger, not your size. And the agency rarely fines a facility for being breached; it fines them because the investigation shows there was no current risk analysis, no access logging, and no proof of remediation. The documentation is the defense. Build it before the letter arrives — you can't backdate it after.

No current risk analysis — this is the one document OCR requests first. Start here; nothing else substitutes for it.

Risk analysis in place, but Part 2 or access gaps remain — you have real, citable exposure. Prioritize shared logins, MFA, segmentation, and the 2026 consent items.

All sections checked, with evidence you can produce — you're in strong, defensible shape. Keep the analysis and training current (annually).

Not sure how you'd really score — or how to close the gaps?

I do a fixed-fee 42 CFR Part 2 & HIPAA readiness assessment for behavioral-health and SUD facilities — your policies, your EHR configuration, your network, and your physical safeguards — and hand you an audit-ready risk analysis and a prioritized fix-it plan your team can actually execute.

Book a 15-minute call: [email protected] · part2ready.com

Reflects the HIPAA Security Rule (45 CFR §164.308–312), 42 CFR Part 2 and its 2024 Final Rule (compliance date February 16, 2026), and the OCR Audit Protocol. Enforcement dates and rule status current as of publication — verify before relying.

Part2Ready is a practice of Trent Cyber Advisory, a technical security and compliance advisory practice. This checklist is an educational self-assessment, not legal advice; consent-form and notice language and final compliance determinations are the responsibility of the facility and its counsel. © 2026 Trent Cyber Advisory.