Two rulebooks, and the second one changed.
A recovery program carries HIPAA and 42 CFR Part 2, usually with the privacy officer role held by someone who also runs billing or clinical operations. That person is usually doing it well. What the arrangement cannot do is keep two rule sets current when one of them was rewritten in 2024.
Most posted notices are still written to the old rule.
I assessed the public websites of a random sample of SUD treatment programs against the elements the 2024 rule requires in a patient notice. In the first 50, 60% posted either no clinical notice at all or one written before the 2024 rule (95% interval, 46% to 72%).
Among the notices that do exist, the elements the 2024 rule added are the ones most often missing: the single consent for treatment, payment and health care operations, the protections against use in legal proceedings, and the redisclosure statement. This is a gap in how the rule change reached the field, not a judgment on anyone running a program.
The method and the interim results are published: Study 01, Part 2 patient notices. The full sample of 100 is collected, and its results follow the validation step.
Four triggers, one underlying job.
One person who owns both rule sets.
The fractional compliance officer retainer runs the program month over month: policies current, the risk register live, BAAs and training tracked, and the Part 2 notice, consent forms and policies kept to the current rule. From $2,500/mo, which is under a third of what the function costs as a hire.
If you do not have a current risk analysis, month one is that analysis, billed at the assessment price. Every month after is the monthly price. That is the analysis 45 CFR 164.308(a)(1)(ii)(A) requires, and I do it on site, because 45 CFR 164.310 is about the building. If your analysis is current, month one usually goes to Part 2: your notice, consent forms and policies read against the 2024 rule.
This is the segment where most of my delivered work sits. If all you need is the Part 2 read of your documents, the Alignment Review is sold on its own.
Questions recovery programs actually ask.
If your program is federally assisted and holds itself out as providing substance use disorder diagnosis, treatment or referral for treatment, it almost certainly does. Most SUD treatment programs are. A general practice that treats SUD among other things may not be. We settle it on the call against your own facts, before anything else.
Partly. The 2024 rule brought much of Part 2 closer to HIPAA, which is why the two are best run by one person. The notice, the consent forms and the rules about records in legal proceedings still differ, and those are the parts most often left on the old rule.
It covers the technical side of the system it runs. The notice you post, the consent forms you use, your policies and your risk analysis are yours, and no vendor can make them current for you.
The compliance officer function starts at $2,500/mo. If you do not have a current risk analysis, month one is that analysis, billed at the assessment price. Every month after is the monthly price. If you only want the Part 2 read of your documents, the Alignment Review is $750 on its own.
Thirty minutes, and you'll know where you stand.
Tell me what triggered this: the rule change, a notice you are not sure about, a review coming due. I'll tell you honestly what you need and what it costs. If the answer is that you don't need me yet, you'll get that instead.