Part 2 has changed. The operating details matter.

The federal milestone.

HHS states that compliance with its 2024 final rule updating 42 CFR Part 2 was required by February 16, 2026. Its Office for Civil Rights began accepting Part 2 complaints on that date. HHS: Understanding Part 2.

HHS also provides model Part 2 patient notices and updated HIPAA notices of privacy practices to support the applicable notice requirements. The requirements and appropriate notice depend on the entity and records involved. HHS: Model notices of privacy practices.

HQ’s reading: follow the information through the work.

A center can update a document while leaving an older process in place. Our operating question is whether the notices, staff instructions, access arrangements, and actual handoffs agree. That is a practical implementation question to work through with the center’s designated privacy and legal advisers.

Start with a map of the relevant workflow. Identify where information enters, which systems receive it, who can act on it, and where it moves next. Include exports, shared queues, automated messages, and manual workarounds. These are places to investigate, not a statement that any particular use is permitted or prohibited.

Questions worth resolving with the responsible team.

• Which systems and workflows hold the records under review?
• Where are the approved notices and instructions presented, and who keeps them current?
• Does each integration match the use the center has approved?
• Who handles a request, an unexpected disclosure, or a system behaving differently from its design?
• How will staff learn the revised process, and how will a later change be reviewed?

Keep decisions and responsibility explicit. A vendor’s general statement about its product cannot establish that every proposed configuration or use is appropriate for a particular center.

Turn the approved decisions into a usable process.

Once the center’s responsible advisers have determined the requirements, implementation can focus on the specified changes: updating a workflow, configuring access, adjusting a form, documenting a handoff, or training the people who perform it. Test the actual sequence rather than checking only that a document exists.

This article is an operational perspective, not legal advice or a determination of a center’s compliance. HQ’s role in an engagement is defined by its agreed scope; policy and legal judgments remain with the center’s qualified advisers.