Compliance
42 CFR Part 2 and offshore medical billing: what a substance use disorder program must know about its billing vendor
42 CFR Part 2 protects substance use disorder treatment records more tightly than HIPAA, and its definition of a record names billing information. A billing vendor that works for a Part 2 program under a written agreement acknowledging that it is fully bound by Part 2 is a qualified service organization, and the program may share what the vendor needs without patient consent. Part 2 has no text on where records are kept or accessed. Since the 2024 final rule, HIPAA’s penalties apply to Part 2 violations, and the compliance date of February 16, 2026 has passed. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
Who is covered
Part 2 programs, and why billing data is in scope
A Part 2 program is a federally assisted program that holds itself out as providing substance use disorder diagnosis, treatment or referral. A unit or staff within a general medical facility can be a program if it is identified as one. The regulation defines “records” as information created, received or acquired by a Part 2 program relating to a patient, and its own examples include billing information, emails, voice mails and texts (42 CFR 2.11). A claims file for a Part 2 program is therefore a Part 2 record, and not only the clinical chart. Whether a given file is one is a question of fact for the program.
The vendor
The qualified service organization route
| Point | What the text says | Source |
|---|---|---|
| Point: Who is a qualified service organization | What the text says: A person that provides services to a Part 2 program, such as data processing or bill collecting, under a written agreement. The list of services is illustrative. | Source: 42 CFR 2.11 |
| Point: What the written agreement must say | What the text says: That in receiving, storing, processing or otherwise dealing with patient records from the program it is fully bound by Part 2, and that if necessary it will resist in judicial proceedings any effort to obtain access to the information except as Part 2 allows. | Source: 42 CFR 2.11 |
| Point: What the program may share | What the text says: Part 2's restrictions do not apply to communications between the program and a qualified service organization of information the organization needs to provide services to or on behalf of the program. | Source: 42 CFR 2.12(c)(4) |
| Point: Business associates | What the text says: Since 2024 the definition expressly includes a person that is a HIPAA business associate of a Part 2 program that is also a covered entity, for information that is both protected health information and a Part 2 record. | Source: 42 CFR 2.11 |
HHS said in the 2024 preamble that a qualified service organization agreement is distinct from a HIPAA business associate agreement, and that a vendor that is both has to meet both sets of terms (89 FR 12472). The business associate contract terms are on the business associate agreement page. The regulation lists two acknowledgments for the written agreement; anything beyond them, such as safeguards, audit rights or a location clause, is a choice of the parties.
Consent
The other route: one consent for treatment, payment and operations
Since the 2024 rule a patient can give a single consent for all future uses and disclosures for treatment, payment and health care operations, and the recipient may be described generically. The sample wording in the regulation includes “people helping to operate this program,” and HHS said that phrase is meant to reach non-program staff who are qualified service organizations. A covered entity or business associate that receives records under such a consent may redisclose them as HIPAA permits, except in proceedings against the patient (42 CFR 2.31 and 2.33). Counseling notes need their own separate consent, and a billing vendor is not within the listed exceptions.
Penalties and dates
HIPAA penalties apply, and the compliance date has passed
- Violations carry the civil and criminal penalties of the Social Security Act sections 1176 and 1177, the HIPAA Enforcement Rule applies in the same way as to covered entities and business associates, and a person may complain to the Secretary about a violation by a Part 2 program, a business associate, a qualified service organization or another lawful holder (42 CFR 2.3 and 2.4). The penalty amounts are those described on the breach liability page.
- HIPAA breach notification applies to breaches of unsecured Part 2 records, and the regulation text names programs. HHS said in the preamble that it has no authority to apply the notification duty to qualified service organizations directly and expects programs to contract for it.
- The final rule was effective on April 16, 2024 and required compliance by February 16, 2026. HHS says OCR began accepting Part 2 complaints and breach reports on that date, and no delay or rescission was found as of October 10, 2026 (HHS Part 2 page).
Offshore
What Part 2 says about location, and what it leaves open
No provision of Part 2, and nothing found in the 2024 preamble, addresses where records may be kept or accessed, including outside the United States. State law is not displaced by Part 2: no State law may authorize or compel a use or disclosure that Part 2 prohibits, and Part 2 does not authorize what State law forbids (42 CFR 2.20), so the State rules on the offshore medical billing restrictions page still apply. The sources read do not say how OCR would enforce Part 2 against a vendor with no presence in the United States, whether a vendor’s subcontractors are covered, or whether one document can serve as both agreements.
In practice
Questions for a program choosing a billing vendor
- Will you sign a qualified service organization agreement that acknowledges you are fully bound by Part 2?
- Which of your staff and subcontractors will see substance use disorder records, and where do they work?
- How do you keep counseling notes out of the billing file?
- How do you notify us of a breach of unsecured records, and by when?
The wider list is in offshore medical billing vendor questions, and the HIPAA position is in HIPAA compliant offshore medical billing. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- Business associate agreement for offshore billing
The terms HIPAA requires in the contract, what the practice must do about problems, and what to add for offshore work.
- HIPAA compliant offshore medical billing
The Business Associate Agreement, the safeguards, and the payer and state rules that can rule offshore work out.
- Vendor questions before you sign
Questions on contract, access, location, payer rules, pay and exit, each tied to the rule or source behind it.
- Offshore restrictions by state and payer
State storage laws, payer consent clauses and Medicaid rules that can restrict offshore billing, and how to check which ones bind you.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.