Part 2 Breach Notification and the Complaint Process

Before 2024, Part 2 had security rules but no breach notification duty of its own. The 2024 final rule (89 FR 12472) changed that by pulling in HIPAA's breach notification framework, and it added a formal complaint process with a ban on retaliation. Both applied in full from the compliance date, February 16, 2026. Programs that were already HIPAA covered entities will recognize the mechanics; programs that were not now have them for the first time. What follows is policy readiness, not legal advice.

Which security policies does Part 2 require?

A Part 2 program, or other lawful holder of patient identifying information, must have "formal policies and procedures to reasonably protect against unauthorized uses and disclosures" and against reasonably anticipated threats to the information's security (42 CFR 2.16(a)). The policies must address:

• Paper records: transferring and removing them; destroying them, including sanitizing hard copy so the information is not retrievable; keeping them "in a secure room, locked file cabinet, safe, or other similar container" when not in use; controlling access to workstations and storage; and de-identification.
• Electronic records: creating, receiving, maintaining and transmitting them; destroying them and sanitizing media; controlling access; and de-identification.

These policies are the first thing a breach investigation, a complaint review or a surveyor will ask for.

When is an incident a breach?

Part 2 adopts HIPAA's definitions. A breach is "the acquisition, access, use, or disclosure" of protected information in a way not permitted that compromises its security or privacy (45 CFR 164.402, applied by 42 CFR 2.11). Three narrow exceptions apply, such as a good-faith, unintentional access by a workforce member acting within authority that goes no further.

Otherwise an impermissible use or disclosure is presumed to be a breach unless the program demonstrates a low probability that the information was compromised, based on a risk assessment of at least four factors: the nature and extent of the information, including identifiers and the likelihood of re-identification; who received or used it; whether it was actually acquired or viewed; and how far the risk has been mitigated (45 CFR 164.402). Notification applies to unsecured records, meaning records not rendered unusable, unreadable or indecipherable to unauthorized persons through methods HHS has specified (42 CFR 2.11). Encryption that meets that guidance is the main way to keep a lost device from becoming a reportable breach.

Whom must a program notify, and when?

Under 42 CFR 2.16(b), HIPAA's breach notification provisions apply to Part 2 programs "in the same manner" as to covered entities. That means:

1. Each affected patient, without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404(b)). A breach counts as discovered on the first day it is known, or would have been known with reasonable diligence, to anyone in the workforce or any agent other than the person who committed it (164.404(a)(2)).
2. Prominent media outlets serving a state or jurisdiction, if the breach involves more than 500 of its residents, on the same 60-day outer limit (164.406).
3. HHS. For 500 or more individuals, at the same time as the patient notices; for fewer than 500, logged and reported no later than 60 days after the end of the calendar year (164.408).

The patient notice must, to the extent possible, describe what happened with the dates of breach and discovery, the types of information involved, steps patients should take, what the program is doing in response, and contact procedures including a toll-free number, email, website or postal address, in plain language (164.404(c)). Your Patient Notice must also tell patients the program is required to notify them after a breach of unsecured records (42 CFR 2.22(b)(1)(v)(A)).

How should a breach response procedure work?

• A named privacy or security lead and a way for any staff member to report a suspected incident the same day.
• A risk assessment template covering the four factors, with the conclusion documented either way.
• Notice templates for patients, media and HHS, ready to adapt.
• A breach log for incidents under 500 individuals, and a calendar reminder for the annual HHS report.
• Contract terms requiring qualified service organizations and business associates to report incidents to you promptly.
• Training, so that staff recognize a misdirected fax, a lost phone or a lobby conversation as something to report.

What must the complaint process include?

Section 2.4 is short and absolute:

• A Part 2 program "must provide a process to receive complaints" about its compliance with Part 2 (2.4(a)).
• Anyone may also complain to HHS, in the same manner as a HIPAA complaint (2.4(b)).
• The program may not intimidate, threaten, coerce, discriminate against or otherwise retaliate against a patient for exercising a Part 2 right or filing a complaint (2.4(c)).
• The program may not require a patient to waive the right to complain as a condition of treatment, payment, enrollment or eligibility (2.4(d)).

In practice, that means a written procedure naming who receives complaints and how, a log, a response timeline, a link from the Patient Notice, and a check that nothing in your intake paperwork asks patients to give up the right. The Patient Notice must describe how to complain to the program and to HHS and state that there will be no retaliation (2.22(b)(1)(vi)). Accreditors and many state rules have their own grievance requirements, so build one process that meets all of them; see writing a policy manual to the state rule and the accreditor.

What are the penalties now?

Violations are subject to the civil and criminal penalties in sections 1176 and 1177 of the Social Security Act (42 CFR 2.3(a)), the same provisions that govern HIPAA, and HHS applies the HIPAA enforcement rule's procedures to Part 2 noncompliance (2.3(c)). Being a HIPAA covered entity does not satisfy Part 2 by itself; the rules overlap but Part 2 keeps its own consent, notice and disclosure requirements. See the 2024 Part 2 rule.

How do we help?

Our Part 2 Policy Alignment is $395: security policies written to 2.16, a breach response procedure with risk assessment and notice templates, a breach log, and a complaint procedure written to 2.4, alongside the consent forms and Patient Notice in Part 2 consent and the Patient Notice. These are templates and readiness work, not legal advice; when an actual incident happens, call counsel. We never receive, hold or review patient records, so our work never becomes part of your breach exposure.