Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The short answer for a behavioral health CEO
Behavioral health operators mitigate breaches by pairing HIPAA Security Rule discipline (written risk analysis, access controls, audit logs, MFA) with 42 CFR Part 2 consent and redisclosure controls, and by rehearsing the 60-day breach notification clock at 45 CFR § 164.404 before an incident forces the issue. That is the whole game. Everything else is detail.
The numbers are not abstract. In its 2024 Report to Congress, OCR reported that it received 663 large-breach reports for breaches occurring in 2024, and hacking/IT incidents made up 81% of those large breaches. In the same cycle, OCR collected $7,813,831 in penalties tied to breach investigations, plus a further $950,000 from an investigation prompted by media reports of a breach. Across those 663 breaches, the PHI of 242,908,056 individuals was exposed, driven mostly by Change Healthcare.
If you run a substance use disorder or mental health facility in Florida, Texas, or Arizona, that reporting is your operating manual. Joint Commission surveyors will ask for the same artifacts. So will CARF. So will state licensing.
What the HIPAA Breach Notification Rule actually demands
The Breach Notification Rule lives at 45 CFR §§ 164.400–414, enforced by OCR. Three deadlines and one definition should be tattooed on every compliance officer’s forearm.
- Individuals. A covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach.
- HHS. Breaches affecting 500 or more individuals must be reported to the Secretary without unreasonable delay and no later than 60 days after discovery. Smaller breaches can be logged annually.
- Media. If a breach affects more than 500 residents of a state or jurisdiction, covered entities must also notify prominent media outlets serving that state.
The definition that ends careers is discovery. A covered entity is deemed to have knowledge of a breach the moment any workforce member or agent knew, or with reasonable diligence would have known. Translation for a treatment center CEO in Fort Lauderdale or Phoenix: the 60-day clock does not start when your general counsel gets the email. It starts when the intake tech sees the anomaly and shrugs.
42 CFR Part 2 became enforceable on February 16, 2026. Catch up now
SUD programs live under a second regime on top of HIPAA. On February 8, 2024, HHS, through SAMHSA and OCR, announced a final rule modifying the Confidentiality of Substance Use Disorder Patient Records regulations at 42 CFR Part 2, implementing section 3221 of the CARES Act. The rule took effect April 16, 2024, with a two-year runway. The compliance deadline was February 16, 2026, and OCR announced its Civil Enforcement Program for Confidentiality of Substance Use Disorder Patient Records on February 13, 2026, confirming it will accept complaints alleging Part 2 and breach notification violations starting that date.
What operators should have already changed:
- Patient Notice and single-consent workflows for treatment, payment, and health care operations.
- Breach handling. The HIPAA Breach Notification Rule now applies to breaches of Part 2 records; same clocks, same reporting, same media obligation.
- Complaint intake. Patients can now file directly with the Secretary and concurrently with the Part 2 program.
Penalties escalated with the alignment. Violations that used to top out at $500 for a first offense now sit inside the HIPAA tiered structure, with 2026 caps reaching approximately $2,134,831 per violation category per year for willful neglect not corrected within 30 days. If your compliance officer cannot produce an updated Notice, a compliant consent form, and a Part 2 breach playbook that mirrors your HIPAA one, you have unfinished work.
The Clearway lesson and the five OCR findings that keep surfacing
Behavioral health facilities do not get investigated by OCR because ransomware is exotic. They get penalized because the basics were skipped. In its 2024 Report to Congress, OCR identified risk analysis, risk management, information system activity review, audit controls, and person or entity authentication as the key Security Rule failure areas.
Study this one. OCR imposed a $1,190,000 civil money penalty against Gulf Coast Pain Consultants, LLC, doing business as Clearway Pain Solutions Institute, a Florida-based practice with 126 employees and locations in Alabama, Delaware, Maryland, New Jersey, and Pennsylvania. A business contractor engaged in May 2018 stopped services in August 2018, access was not cut off, and the former contractor later generated roughly 6,500 false Medicare claims, impacting the PHI of approximately 34,310 individuals. The first HIPAA-compliant risk analysis Gulf Coast produced was dated September 30, 2022.
Termination access, in other words, was the finding. Not a hacker in a hoodie. A former contractor who still had a login. OCR Director Melanie Fontes Rainer said it plainly in the announcement: “Current and former workforce can present threats to health care privacy and security,” and effective compliance means being proactive in reviewing who has access to health information and responding quickly to suspected security incidents.
Operator translation:
- Keep a current, written risk analysis. Refresh when you open a site, buy a program, or swap EMRs. Joint Commission and CARF surveyors will ask during your EOC tour.
- Remove terminated workforce access in minutes, not on the next business day. Keep the audit log that proves it.
- Turn on MFA for every remote path into ePHI. No exceptions for the medical director. OCR imposed a $548,265 civil money penalty against Children’s Hospital Colorado after determining the first reported breach occurred because multi-factor authentication was disabled on an email account.
- Review information system activity. If nobody looks at the logs, they do not exist for OCR purposes.
The operator playbook: what to build before the incident
Every behavioral health operator I work with wants a checklist. Fine. Here is one grounded in what OCR is actually citing.
- Written risk analysis, refreshed annually and after material changes. Risk analysis failures showed up in the majority of the 2024 CMPs.
- MFA on every remote and administrative account. OCR specifically cited incomplete risk analyses, excessive user privileges, and weak authentication, including default passwords and single-factor remote access, as the most consistently identified failures across breach investigations.
- Real-time termination workflow. HR, IT, and clinical leadership on one channel. Minutes, not hours.
- Business Associate Agreements with a shorter notification clock than 60 days. If your BA takes 59 days, you have one day. Contract for 72 hours.
- A Part 2 playbook that matches your HIPAA one. Consent, Patient Notice, redisclosure statement, complaint intake to SAMHSA and OCR.
- A tabletop drill. Put the CEO, COO, compliance, IT, clinical leadership, and outside counsel in one room. Find out where your 60-day clock actually starts.
- Documentation. Six years, minimum. If it is not written down, OCR does not credit it, and neither will a DOJ civil investigator working a parallel False Claims Act theory.
Operators who build this operational backbone before an incident spend less money, hold census, and preserve their Joint Commission or CARF accreditation. The ones who wait pay the $1.19M lesson.
Frequently asked questions
How fast must a behavioral health facility notify individuals after a HIPAA breach?
Under 45 CFR § 164.404, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Discovery begins the day any workforce member knew, or with reasonable diligence should have known, about the incident. Not the day it reached the C-suite.
When did the updated 42 CFR Part 2 rule become enforceable, and what changed for SUD providers?
SAMHSA and OCR issued the final rule on February 8, 2024. It took effect April 16, 2024, with a two-year runway, and OCR’s compliance deadline and Civil Enforcement Program went live on February 16, 2026. Key changes: a single patient consent for future TPO uses, alignment of Part 2 breach notification with the HIPAA Breach Notification Rule, and a new right to file complaints directly with the HHS Secretary.
What HIPAA Security Rule failures does OCR cite most often in enforcement?
In its 2024 Report to Congress, OCR named risk analysis, risk management, information system activity review, audit controls, and person or entity authentication as the priority failure areas. The $1,190,000 civil money penalty against Gulf Coast Pain Consultants (Clearway Pain Solutions) in December 2024, driven largely by failure to terminate a former contractor’s access to ePHI of approximately 34,310 individuals, is the case study every multi-site operator should read.
Do small behavioral health breaches (under 500 individuals) still have to be reported?
Yes. Under 45 CFR § 164.408, breaches affecting fewer than 500 individuals must be logged and reported to the HHS Secretary no later than 60 days after the end of the calendar year in which the breach was discovered. In 2024, OCR received 74,299 reports of breaches affecting fewer than 500 individuals, so the small-breach track is not a place to hide from OCR or state licensing authorities.
References
- HHS OCR, 2024 Annual Report to Congress on Breaches of Unsecured Protected Health Information
- HHS OCR, Gulf Coast Pain Consultants (Clearway) Notice of Proposed Determination. $1,190,000 CMP
- HHS OCR, Children’s Hospital Colorado Notice of Final Determination. $548,265 CMP
- HHS, Fact Sheet: 42 CFR Part 2 Final Rule (February 8, 2024)
- HHS, Understanding Confidentiality of Substance Use Disorder (SUD) Patient Records / Part 2
- eCFR, 45 CFR Part 164, Subpart D. Notification in the Case of Breach of Unsecured PHI
- HIPAA Journal, February 16, 2026 Compliance Deadline for Part 2 Final Rule; OCR Civil Enforcement Program announced February 13, 2026
- HIPAA Journal, OCR Reports to Congress on HIPAA Compliance and Data Breaches in 2024