Part 2 accounting compliance-date tolling

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.25 contains the accounting framework, but the HHS Part 2 fact sheet, updated January 30, 2026, states that its compliance date will be set when the corresponding HIPAA accounting right is revised. The general February 16, 2026 Part 2 compliance date therefore should not be applied to section 2.25 as though its special trigger had already occurred.

Use a dated status source

The regulatory text is visible in 42 CFR 2.25. HHS's fact sheet, updated January 30, 2026, supplies the operative timing caveat. Record both sources and a recheck owner because the future HIPAA rule could change content, timing, and implementation work.

Separate readiness from compliance

Readiness can include event logging, route classification, recipient normalization, legacy retention, request intake, export design, review, correction, secure delivery, and testing. Mark these as preparatory controls rather than evidence that the tolled duty is active.

Define a change trigger

Monitor HHS and the Federal Register for a final HIPAA accounting revision and its effective and compliance dates. When triggered, compare the final requirements with the data model, notices, policies, contracts, training, metrics, and release test.

Maintain a dated legal-status record

Preserve the live regulation, HHS timing statement, source-check date, reviewer, monitoring owner, open rulemaking, and next review date. Record the conclusion in notices, policies, project plans, tickets, system requirements, training, and leadership reporting so different teams do not activate conflicting assumptions.

Use precise status terms such as codified, special compliance date not yet set, readiness in progress, and existing other-law duty. Avoid vague labels such as postponed forever or already effective.

Keep nearby duties operating

The tolling statement concerns the section 2.25 Part 2 accounting. Existing 45 CFR 164.528 duties, section 2.24 intermediary lists, patient access, state accounting rights, contract requirements, and incident or audit logs may still apply. Intake must classify requests rather than closing them based on the section 2.25 status alone.

Restrictions under section 2.26 are also a separate current patient-right framework. Do not extend the accounting caveat to unrelated Part 2 provisions.

Build reversible readiness controls

Inventory disclosure sources, define consent and TPO EHR populations, preserve three-year history, normalize recipients, map content fields, establish request intake, create reviewed exports, secure delivery, and test corrections. Mark the resulting workflow as preparatory and prevent it from generating inaccurate notices or deadlines.

Use feature flags, versioned specifications, controlled templates, and documented assumptions so the future rule can be incorporated without destroying earlier evidence. Keep vendors aware of retention and export needs without representing a tolled specification as a present contractual law.

Monitor the trigger from primary sources

Assign regulatory owners to HHS and Federal Register updates concerning the corresponding HIPAA accounting right. Track proposal, comment, final rule, publication, effective date, compliance date, transition provisions, scope, and litigation or agency updates. A proposal or announcement is not the final activation event.

When a final trigger appears, counsel and privacy should compare it with section 2.25 and current system assumptions. Confirm entities, disclosure population, lookback, EHR scope, content, exclusions, suspension, timing, fees, documentation, notices, and enforcement before activation.

Test communications and governance

Review web content, notices, scripts, sales materials, policies, and patient responses for accurate status. Correct claims that the accounting is presently due or unavailable in every context. Preserve the prior version and affected-audience analysis.

Report readiness measures separately from compliance conclusions. Leadership should see source coverage, data quality, unresolved dependencies, rule status, decision owner, and next review date.

Run a trigger tabletop with privacy, records, product, security, legal, and communications owners. Test how a final rule would be authenticated, compared, approved, implemented, communicated, and validated without interrupting existing request handling.

Example

Nine readiness controls are tracked. Seven have an owner, source, status, test, dependency, and future-rule recheck; two are labeled legally required today. Accurate status is 7 of 9 controls.

Tolling-governance checklist

• preserve section 2.25, the dated HHS statement, reviewer, owner, and next check;
• distinguish codified text, unset special date, preparation, and current other-law duties;
• keep HIPAA, intermediary-list, access, restriction, state, and contract routes active;
• build versioned, reversible logging, export, intake, delivery, and correction controls;
• monitor the primary rulemaking sequence through final compliance instructions; and
• audit notices, policies, patient responses, and metrics for accurate status language.

Tolling changes when the obligation must be performed, not whether preparation matters. It also does not suspend unrelated patient rights.