Part 2 discontinued paper-record custodian

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.19(b)(1)(ii) requires legally retained discontinued-program paper records to be held under Part 2 restrictions by a responsible person. As soon as practicable after the labeled retention period ends, that person must destroy the records and sanitize associated hard-copy media under section 2.16 procedures. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended framework.

Appointment needs durable authority

The paper-retention procedure assigns custody to a responsible person. Record identity, organization, contact, acceptance, authority, term, successor, compensation, conflicts, storage site, keys, records inventory, and reporting route.

Custody includes controlled access

Define permitted retrievals, identity and authority checks, patient access, legal requests, copying, sign-out, resealing, visitor control, environmental inspection, incident response, moves, vendor access, audit logs, and periodic inventory reconciliation.

Prepare for succession and final action

A custodian can leave, become unavailable, or lose access. Maintain succession, emergency entry, current contact, documented handoff, and the destruction date. Final destruction must follow § 2.16 security procedures and retained evidence.

Appoint a person who can perform the whole role

Document identity, organization, authority, acceptance, qualifications, conflict review, contact, location, start, end, successor, backup contact, and resources. The person must be able to protect the records, evaluate lawful requests, maintain access evidence, monitor the retention end, coordinate incidents, and complete destruction.

Avoid assigning a departed employee, dissolved entity, generic department, storage vendor without accountable oversight, or person who lacks access to the records, authority, equipment, or destruction budget. Use counsel to resolve fiduciary, contractual, licensing, or estate questions.

Transfer custody with reconciled evidence

Give the responsible person the sealed containers, protected inventory, legal authority, retention schedule, holds, access procedure, incident contacts, storage requirements, destruction instructions, vendor documents, and prior custody log. Reconcile container and seal identifiers, counts, condition, location, and receipt.

Keep the detailed crosswalk and patient information restricted. The warehouse or general facility should need only the minimum code, placement, environmental, and contact information.

Maintain Part 2 restrictions during retention

Use secure rooms, cabinets, safes, or storage facilities; controlled keys and badges; visitor and vendor rules; retrieval approval; checkout and resealing; and incident response. Protect against fire, water, pests, theft, unauthorized viewing, improper copying, and mistaken disposal.

Review access, storage condition, seal status, inventory, holds, authority, contact, and remaining period at a defined interval. Record every request, decision, opening, copy, return, correction, and disclosure authority. Do not confirm patient status to an unverified requester.

Plan succession and continuity

Name a successor process for death, incapacity, resignation, contract end, organizational closure, relocation, disaster, or loss of credentials. Test that the successor can locate the records, understand the authority and dates, access the site, identify holds, and arrange secure destruction.

Maintain current privacy, security, legal, clinical, regulator, and vendor contacts. Avoid a single key, person, or undocumented relationship that can make the archive inaccessible.

Complete final disposition

Use advance reminders before each retention end. Reconfirm authority, extensions, and holds; approve the batch; choose an appropriate destruction and sanitization method; control custody; reconcile all containers and media; and preserve witness, vendor, result, and certificate evidence.

Document why any record remains after the labeled date and set a new supported date. “No one requested it” is not a closure process.

Keep a custodian decision log

Record each access request, verified requester, claimed authority, record scope, decision, approver, opening, copy, disclosure, return, resealing, and follow-up. Add storage inspections, environmental events, seal discrepancies, contact changes, successor actions, legal updates, and destruction reminders. Protect the log because it can itself reveal record existence.

At every review, ask whether the custodian can still locate and access the records, the authority and end date remain current, every hold is visible, the storage is sound, the successor is ready, and destruction resources are funded. Escalate a missing answer while the former program's records can still be protected.

Example

Twelve custodial assignments are assessed. Nine have appointment, inventory, secure site, access procedure, backup person, monitoring, incident route, retention end, and final action; three lack succession. Readiness is 9 of 12 assignments.

Paper-custodian checklist

• appoint and document an accountable, capable responsible person and successor;
• transfer sealed records, inventory, authority, dates, holds, contacts, and instructions;
• secure location, keys, visitors, retrieval, opening, copying, return, and resealing;
• review condition, access, seal, authority, holds, contacts, and end date;
• plan for custodian, organization, location, disaster, and contract changes; and
• authorize, reconcile, destroy, sanitize, certify, and close each expired batch.

Custody is an active responsibility lasting through final destruction. Physical possession without authority, monitoring, and an executable end-date plan is incomplete.