Part 2 discontinued-program legal-retention exception

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.19(a)(2) and (b) provide a special path when law requires discontinued-program records to be kept for a period extending beyond discontinuation or acquisition. The program must preserve the legal authority and end date and follow detailed paper or electronic custody, security, labeling, and final-destruction procedures consistent with section 2.16. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended framework.

Document the retention authority

Current 42 CFR 2.19 requires a legal retention period specified by law. Record the statute, regulation, court order, or other authority; covered record types; start and end dates; jurisdiction; conflicts; holds; responsible reviewer; and source version.

Use the rule's form-specific procedure

Paper records require sealed, labeled containers and responsible-person custody. Electronic records require one of the prescribed encrypted archive options, source-media sanitization, a sealed and labeled container, protected storage, separate decryption tools, and final sanitization.

Preserve access and accountability

Apply the discontinued or acquiring program's § 2.16 policies. Define permitted access, patient requests, audits, litigation, incident response, record retrieval, return, copying, logging, successor duties, vendor roles, and continuity during retention.

Prove the legal requirement and precise period

Record jurisdiction, statute, regulation, court order, grant or other legal authority, record class, patient population, date range, event that starts the period, duration, suspension or tolling rule, end date, and qualified reviewer. Distinguish a binding retention requirement from an organizational preference, vendor default, payer request, historical schedule, or belief that records may be useful.

Resolve overlapping requirements and choose a documented disposition date that satisfies each applicable authority. Add litigation, investigation, audit, complaint, research, tax, payer, clinical, and other holds separately. A hold can delay disposition without replacing the permanent retention schedule.

Inventory records and copies before closure

Map paper, scans, clinical and billing systems, portals, messages, email, files, databases, logs, backups, devices, removable media, printers, faxes, vendors, subcontractors, off-site storage, and acquired systems. Identify authoritative copy, duplicates, associated media, owner, access, security, and planned path.

Freeze uncontrolled export and deletion while the inventory is reconciled. Record records that will transfer by patient consent, qualify for another exception, be retained under law, be de-identified, or be destroyed. Do not use retention of one record class to justify keeping the entire environment.

Apply the required format-specific procedure

For paper, use sealed and prescribed labels identifying the former program, legal authority, and a date no later than the required retention end. Sanitize hard-copy media associated with the printouts. Place the records under Part 2 restrictions with a responsible person who will destroy and sanitize them as soon as practicable after the period ends.

For electronic records, choose the encrypted portable-device option or original-plus-backup separate-media option described in paragraph (b)(2). Implement encryption at rest and access controls for the confidential process or key, seal records with reader equipment, assign a responsible person, separate decryption tools, protect the storage environment, sanitize former media within the rule's one-year period, and plan final sanitization.

Preserve access without reopening ordinary operations

Define who may retrieve records, for which legal purpose, through which request and approval, using which equipment and key, with what log and return procedure. Maintain patient access, court, regulator, payer, complaint, and other lawful response paths during the retention period without turning the archive into an active shared system.

Test readability and decryption at planned intervals without making unnecessary copies. Keep contact, succession, equipment, key, vendor, and location information current. Investigate failed media, lost containers, unauthorized access, environmental damage, or unreadable records promptly.

Execute the end date

Schedule notices to the responsible person and successor before the end date. Recheck extensions and holds, approve disposition, inventory media and paper, select an appropriate section 2.16 method, witness or verify as required, preserve certificates, and reconcile every copy.

If authority changes, document the new source and date. Avoid automatic extensions that leave records indefinitely retained because no active owner remains.

Example

Thirteen retained-record groups are reviewed. Ten have governing authority, precise expiry, media-specific procedure, responsible person, access, inventory, monitoring, and final-action date; three rely on an undated policy. Readiness is 10 of 13 groups.

Legal-retention checklist

• preserve binding authority, record scope, period trigger, end date, and reviewer;
• separate retention rules from holds, preferences, vendor defaults, and consented transfers;
• inventory paper, electronic systems, communications, media, backups, and vendors;
• follow the exact paper or electronic archive procedure in section 2.19(b);
• maintain restricted retrieval, readability, keys, equipment, succession, and incident response; and
• recheck authority and holds, then sanitize and destroy promptly after the period.

The exception preserves only records that law requires to be kept and only for the supported period. It is not a general reason to retain a discontinued program's full environment.