Part 2 discontinued-program record disposition

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.19(a) generally requires a discontinued, taken-over, or acquired Part 2 program to remove patient-identifying information or render it non-retrievable. Destruction and associated-media sanitization must follow section 2.16. The rule recognizes consented transfer, legally required retention, and specified ISDEAA circumstances. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended framework.

Trigger the plan early

Current 42 CFR 2.19 covers discontinuation, takeover, and acquisition. Inventory entities, programs, records, systems, paper, devices, backups, email, vendors, retention duties, holds, active care, patient rights, contracts, and the closing or acquiring parties.

Classify every record path

For each record set, identify authorized transfer by compliant patient consent, legally required retention, a qualifying ISDEAA transfer, de-identification, or destruction. Preserve the authority, responsible person, dates, copies, media, safeguards, completion evidence, and unresolved exceptions.

Coordinate security and continuity

Disposition must remain consistent with § 2.16 security policies. Maintain access, encryption, custody, communication, patient access, clinical continuity, billing, complaints, audits, incident response, vendor termination, and final sanitization during the transition.

Trigger closure governance before systems and staff disappear

Name an executive owner, Part 2 privacy lead, records manager, security lead, clinical continuity owner, counsel, finance and payer owner, information-technology lead, facilities lead, vendor owner, acquiring-party contact, and responsible person for retained records. Set decision, patient communication, transfer, hold, destruction, access, and closure dates.

Inventory legal entities, programs, locations, active and former patients, paper, electronic systems, portals, messages, email, call recordings, devices, removable media, printers, scanners, backups, archives, logs, vendors, subcontractors, research, billing, claims, legal holds, and off-site storage. Prevent new untracked copies during the transition.

Assign every record set to a permitted path

For each system or batch, document one or more supported paths: transfer based on patient consent meeting section 2.31, retention required by law, specified ISDEAA transfer, removal of patient-identifying information, or destruction and sanitization. Record authority, scope, owner, destination, retention end, hold, method, evidence, and unresolved exception.

Do not treat acquisition of business assets, a database license, employment of staff, payer continuity, or clinical need as automatic permission to transfer Part 2 records. Analyze patient consent and every applicable exception.

Implement the legally required retention procedure

When law requires continued retention, preserve the exact authority and end date. For paper, use sealed, properly labeled containers, sanitize associated hard-copy media, and place records with a responsible person under Part 2 restrictions. Plan destruction and sanitization as soon as practicable after the required period ends.

For electronic records, follow section 2.19's encrypted portable-device or separate original-and-backup-media route. Apply the specified access controls, sealed container, reader equipment, responsible-person custody, separate decryption tools, climate protection, and final sanitization. The rule also sets a one-year deadline for sanitizing prior media, including email and other electronic communications, after the specified transfer.

Protect continuity and patient choice

Give patients accurate, accessible information about closure, care options, record choices, consent, access, contact routes, deadlines, and complaints without exposing SUD status through outreach. Maintain urgent clinical response, medication continuity, referral support, and legally required access while the program can still act.

Track failed mail, portal loss, changed contact, incapacity, minors, representatives, deceased patients, unsafe contact preferences, language and disability support, and disputed authority. Avoid coercing transfer to the acquiring program.

Control vendors, assets, and final evidence

Freeze unnecessary exports and restrict administrative access. Amend or terminate vendors only after return, transfer, retention, destruction, and incident duties are resolved. Revoke accounts, keys, tokens, integrations, remote support, and physical access after their last approved task.

For each record set, preserve disposition authority, inventory, consent or retention evidence, custody, encryption, transfer receipt, destruction or sanitization proof, access closure, exceptions, incidents, and verifier. Run a final orphan-data search across cloud, email, devices, backups, vendors, facilities, and acquired systems.

Example

Seventeen record systems enter a closure inventory. Fourteen have authority, path, owner, retention or consent evidence, media treatment, completion test, and closure record; three vendor archives lack a deletion plan. Readiness is 14 of 17 systems.

Discontinued-program checklist

• activate closure owners, dates, holds, continuity, communications, and risk control;
• inventory every program, patient, record, system, paper, device, vendor, and copy;
• assign consent transfer, required retention, ISDEAA, de-identification, or destruction;
• follow section 2.19's special paper and electronic retention procedures exactly;
• protect patient choice, access, urgent care, privacy, and safe outreach; and
• reconcile vendors, media, credentials, receipts, certificates, orphan data, and closure evidence.

Program closure is a records lifecycle event, not permission to transfer everything to a buyer or leave inaccessible archives behind.