Part 2 paper-record transfer and removal

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.16(a)(1)(i)(A) requires formal policies and procedures addressing the transfer and removal of paper records containing patient-identifying information. The broader paragraph requires reasonable protection from unauthorized uses, disclosures, and anticipated threats or hazards. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended framework.

Movement needs an authorized purpose

The current paper-record rule expressly includes transferring and removing records. Record file or container, patient or cohort, sender, custodian, approver, purpose, origin, destination, carrier, method, time out, receipt, return, and exception.

Protect every handoff

Use sealed and appropriately labeled containers, verified destinations, controlled pickup, chain of custody, locked transport, receipt confirmation, no unattended vehicles, approved home-work rules, scanning controls, and secure temporary storage.

Include routine and unusual routes

Cover interoffice mail, courier, court production, payer review, records vendor, archive, disaster relocation, home visit, community service, remote work, merger, closure, return, and destruction. Verify contracts and state law separately.

Define every transfer and removal event

Inventory movement between work areas, facilities, records rooms, clinics, courts, storage vendors, scanning vendors, billing operations, home or remote work, mobile services, transport, and destruction. Include originals, printouts, copies, labels, cover sheets, faxes, photographs, handwritten notes, sign-in sheets, and temporary working files.

For each route, record allowed purpose, requester, approver, custodian, origin, destination, record set, patient count, container, carrier, tracking, departure, expected arrival, receipt, return, retention, and exception. Separate internal handoff from removal beyond a controlled area.

Apply authorization and minimum scope before movement

Verify the underlying Part 2 authority and business need, select only necessary records, check pages and patient identity, remove unrelated material, use a nonrevealing inventory, and obtain approval. Avoid public labels or package descriptions that identify SUD treatment.

Use sealed tamper-evident or otherwise appropriate containers, controlled keys, badges or locks, trusted couriers, direct handoff, tracking, and signed receipt based on risk. Do not leave records unattended in vehicles, reception areas, shared printers, luggage, or unsecured home spaces.

Govern remote, emergency, and vendor handling

Define whether paper may leave a site, approved locations, transport method, household separation, visitors, copying, photography, storage, return deadline, and destruction. Provide a secure alternative when staff cannot meet those conditions.

Vendor contracts and procedures should address workforce access, route, storage, subcontractors, incident notice, return, destruction, evidence, and audit. Emergency movement should use a documented exception with the same inventory and follow-up as soon as practicable.

Reconcile and respond to loss

At receipt or return, compare package, seal, inventory, page and patient count, time, custodian, and condition. Escalate late, incomplete, damaged, misdelivered, or opened packages immediately rather than waiting for routine reconciliation.

Preserve tracking, video, access, witness, inventory, and communication evidence. Search proportionately, contain further movement, notify privacy and security, assess breach obligations, communicate as directed, correct the route, and test remediation.

Control printing and scanning as transfer points

Require staff to select the correct patient, device, destination, pages, and recipient before release. Use secure-print pickup where available, place devices away from public traffic, clear queues, retrieve jams, inspect output trays, and destroy misprints securely. Configure saved destinations and address books to reduce misrouting without assuming they remain accurate.

For scanning, verify page count, orientation, patient indexing, image quality, destination, permissions, and successful upload before disposing of or returning paper. Reconcile skipped, duplicated, misfiled, or mixed-patient pages. Control temporary scan folders, device storage, email delivery, and vendor maintenance.

Staff can ask whether removal is necessary, who approved it, which minimum pages may travel, how custody is tracked, where records may be stored, when they return, and what to do after a delay or loss. Put those answers on the transfer procedure and training aid.

Example

Fourteen paper transfers are sampled. Eleven have purpose, approval, item list, custodian, destination, secure method, receipt, and closure evidence; three have no documented handoff. Readiness is 11 of 14 transfers.

Paper-transfer checklist

• inventory every internal, external, remote, mobile, vendor, and destruction route;
• verify authority, purpose, minimum records, approval, and accountable custodian;
• use secure containers, neutral labeling, controlled transport, tracking, and receipt;
• define remote, emergency, courier, scanning, and storage-vendor conditions;
• reconcile record and page counts promptly and escalate discrepancies; and
• preserve evidence, assess loss, remediate controls, and verify correction.

Transfer control covers the complete journey, including staging, handoff, transit, receipt, use, return, and disposition.