Part 2 qualified service organization

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Check the current Part 2 framework

The HHS summary of the 2024 Part 2 final rule describes changes involving consent, redisclosure, breach notification, patient rights, and complaints, with compliance required by February 16, 2026. The Federal Register final rule contains the agency's adopted text and explanation. A vendor inventory or QSO agreement created under an older workflow should be compared with the live eCFR and current operations. Record the review date, agreement version, service owner, privacy owner, and remediation due date rather than relying on the contract's original signature date.

Services can be operational or professional

42 CFR 2.11 gives examples such as data processing, billing, dosage preparation, laboratory work, legal, accounting, population health, medical staffing, and child-abuse prevention or treatment services. Actual functions and data flows control the analysis.

The written agreement has two core acknowledgments

Map the parties, services, records, permitted activity, safeguards, incident duties, subcontractors, access, return or destruction, and termination. Preserve the Part 2 acknowledgment and judicial-resistance term required by the definition.

QSO and business-associate roles can overlap

For a Part 2 program that is also a HIPAA covered entity, the QSO definition includes a person meeting the business-associate definition for PHI that also constitutes a Part 2 record. Execute and manage every agreement required for the actual roles.

Start with the service, not the vendor label

A company is not a qualified service organization merely because it signs a template called a QSO agreement. First identify the service it actually performs for the Part 2 program and the records it receives, stores, processes, or otherwise handles. The regulatory examples are broad, but the relationship still needs a service to or for the program plus the required written agreement.

Map each product and subcontracted function. A billing vendor might handle claims, support tickets, call recordings, exported reports, and backups through different systems. The QSO analysis, safeguards, access, and exit plan should cover the real flow rather than only the product named on an order form.

Review the written agreement and its implementation

The definition requires an acknowledgment that the service organization is fully bound by Part 2 when dealing with the program's patient records. It also requires an agreement to resist judicial efforts to obtain patient-identifying SUD information except as Part 2 permits, when resistance is necessary.

Operational terms should make those promises usable. Identify covered services and data, permitted activity, workforce access, subcontractors, security, incident notice, cooperation, legal-demand routing, amendment, return or destruction, and termination. Confirm that staff instructions and system configuration match the agreement. A complete clause cannot protect data that the vendor has not inventoried or that support staff can export without review.

Map overlapping legal roles

A QSO can also be a HIPAA business associate when the regulatory definitions and facts fit. Those roles arise from different authorities, so preserve every required agreement and apply the more protective obligation when rules overlap. Do not assume that a business associate agreement silently supplies the Part 2 acknowledgments, or that QSO status answers HIPAA, state privacy, security, licensing, or contract questions.

Reassess when the program adds a product feature, the vendor changes subprocessors, data is reused for analytics or model development, a new affiliate receives access, or the relationship ends. A material change can alter scope even when the contracting parties stay the same.

Prepare for requests, incidents, and termination

Give the vendor a named route for record requests, patient questions, security events, audit activity, and legal demands. At termination, inventory live systems, archives, backups, support tools, local downloads, and subcontractor copies. Record what was returned, destroyed, or retained, why retention continues, and which controls remain in force.

Example

Eight vendors handle Part 2 data. Six have supported service scope, QSO classification, current agreement, access, and exit controls; two use a generic vendor form. Readiness is 6 of 8 vendors.

QSO review checklist

• identify the Part 2 program, service, vendor entity, and every relevant data flow;
• confirm the required acknowledgment and judicial-resistance commitment;
• reconcile QSO, business-associate, security, and state-law obligations;
• approve subprocessors and downstream access before records are shared;
• test incident and legal-demand escalation with accountable owners; and
• verify return, destruction, retained copies, and continuing protections at exit.

The QSO definition does not approve every vendor use or make a generic contract sufficient. Actual functions, records, agreements, and controls decide the result. This page is operational guidance, not legal advice; Part 2 privacy and experienced counsel review remain required.