Part 2 retained-record decryption-key separation

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.19(b)(2)(iv) requires the responsible person to appear on the archive access-control list and receive a means to decrypt the data. That person must store decryption tools on a device or at a location separate from the encrypted records. NIST SP 800-88 Rev. 2 discusses sanitization and cryptographic erase but does not replace the Part 2 custody rule. The HHS fact sheet identifies February 16, 2026 as the compliance date.

Separation needs defined failure boundaries

Current 42 CFR 2.19(b)(2)(iv) separates decryption tools from the data they protect. Record data location, key location, custodian, authorized people, authentication factors, recovery materials, dependencies, prohibited co-storage, and emergency access.

Access should survive the retention period

Plan staff departure, death or incapacity, organization closure, lost credentials, hardware failure, expired certificates, vendor shutdown, password rotation, disaster, and legal succession. Test authorized recovery without exposing the key or weakening separation.

Use current technical governance

NIST SP 800-88 Rev. 2 addresses sanitization programs and cryptographic erase. For the Part 2 archive, qualified security professionals should define key generation, custody, backup, rotation, revocation, compromise response, retirement, and validation.

Inventory every component of decryption capability

Record encrypted media, algorithm and mode where relevant, key identifier, key version, key store, hardware token, password or secret, certificate, recovery material, authentication factors, software, account, device, network or vendor dependency, responsible person, successor, and locations. Avoid placing sensitive key values in the inventory itself.

Map which component is necessary to assign meaning to the retained data and which failure could make it unreadable. Include expired certificates, account dormancy, subscription termination, hardware obsolescence, and organization closure.

Design and verify real separation

Store tools on a different device or at a different location from the encrypted archive as the rule requires. Define prohibited co-storage, physical and logical boundaries, access groups, transport, emergency retrieval, and return. A password note inside the sealed container or key file on the encrypted device defeats the intended separation.

Use strong authentication, individually attributable access, minimum administrators, logging, dual control or split knowledge where appropriate, and secure recovery. Protect backup keys and recovery materials from the same loss, disaster, or compromise as the primary tool.

Govern responsible-person and successor access

Place the responsible person on the current access-control list and document authorization, scope, start, end, authentication, training, acceptance, and review. Limit access to lawful archive purposes. Record every key or tool retrieval, use, test, copy, change, return, and exception.

Prepare for departure, death, incapacity, conflict, loss of role, contract end, merger, site closure, and emergency. Name a controlled successor process that verifies authority before granting access and removes the former person's credentials.

Test recovery without weakening protection

At a risk-based interval, retrieve the separate tool through the approved process, decrypt a controlled sample using preserved equipment and instructions, verify integrity and readability, remove any clear-text test copy, return the tool, and review logs. Record result, failure, remediation, and next date.

Do not rotate, migrate, revoke, or destroy a key until all affected archive copies and dependencies are known. After any change, retest both retained data and backup.

Respond to compromise and close the archive

After suspected key exposure, preserve evidence, restrict access, assess which records and copies are affected, involve privacy and security, evaluate breach duties, re-encrypt or migrate when appropriate, update recovery, and verify containment. Avoid deleting the only working key during response.

At the retention end, recheck authority and holds, authorize data sanitization, retire key material and recovery copies using qualified methods, revoke accounts, reconcile tokens and devices, preserve evidence, and close the access-control record.

Example

Twelve key-custody configurations are tested. Nine have separate storage, current custodian, approved access, recovery, logging, compromise route, succession, and successful test; three rely on one departing administrator. Readiness is 9 of 12 configurations.

Decryption-separation checklist

• inventory encrypted data, key identifiers, tools, factors, dependencies, and owners;
• store tools on a separate device or at a separate location from the records;
• authorize and log responsible-person, administrator, emergency, and successor access;
• protect recovery from common loss, disaster, compromise, and obsolescence;
• test controlled decryption, integrity, cleanup, return, and audit evidence; and
• respond to compromise and retire data, keys, accounts, tokens, and copies together.

Separation should prevent one loss or unauthorized access from exposing both ciphertext and the means to read it while preserving lawful recovery throughout retention.