Behavioral health practices hold some of the most sensitive records in healthcare: psychotherapy notes, substance use disorder (SUD) records and telehealth sessions. Cytek helps therapists, counseling groups, psychiatric practices and treatment programs meet HIPAA and 42 CFR Part 2, and keeps patient data away from attackers.
01
A breach in behavioral health does more damage than almost anywhere else in healthcare. Patients share things they may not tell their own families, and attackers know that information is valuable for extortion.
02
HHS finalized a rule in February 2024 that aligns Part 2 more closely with HIPAA. The compliance date was February 16, 2026, and the HHS Office for Civil Rights (OCR) now enforces Part 2 alongside HIPAA.
If your consent forms, notices and breach procedures predate the rule, they likely need updating.
03
After a breach, OCR's first question is almost always whether you had an accurate and thorough risk analysis. In a 2026 settlement, a substance use treatment center paid $103,000 after a phishing email exposed the records of about 1,980 patients, and OCR found it had never completed a risk analysis.
A documented risk analysis, a remediation plan and trained staff are the difference between a bad day and a federal investigation.
HOW WE HELP
HIPAA risk assessment
The documented security risk analysis HIPAA requires, covering your EHR, telehealth tools and devices.
Learn more →Part 2 and HIPAA policies
Consent forms, notices and procedures updated for psychotherapy notes and the 2024 Part 2 rule.
Learn more →Staff training
HIPAA and phishing awareness training that fits a clinical schedule, with records for audits.
Learn more →Encrypted email
Send records and treatment information to patients and providers securely.
Learn more →Penetration testing
Find the gaps in your network, Wi-Fi and patient portal before attackers do.
Learn more →FAQ
Yes, if you are a covered entity. Most practices that bill insurance electronically are covered entities and must follow the HIPAA Privacy, Security and Breach Notification Rules.
Yes. Psychotherapy notes kept separate from the rest of the record get extra protection under HIPAA, and most disclosures require a specific patient authorization.
Part 2 generally applies to federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment or referral. If you are unsure, an assessment of your services and funding sources is the first step.
Yes. Any vendor that creates, receives, stores or transmits PHI for you, including telehealth, EHR and email providers, needs a signed business associate agreement.
At least once a year, and whenever you add a location, change systems or have a security incident.
Sources: HHS OCR Part 2 compliance (Reed Smith) · Part 2 final rule summary (Troutman Pepper) · HHS OCR settlement announcement. This page is general information, not legal advice.
Start with the free HIPAA risk assessment, or talk to an analyst about Part 2 and your practice.
