# 42 C.F.R. § 2.16 (2026): Security for records and notification of breaches

> Federal · Regulations · In force

URL: https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_16

## Section

- **Citation:** 42 C.F.R. § 2.16 (2026)
- **Heading:** Security for records and notification of breaches
- **Jurisdiction:** Federal
- **Kind:** Regulations
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** Title 42 CFR: Public Health / Chapter I: PUBLIC HEALTH SERVICE, DEPARTMENT OF HEALTH AND HUMAN SERVICES / Part 2: CONFIDENTIALITY OF SUBSTANCE USE DISORDER PATIENT RECORDS / Subpart B: General Provisions / § 2.16: § 2.16   Security for records and notification of breaches.

## Text

(a) The part 2 program or other lawful holder of patient identifying information must have in place formal policies and procedures to reasonably protect against unauthorized uses and disclosures of patient identifying information and to protect against reasonably anticipated threats or hazards to the security of patient identifying information.
(1)
Requirements for formal policies and procedures.
These policies and procedures must address all of the following:
(i) Paper records, including:
(A) Transferring and removing such records;
(B) Destroying such records, including sanitizing the hard copy media associated with the paper printouts, to render the patient identifying information non-retrievable;
(C) Maintaining such records in a secure room, locked file cabinet, safe, or other similar container, or storage facility when not in use;
(D) Using and accessing workstations, secure rooms, locked file cabinets, safes, or other similar containers, and storage facilities that use or store such information; and
(E) Rendering patient identifying information de-identified in accordance with the requirements of 45 CFR 164.514(b) such that there is no reasonable basis to believe that the information can be used to identify a particular patient.
(ii) Electronic records, including:
(A) Creating, receiving, maintaining, and transmitting such records;
(B) Destroying such records, including sanitizing the electronic media on which such records are stored, to render the patient identifying information non-retrievable;
(C) Using and accessing electronic records or other electronic media containing patient identifying information; and
(D) Rendering the patient identifying information de-identified in accordance with the requirements of 45 CFR 164.514(b) such that there is no reasonable basis to believe that the information can be used to identify a patient.
der the patient identifying information non-retrievable;
(C) Using and accessing electronic records or other electronic media containing patient identifying information; and
(D) Rendering the patient identifying information de-identified in accordance with the requirements of 45 CFR 164.514(b) such that there is no reasonable basis to believe that the information can be used to identify a patient.
(2)
Exception for certain lawful holders.
Family, friends, and other informal caregivers who are lawful holders as defined in this part are not required to comply with paragraph (a) of this section.
(b) The provisions of 45 CFR part 160 and subpart D of 45 CFR part 164 shall apply to part 2 programs with respect to breaches of unsecured records in the same manner as those provisions apply to a covered entity with respect to breaches of unsecured protected health information.
[89 FR 12622, Feb. 16, 2024]

## Nearby sections

- [42 C.F.R. § 2.11 (2026) § 2.11   Definitions.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_11.md)
- [42 C.F.R. § 2.12 (2026) § 2.12   Applicability.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_12.md)
- [42 C.F.R. § 2.13 (2026) § 2.13   Confidentiality restrictions and safeguards.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_13.md)
- [42 C.F.R. § 2.14 (2026) § 2.14   Minor patients.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_14.md)
- [42 C.F.R. § 2.15 (2026) § 2.15   Patients who lack capacity and deceased patients.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_15.md)
- [42 C.F.R. § 2.16 (2026) § 2.16   Security for records and notification of breaches.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_16.md)
- [42 C.F.R. § 2.17 (2026) § 2.17   Undercover agents and informants.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_17.md)
- [42 C.F.R. § 2.18 (2026) § 2.18   Restrictions on the use of identification cards.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_18.md)
- [42 C.F.R. § 2.19 (2026) § 2.19   Disposition of records by discontinued programs.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_19.md)
- [42 C.F.R. § 2.20 (2026) § 2.20   Relationship to state laws.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_20.md)
- [42 C.F.R. § 2.21 (2026) § 2.21   Relationship to federal statutes protecting research subjects against compulsory disclosure of their identity.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_21.md)
- [42 C.F.R. § 2.22 (2026) § 2.22   Notice to patients of Federal confidentiality requirements.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_22.md)
- [42 C.F.R. § 2.23 (2026) § 2.23   Patient access and restrictions on use and disclosure.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_23.md)
- [42 C.F.R. § 2.24 (2026) § 2.24   Requirements for intermediaries.](https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_24.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/CFR_T42_P2_S2_16. Check the current official text before relying on it. Not legal advice.