Part 2 and BAA readiness checklist.

1. 1.Our patient consent form covers disclosures to payers for payment, using the single treatment, payment and health care operations consent the 2024 Part 2 rule allows.
2. 2.Each disclosure made under a consent includes a copy of the consent or a clear explanation of its scope.
3. 3.We collect separate consent for SUD counseling notes, and never rely on the general consent for them.
4. 4.We have a signed business associate agreement with every vendor that handles PHI for us, including billing, clearinghouse and AI tools.
5. 5.Our agreements with vendors that receive Part 2 records address Part 2 as well as HIPAA.
6. 6.We send payers and vendors only the minimum necessary information for each task.
7. 7.Our Patient Notice reflects the 2024 Part 2 changes and aligns with our HIPAA Notice of Privacy Practices.
8. 8.We have a breach response plan that applies HIPAA breach notification rules to Part 2 records.
9. 9.Staff who touch SUD records were trained on the 2024 rule changes.
10. 10.We know which of our records are Part 2 records, even though the rule does not require us to segregate them.

0 of 10 yes. Several gaps. Worth a review with your compliance lead or counsel.