Resource Overview

Conducting an SRA in accordance with HIPAA policy is a complex task, especially for small to medium providers such as community health centers. The HIPAA Security Rule mandates security standards to safeguard electronic Protected Health Information (ePHI) maintained by electronic health record (EHR) technology, with detailed attention to how ePHI is stored, accessed, transmitted, and audited. This rule is different from the HIPAA Privacy Rule, which requires safeguards to protect the privacy of PHI and sets limits and conditions on it use and disclosure. Meaningful Use supports the HIPAA Security Rule. In order to successfully attest to Meaningful Use, providers must conduct a security risk assessment (SRA), implement updates as needed, and correctly identify security deficiencies. By conducting an SRA regularly, providers can identify and document potential threats and vulnerabilities related to data security, and develop a plan of action to mitigate them.

Security vulnerabilities must be addressed before the SRA can be considered complete. Providers must document the process and steps taken to mitigate risks in three main areas: administration, physical environment, and technical hardware and software. The following set of resources provide education, strategies and tools for conducting SRA.

Security Risk Analysis Resources
Compliance with 42 CFR Part 2: A Case Study with Community Medical Centers, Inc.
HITEQ Center

Compliance with 42 CFR Part 2: A Case Study with Community Medical Centers, Inc.

Developed by HITEQ with Adapt Health Information Technology and Chiron Strategy Group

Health centers are actively expanding the substance use treatment services they offer in the community to address access to care for opioid use disorders, and more broadly to address better screening, referral and timely access to all substance use disorder (SUD) treatment. The downloadable case study below is an example of how a health center is assessing operations to comply with 42 CFR Part 2, with a particular focus on changes to their health information technology (IT) systems.

What is 42 CFR Part 2 and when does it apply for health centers? 

The purpose of Title 42 of the Code of Federal Regulations (CFR) Part 2: Confidentiality of Substance Use Disorder Patient Records (Part 2)  is to address concerns about the use of substance use disorder (SUD) information in non-treatment based settings. Part 2 is intended to ensure that a patient receiving treatment for a SUD in a Part 2 Program does not face adverse consequences in criminal or domestic proceedings such as those related to child custody, divorce or employment. Part 2 protects the confidentiality of SUD patient records by restricting the circumstances under which Part 2 Programs can disclose information. Part 2 is applicable to federally assisted programs who provide and hold themselves out as providing SUD services including diagnosis, treatment, or referral for treatment.  Providers in general facilities whose primary function is to provide diagnosis, treatment, or referral for treatment for a SUD are also considered “programs”. 

Compliance with Part 2 will likely involve a number of changes for health centers including changes to clinical documentation and data segregation in the EHR, suppression of data sharing across HIE’s and other networks, changes to workflows, and changes to patient intake and patient-facing forms. For health centers that have emphasized and pursued data sharing and exchange, putting these protections in place may feel like working backwards in systems that are designed for automated sharing. 

For more information, please see 42 CFR Part 2 Final Rule and Health Center Compliance in the HITEQ webinar archives.

The case study, available for download below, includes a 42 CFR Part 2 Regulatory Checklist that health centers may find particularly helpful to review.

Download the full case study below.


Intended AudienceHealth Center Leadership, Behavioral Health Teams and Providers, Health IT Staff, Care Team Leaders

Documents to download

Please login or register to post comments.

Theme picker


This resource collection was cultivated and developed by the HITEQ team with valuable suggestions and contributions from HITEQ Project collaborators.

Looking for something different or have something you think could assist?

HITEQ works to provide top quality resources, but know your needs can be specific. If you are just not finding the right resource or have a highly explicit need then please use the Request a Resource button below so that we can try to better understand your requirements.

If on the other hand you know of a great resource already or have one that you have developed then please get in touch with us by clicking on the Share a Resource button below. We are always on the hunt for tools that can better server Health Centers.

Request a Resource  Share a Resource
Search HITEQ Content
Learning Progress
Quick Feedback Request
Highlighted Resources & Events

Theme picker

Need Assistance?
Would you like more assistance regarding Privacy and Security strategies or support in using any of the include resource sets?

  Request Support


The Quadruple Aim
Quadruple Aim

A Conceptual Framework

Improving the U.S. health care system requires four aims: improving the experience of care, improving the health of populations, reducing per capita costs and improving care team well-being. HITEQ Center resources seek to provide content and direction aligned with the goals of the Quadruple Aim

Learn More >