Behavioral health intake, scheduling, and crisis lines carry the disclosures most likely to fail a 42 CFR Part 2 audit and the conversations most likely to lose a patient at the front door. Compass listens to every one of them and produces evidence that holds up for OCR, SAMHSA, your state authority, and your accreditor.
You run compliance or operations for a behavioral health program. Maybe a freestanding SUD facility with detox, residential, and IOP. Maybe a multi-site mental health network with outpatient clinics, crisis lines, and a warmline. Either way, your week is shaped by a fact most healthcare vendors do not understand. A phone call from your facility, by itself, can identify a patient as a person with substance use disorder. The caller ID, the IVR prompt, the agent's greeting, the voicemail left on a family member's phone. Any of these can be a disclosure under 42 CFR Part 2 if the recipient was not authorized by the patient. HIPAA does not work this way. Part 2 does.
The 2024 SAMHSA final rule, published jointly with OCR and implementing sections of the CARES Act, aligned several Part 2 provisions with HIPAA. A single patient consent can now authorize future uses and disclosures for treatment, payment, and health care operations. Breach notification follows the HIPAA Breach Notification Rule. Patients gained a strengthened right to an accounting of disclosures. Penalties mirror HITECH-tier HIPAA enforcement. The general compliance date is February 16, 2026. None of this made the underlying confidentiality standard less strict. Part 2 still requires the §2.31 consent elements and the §2.32 prohibition-on-redisclosure notice, and still treats verbal acknowledgment that a person is in your program as a disclosure. The alignment narrowed the workflow gap. It did not narrow the consent rules.
Your job is not what general healthcare QA teams do. You watch for the specific failure modes. Staff confirming a patient relationship to someone pretending to be family. Voicemails left at numbers the patient never authorized. Consent revocations that came in by phone Tuesday and may not have been honored on Wednesday's outreach call. Redisclosures to a primary care provider where the consent has since expired. Mandatory reporting calls where state child welfare law, the duty to protect under Tarasoff-line statutes, and Part 2 collide and the agent improvised. Crisis calls where the §2.51 medical emergency exception threshold was crossed and the documentation supporting that disclosure decision is thin.
Most of this risk lives on the phone, against patients in withdrawal and family members who do not understand why you cannot confirm their daughter is in your program. The audit trail you can produce today reflects two to five percent of those conversations. The other 95% sit in your recording archive, unreviewed.
Sampling catches what is loud. The clear script breach. The monotone privacy notice on a sampled call. What it does not catch is the pattern. Sampling cannot tell you how often, across every inbound call last quarter, a staff member confirmed that a named individual was a patient before verifying caller identity and authorization. It cannot tell you which referral coordinators leave detailed voicemails on numbers the patient did not list as a safe contact. It cannot tell you whether the script change you rolled out in April actually changed behavior in May.
It also misses the drift that defines Part 2 risk. The intake team that started saying "treatment center" in the greeting after a phone system update, when the prior wording was the generic facility name the privacy officer approved. The case manager who slips into a soft acknowledgment that an adult patient is "doing well" when a worried parent calls. The night shift that drifts off person-first language because the trainer who set the standard left. The thin overnight rotation, where most facilities have their worst exposure between 7 p.m. Friday and 7 a.m. Monday, is the part of the week your sample is least likely to find.
Consent revocation is its own failure mode. Part 2 consent can be revoked orally and is effective immediately. When a patient says on a Monday call "I do not want my mom getting updates anymore," the revocation lands the moment they say it. Whether the next outbound call to mom happens depends on whether someone logged it, whether it propagated from the after-hours queue into the morning outreach list, and whether the next agent read the record.
42 CFR Part 2 governs the confidentiality of substance use disorder patient records held by federally assisted programs. It is stricter than HIPAA in the ways that matter most for recorded calls. Disclosure of information that would identify a patient as having or having had a substance use disorder requires written patient consent unless a specific exception applies. The consent must contain the §2.31 elements, including the recipient, the purpose, and the amount and kind of information disclosed. Disclosures must be accompanied by the §2.32 prohibition-on-redisclosure notice. The §2.51 medical emergency exception, the §2.52 research and audit provisions, and the §2.64 and §2.65 court order procedures define the narrow paths around the consent rule. None of that changed with the 2024 final rule.
What changed is the operational integration. The new accounting-of-disclosures right, the breach notification alignment with HIPAA, and the single-consent TPO model all assume you can retrieve a defensible record of disclosure events on demand. A recording archive scored at five percent cannot produce that record.
State law adds another layer. Many states have confidentiality protections for mental health records that go beyond HIPAA. Mandatory reporting duties, including child abuse, elder abuse, and the duty to warn or protect established by Tarasoff-line cases and codified by statute in most states, interact with Part 2 rather than override it cleanly. The defensible posture in an audit is documentation that the call happened, what was said, what threshold was crossed, and what action followed. Accreditors care too. CARF and The Joint Commission Behavioral Health Care surveys look at communication and consent practices. State DHS licensing inspections often request call-handling evidence. Same set of recordings either way.
Compass analyzes every call into and out of your intake, scheduling, case management, crisis, and care coordination lines. Conditions are factual observations from each call. Signals are behavioral patterns scored against those conditions, calibrated to your clinical style guide and Part 2 policies. Outcome Lift attaches operational, clinical, and retention impact. Guidance turns the pattern into coaching for the staff member who needs it. Conversation Compliance is the primary pillar. Insights, Quality, and Coaching turn the compliance evidence into operational and clinical improvement, without replacing your privacy officer, your clinical peer review, or your accreditation prep.
Conversation Compliance. Part 2 specific signals across every call. Identity verification before patient confirmation. Voicemail and authorized-contact match. Consent revocation capture. Redisclosure prohibition notice delivery. Authorized-disclosure scope adherence. Mandatory reporting threshold and disposition. Each signal produces audit-ready evidence with timestamped audio.
Conversation Insights. Drift across sites, shifts, payer cohorts, and tenure. Patterns sampling cannot see, like the slow erosion of identity verification on high-volume mornings or the night-shift drift on person-first language.
Conversation Coaching. Evidence-backed coaching moments per staff member, tied to the actual moment in the actual call. The intake coordinator who needs a refresher on family handling is identified by behavior, not by a supervisor's guess.
Conversation Quality. Replaces a QA scorecard that was never built for trauma-informed work. Conditions, Signals, Outcome Lift, and Guidance let your clinical director and your compliance officer look at the same evidence rather than two reviewer interpretations.
Q: What is your contractual posture under HIPAA and Part 2? A: Compass signs a Business Associate Agreement for HIPAA covered entities and a Qualified Service Organization Agreement (QSOA) for Part 2 programs. Both are in place before any audio or transcript is exchanged. We do not redisclose, do not sell, and no customer data is used to train models that serve other customers. Standard paperwork (NDA, BAA, QSOA, DPA) is available on request, and SOC 2 is in progress; documentation is available during your vendor review.
Q: Are transcripts, signal outputs, and derivative artifacts treated as Part 2 records? A: Yes. Transcripts, embeddings, signal scores, and reports produced from SUD-identifying conversations inherit Part 2 protection. The §2.32 redisclosure prohibition propagates to derivative artifacts. Access controls, audit logs, retention policy, and the current sub-processor list are available during your vendor review.
Q: How does Compass handle subpoenas and court orders for our SUD records? A: A court order meeting §2.64 or §2.65 requirements is generally needed before SUD records can be disclosed in response to a subpoena. Compass surfaces, exports, and legal-holds the specific calls and artifacts your counsel needs and supports your normal legal process. We do not respond to third-party requests directly.
Q: We have a QA team and a clinical peer review process tied to CARF or Joint Commission. What changes? A: Peer review and accreditation review do not go away. Their inputs change. Reviewers stop sampling and start working from the calls Compass surfaces as material. Most teams we work with move staff hours from scoring calls toward coaching the patterns Compass identifies, while keeping the accreditation-required review cycles intact.
Q: Does Compass cover payer audit and utilization review calls? A: Yes. Insurance verification, UR, and single-case agreement calls are among the most material conversations in a behavioral health revenue cycle. Compass produces the call-level evidence you need when a payer disputes medical necessity or authorization.
Q: Will this work with our recording platform and EHR? A: Compass ingests audio from platforms common in behavioral health, including Genesys Cloud, Five9, NICE, RingCentral, and standard SIPREC recorders. Reference data joins to behavioral-health EHRs including Kipu, Sunwave, BestNotes, and CareLogic are supported. Integration specifics are confirmed in your vendor risk and integration review before any production data moves.
Q: We do not want this to become a surveillance tool that drives turnover on our intake team. A: Compass is configured to support evidence-based coaching, not punitive scoring. Signal-level coaching moments are calibrated to clinical practice, and we work with operators on rollout to coordinators, supervisors, and any applicable works council before scoring is tied to evaluation. Multilingual transcription and signal extraction are supported, including bilingual coordinators who code-switch mid-call.
Q: How is Compass different from generic call analytics or an LLM pointed at our recordings? A: A general LLM over raw transcripts can summarize. It cannot tell you whether a voicemail was left on an authorized number, whether the §2.32 prohibition notice was delivered on a specific redisclosure, or whether the §2.51 emergency exception threshold was met with documented support. Compass uses Contextual Entity Resolution, which ties each utterance to the patient, the staff member, the consent state at the time of the call, and the regulatory frame. The audit trail is structured rather than summarized.
Q: What happens at offboarding? A: At contract end, Compass returns or destroys audio, transcripts, and derivative artifacts on your election, with written attestation, on the timeline your QSOA specifies.
Bring us one Part 2 scenario your sample never seems to catch: a voicemail pattern you suspect, a consent revocation that may not have propagated, a crisis call that crossed the §2.51 threshold. We will walk it through Compass on synthetic or publicly available behavioral health audio so your privacy officer and clinical lead can see the evidence shape before any of your audio moves. BAA and QSOA come first when your recordings are involved. Bring your privacy officer to the working session.
