Health and human services agencies
HIPAA, substance-use records and privacy, handled as one program
Already have an IT provider? Here's how we work together.
An example
Consider a county department that runs a mental health clinic and works closely with a substance-use treatment program. Records about substance-use treatment carry a federal confidentiality rule (42 CFR Part 2) that is stricter than HIPAA about who may see them and when.
A new case-management system goes live next month. It will share records across programs. Nobody has checked whether each disclosure the system will make is covered by a patient’s consent or otherwise permitted, or whether the consent forms match what the system will actually do.
The Problem
Health and human services agencies often carry several privacy and security obligations at once: HIPAA for the clinic or health department, 42 CFR Part 2 for substance-use records, state reporting duties, and the conditions on federal grants.
Each rule is usually handled by a different office. Case workers and clinicians need information quickly, and vendors change systems often. The gaps appear where the rules and the systems meet.
People share their most sensitive information with these agencies. Protecting it has to be designed in, not checked once.
What we do
A HIPAA security risk analysis, with each safeguard checked against NIST controls.
A 42 CFR Part 2 review of consent forms and of who receives substance-use records, for what purpose, under which consent or permitted use; where a system needs to separate records, we check that it does.
A privacy program: what information is held, why, who can see it, and how requests and breaches are handled.
Security review of the vendors that hold client records, before purchase and every year after.
Incident response and breach-notification readiness, practiced in a tabletop exercise.
Audit preparation rounds before a review by the federal Office for Civil Rights or a state oversight agency.
Who does what
Security Medic
Leads the security program: assesses, writes the plan and the policies, specifies the controls that must be put in place, reports to leadership, and checks that the work was done.
Your IT staff, IT provider and system vendors
Configure and run the systems. We specify what must be in place, including sharing and consent settings, and check the result.
Commissioner, program directors and privacy officer
Approve policies, decide who may see what, and answer to oversight agencies.
Your attorney and your insurer
Give legal advice and make coverage decisions. We are not legal counsel, and we work alongside both.
What must be met, and how it is met
An obligation is what the organization must meet: a law, a regulation, a contract or a grant condition. A standard is how it is met and checked. The NIST Cybersecurity Framework (CSF) 2.0 connects them, so one program and one body of proof serve every obligation.
Obligations that commonly apply
- HIPAA Security Rule (45 CFR Part 164, Subpart C). Safeguards for electronic health information held by clinics, health departments and other covered parts of the agency.
- HIPAA Privacy and Breach Notification Rules. Who may use and share health information, and what must happen after a breach.
- 42 CFR Part 2. The federal confidentiality rule for substance-use disorder treatment records. The 2024 update (compliance from February 16, 2026) aligns much of it with HIPAA and does not require records to be kept separate, but consent, permitted uses and disclosures, and the limits on use in legal proceedings still apply.
- NY General Municipal Law Article 19-c and federal grant conditions. Cyber incident reporting to DHSES within 72 hours for county agencies, and reasonable cybersecurity in internal controls for agencies spending federal awards (2 CFR § 200.303).
Standards we use to meet them
- NIST SP 800-53 Rev. 5 with SP 800-53A. The controls used to meet the HIPAA safeguards, and the methods to check them: examine, interview, test.
- HHS HIPAA Security Rule crosswalk and NIST SP 800-66 Rev. 2. Federal guides that map HIPAA requirements to the earlier versions of the Cybersecurity Framework (the HHS crosswalk to the 2014 version, SP 800-66 Rev. 2 to CSF 1.1) and to NIST SP 800-53 controls. We carry those mappings forward to CSF 2.0 in our own analysis.
- NIST Privacy Framework 1.0. A structure for the privacy program across all of the agency’s programs.
- NIST CSF 2.0. The hub that connects every obligation, so one body of proof serves them all.
Which obligations apply depends on the organization; the free assessment and the first call sort that out.
Security Medic is independent. We assess against these laws, standards and frameworks as a reference. We do not certify, we are not legal counsel, and we are not affiliated with the agencies and bodies that publish them.
The first step is free
Before anything is bought, the organization should know where it stands. The free assessment shows that, at no cost and with no obligation.
- 1
Free 30-minute call (optional)
Talk through the rule, the grant or the deadline, and what the organization needs.
- 2
Free assessment
Answered online, in plain language. No technical knowledge is needed.
- 3
Gap report
Where the organization stands, the gaps that matter most, and the path to close them.
- 4
Free results review
We walk through the report together and answer questions.
If more work makes sense, it is scoped in writing against the named obligation: a scoped assessment, then audit preparation rounds where a formal review or deadline is coming. When the work has to go through procurement, the gap report helps write a scope that fits the need.
When to talk to us
The best time is before an RFP is written. By the time a solicitation is posted, the scope is set. Earlier, a free assessment can show what the organization actually needs, so the work that follows is the right work.
- Before a new case-management or health record system goes live, or a vendor changes.
- When the HIPAA risk analysis is more than a year old.
- When a grant is awarded that funds technology or data sharing.
- Before writing an RFP for privacy or security help, so it asks for what the agency actually needs.
How public bodies can work with us
Through an RFP
We respond to solicitations as the prime contractor or as a named subcontractor on another firm’s team.
Direct purchase
Where the organization’s procurement policy allows a direct purchase or quotes, we provide a written proposal for the scope.
Grant-funded work
When a grant pays for an assessment or plan, we scope the work to the grant’s conditions and reporting.
Procurement officers will find our company details and what to expect in a response in the bid kit.
Start with a free 30-minute call
Bring the rule, the grant or the deadline. We will talk through where the organization likely stands and what a first step would cover.
Book a free call