Behavioral Health Practices and Communication Confidentiality

Behavioral health practices can be subject to confidentiality requirements beyond HIPAA, depending on the service, program, and records involved. Most healthcare communications content assumes that baseline and stops there. A separate federal rule also reaches substance use disorder treatment records. Compliance with its updated terms became mandatory on February 16, 2026.

This creates a practical problem that has nothing to do with clinical care. Ordinary phone habits pass without notice in a primary care office. In a behavioral health one, the same habits can disclose something. A voicemail. A caller ID. A shared queue. An appointment reminder.

This article covers why the bar is higher, where communication systems create exposure, and what to evaluate in a platform. Every specific judgment belongs to your compliance counsel.

Why the confidentiality bar is higher

Two things stack.

HIPAA applies where the practice or organization is a covered entity or business associate and the information is protected health information. The Privacy, Security, and Breach Notification Rules then shape how that information is handled.

42 CFR Part 2 may also apply. HHS describes Part 2 as protecting records of the identity, diagnosis, prognosis, or treatment of any patient in connection with substance use disorder programs. Those programs are conducted, regulated, or assisted by a federal department or agency. Part 2 reaches practices and programs that take federal assistance and hold those records.

The 2024 final rule brought several changes that matter to anyone handling these records. The HHS fact sheet on the Part 2 final rule sets them out. It applied the same requirements as the HIPAA Breach Notification Rule to breaches of Part 2 records. It replaced the criminal penalties previously in Part 2 with the civil and criminal enforcement authorities that apply to HIPAA violations. And it gave patients a new right to file a complaint directly with the Secretary for an alleged Part 2 violation.

Whether Part 2 applies to your practice, to which records, and when is a question for your compliance counsel. HHS keeps an overview at hhs.gov/hipaa/part-2.

The framing that matters for communications is this. In most of healthcare, the risk in a disclosure is what was said. In behavioral health, the risk is often that a relationship exists at all. Confirming that a person is a patient of a named practice can itself be the harm.

That reframes every communication decision. It also changes who signs off on one. A phone setting stops being an office detail and becomes a disclosure choice.

Where communication systems create exposure

Six places, and none of them involve clinical content.

1. Outbound voicemail

A voicemail left on a household or shared line discloses a call from a named practice. If the practice name identifies the service, the disclosure has happened before the message content matters.

Three things matter here. What is the outbound greeting name? Does the message say the practice name? And what has the patient consented to receive, on which line?

2. Inbound voicemail

Voicemail from patients carries clinical detail and identity, and it is a record. It is also the setting most often left at default: kept with no end date, open to anyone with the mailbox, and rarely reviewed.

Transcription makes a second copy. Where a voicemail transcript lands in email or in a chat thread, it becomes a second record. That copy sits in a system with its own access rules and its own retention. Ask a vendor where every copy of a message goes, not just where the first one lands.

3. Caller ID

The number a practice presents when calling out appears on the recipient's screen. It then sits in their call history. Where that number is public and tied to a named service, presenting it is disclosure.

Branded caller ID displays a name rather than a number. In most of healthcare that helps. Here it needs a second look, because the displayed name is the disclosure.

4. Appointment reminders

Automated reminders are convenient. They go to whichever device and channel is on file, at whatever hour the setup names. The content, the channel, the timing, and the consent record all matter. In most practices one person sets all four once, optimizing for attendance.

5. Shared queues and coverage

A practice offering both general and behavioral health services may route calls through shared staff or shared queues. Which staff can see which caller, which records, and which call history is a confidentiality question, not an efficient one.

After hours coverage raises the same point. An answering service that picks up for the whole practice can see which line the caller dialed, and that line may name the service.

6. Text messaging

Do not treat ordinary carrier SMS as automatically appropriate for sensitive behavioral-health communications. Evaluate the message content, recipient preference, safeguards, vendor role, and the laws and policies that apply to the specific workflow. The existence of a patient relationship can itself be sensitive in some contexts, so keep reminder and outreach content deliberately limited.

A messaging feature inside a contracted platform may have a different data path and vendor role from carrier SMS. Evaluate each channel and workflow separately rather than assuming the same controls apply. The two are easy to confuse, because the app icon on a phone can look the same. Ask a vendor which of the two a given feature uses, and get the answer in writing.

What to evaluate in a platform

Seven capabilities to ask any vendor about, including us. Each one is a question. Ask for proof rather than a claim. Do not accept a capability list.

1. Per-line and per-service configuration. Can you set outbound presentation, greetings, voicemail behavior, and retention differently for one service line than for the rest of the practice? A single global setup forces the wrong setting somewhere.

2. Granular access control. Can you scope access to voicemail, recordings, and call history to a named group rather than to every administrator? Ask what the smallest scope is.

3. Audit logging of access. Is there a record of who accessed which voicemail, recording, or call history, and when? Ask to see the log format. Then ask two more things: how long the log itself is kept, and who can read it.

4. Retention configurable per record type. Voicemail, recordings, and messaging often need different periods. Ask whether the platform can apply a legal hold narrowly.

5. Outbound identity control. Can you set the outbound caller ID display per service line? Can the platform sign that display, so carriers do not read it as spoofing?

6. Reminder configuration granularity. Can you set reminder content, channel, and timing per service, per patient preference, and per consent record?

7. Business associate agreement scope. Which specific services does the agreement name? HHS specifies what a business associate contract must contain. The covered-services list, though, is the vendor's state and yours to read.

Ask the vendor to show each of these during evaluation and to put the answer in writing. A vendor unwilling to do that has given you the answer.

A sequence worth following

Establish with counsel whether Part 2 applies, to which records and which programs.

Inventory every channel currently used to contact patients, including the ones nobody authorized.

Document the current setup of voicemail, retention, access, caller ID, and reminders. This step usually produces surprises.

Map communication preferences and any required consent to the actual channel, purpose, and content. Do not assume permission for one workflow automatically covers another.

Ask the seven questions of your current provider before asking them for a new one. Some gaps are set up rather than platforms.

Have counsel review the resulting setup before it becomes the standing state.

What this article does not do

It does not tell you what Part 2 requires of your practice. It does not state retention periods. It does not tell you whether a specific voicemail practice is permissible.

Those answers depend on your programs, your federal assistance status, your records, and your consent framework. They belong to your compliance counsel. Communications work has a narrower job. When counsel reaches those answers, the platform has to implement them. And you have to be able to evidence what the setup actually is.

Related reading

Three pieces that pick up where this one stops — same audience, adjacent decision.

• HIPAA and Telehealth Video

• What a Healthcare Contact Center Actually Does 

Frequently Asked Questions

What is 42 CFR Part 2?

A federal regulation protecting records of the identity, diagnosis, prognosis, or treatment of patients in connection with substance use disorder programs that are conducted, regulated, or assisted by a federal department or agency. It is separate from HIPAA and in places stricter.

When did the Part 2 final rule take effect?

The final rule was announced February 8, 2024, and compliance with its requirements has been mandatory since February 16, 2026.

What did the Part 2 final rule change?

Among other changes, it applied the same requirements as the HIPAA Breach Notification Rule to breaches of Part 2 records, replaced the criminal penalties previously in Part 2 with the civil and criminal enforcement authorities that apply to HIPAA, and gave patients a right to complain directly to the Secretary.

Can a behavioral health practice leave a voicemail for a patient?

That determination depends on the applicable rules, the consent on file, and the circumstances, and it belongs to your compliance counsel. What a platform should let you control is whether the practice name is disclosed, what the message contains, and which line the setting applies to.

Are automated appointment reminders allowed?

The same answer applies: it is a determination for counsel based on consent and applicable rules. What matters technically is whether reminder content, channel, and timing can be configured per service and per patient rather than globally.

What should a behavioral health practice ask a phone vendor?

Seven things: per-service configuration, granular access control, audit logging of access, per-record-type retention, outbound identity control, reminder configuration granularity, and the specific services named in the business associate agreement. Ask for each to be demonstrated, not described.

Quick Answers

42 CFR Part 2: protects substance use disorder treatment records in federally assisted programs. Separate from HIPAA.

Compliance required since: February 16, 2026.

The distinctive risk: disclosure of the relationship itself, not of clinical content.

Six exposure points: outbound voicemail, inbound voicemail, caller ID, reminders, shared queues, text messaging.

Every determination belongs to compliance counsel. The platform's job is to implement it and evidence it.