Qualified Service Organization Agreements Under 42 CFR Part 2: The Vendor File Behavioral Health Operators Need

Most behavioral health operators can produce a business associate agreement for their EHR vendor within a minute. Far fewer can produce a Qualified Service Organization Agreement for the lab that runs their urine drug screens, the answering service that takes after-hours admissions calls, or the call-tracking platform their marketing team plugged into the main number. For a federally assisted substance use disorder program, those agreements are what allow patient-identifying information to flow to a vendor without written patient consent. When one is missing, every disclosure to that vendor is a disclosure without a legal basis.

This post is operational guidance for owners, clinical directors and compliance officers. It is not legal advice, and the regulation itself, 42 CFR Part 2, is the controlling source.

What a QSOA Is and Why the 2026 Deadline Raised the Stakes

A Qualified Service Organization Agreement (QSOA) under 42 CFR Part 2 is a written agreement between a Part 2 substance use disorder program and an outside vendor that provides services to the program, such as laboratory analysis, billing, data processing, legal or accounting work, in which the vendor acknowledges it is fully bound by Part 2 when it receives, stores or processes patient records and agrees to resist, in judicial proceedings if necessary, any attempt to obtain those records except as Part 2 permits. With that agreement in place, the program may share records with the vendor for the contracted service without individual patient consent. HHS’s final rule revising Part 2 set February 16, 2026 as the date by which programs had to comply with the updated requirements, so any vendor file that has not been reviewed against the revised rule is now out of date by definition.

The revised rule brought Part 2 much closer to HIPAA, including applying breach notification requirements to Part 2 records. HHS summarizes the changes in its fact sheet on the 42 CFR Part 2 final rule, and the current regulation text is published on the Electronic Code of Federal Regulations. Closer alignment did not make the QSOA disappear. It made it easier to fold into existing vendor paperwork, which is exactly why so many programs assume they have one when they do not.

Where the QSOA File Breaks Down in Practice

When we reconcile a program’s vendor list against its signed agreements, the gaps cluster in the same places. The EHR, the billing company and the clearinghouse are almost always covered. The failures are at the edges of the operation, where nobody in compliance signed the purchase order.

Admissions call vendors: answering services, call centers and call-recording or call-tracking tools capture names, phone numbers and the reason for the call, and Part 2’s definition of a patient reaches people who have applied for treatment, not only those admitted.

Reference laboratories: toxicology labs receive identified specimens and return results tied to the program, and a lab contract written for general medical practices often contains HIPAA language with no Part 2 acknowledgment at all.

Alumni and CRM platforms: outreach tools populated from discharge lists are a disclosure of former patient identities, and they are frequently purchased by the business development team rather than through compliance.

Combined BAA templates: a vendor’s standard BAA may say nothing about Part 2, and a document titled “BAA/QSOA” that never actually states the vendor is bound by Part 2 or agrees to resist judicial access does not do the job its title claims.

Subcontracted services: a billing company that offshores coding or a lab that sends specimens to a reference partner moves records one step further from the program, and the agreement should address how the vendor’s own contractors are bound.

The admissions line is the gap we flag most often and the one operators push back on hardest. The reasoning is usually that the caller is not yet a patient. Under Part 2, information that identifies someone as having applied for substance use disorder treatment at a program is protected. A recorded call in which a mother gives her son’s name and asks about detox availability is exactly that kind of information, and it is sitting on a marketing vendor’s server.

What a Defensible QSOA Contains

Use the current regulation as the checklist, not a template from a prior vendor. At a minimum, the agreement should make the following clear in plain language:

• The specific service the vendor provides to the program, described concretely enough that a reviewer can see why the vendor needs patient information to perform it.
• An express acknowledgment that, in receiving, storing, processing or otherwise dealing with any patient records from the program, the vendor is fully bound by 42 CFR Part 2.
• The vendor’s agreement to resist, in judicial proceedings if necessary, any effort to obtain access to patient records except as Part 2 permits.
• Limits on what the vendor may do with the records and how it handles any onward sharing to its own contractors.
• Where the vendor is also a HIPAA business associate, the business associate provisions HHS describes in its business associate guidance, including breach reporting to the program.
• Signatures and dates from people with authority to bind both organizations, and an effective date that precedes the first disclosure.

One limit matters for clinical staff. A QSOA covers services provided to the program. It is not a route for referring a patient to another treatment provider, coordinating with a probation officer or sharing records with a family member. Those disclosures need consent or another specific Part 2 exception, and staff who think “we have a QSOA with them” settles the question will make disclosures the agreement never authorized.

What a Surveyor or Auditor Asks For

In a compliance review or an accreditation survey that touches information management, the request is rarely “show me your QSOAs.” It is usually a sample-driven question: who has access to client information outside your staff, and show me the agreement for each. Reviewers working from that question tend to follow the money and the data. They pull the accounts payable vendor list, or ask which systems the intake coordinator uses, and then ask for the paperwork behind each name.

The programs that handle this well can hand over a single vendor register with four columns: vendor name, service, whether the vendor touches Part 2 records, and the location of the signed agreement with its date. The programs that struggle produce a folder of PDFs and then discover during the review that the toxicology lab’s agreement was signed by a lab sales representative years ago and references the old version of the rule. If you would rather have that discovery happen in a mock review than a real one, our compliance services team runs exactly this reconciliation.

What to Do This Week

Pull your accounts payable vendor list for the last 12 months and your list of software logins used by intake, clinical and billing staff. Merge them into one list. Then, for each vendor, answer one question: does this vendor ever see, hear, store or process information that identifies a person as an applicant for, or patient of, our substance use disorder services? Every “yes” needs a signed QSOA, or a combined BAA/QSOA that actually contains the Part 2 acknowledgment and judicial resistance language, either signed after February 16, 2026 or documented as reviewed against the revised rule.

Expect three categories in the result. Vendors with a current, compliant agreement: file the agreement and record its location in the register. Vendors with an agreement that predates the revised rule or lacks Part 2 language: send an amendment. Vendors with nothing: stop non-essential disclosures until an agreement is signed, and have your privacy officer assess whether what has already been shared needs to be evaluated under the breach notification process HHS outlines in its breach notification guidance.

Finally, add one line to your procurement or purchasing policy: no vendor that may receive client information is engaged, and no system is connected to the main phone line or the EHR, until the privacy officer has confirmed a signed agreement is on file. If you want help writing that procurement control or reviewing your existing agreements, call us at (888) 458-6619.

Keeping the QSOA File Current

A QSOA register is not a one-time project. Vendors change ownership, are acquired, move hosting, add subcontractors or rewrite their standard terms at renewal. Build a review of the register into your annual compliance work plan, assign it to a named owner and tie it to contract renewal dates so amendments happen when you have leverage. Programs without a dedicated compliance lead often place this with a fractional compliance officer who already maintains the policy calendar, and it pairs naturally with the vendor inventory work in our HIPAA compliance checklist.

Whether you are preparing for an accreditation survey, responding to a payer audit or simply want to know whether your admissions vendors are covered, Circa Behavioral can review your vendor register against the current Part 2 rule. Reach our team at (888) 458-6619.