42 CFR Part 2 goes well beyond HIPAA
Consent and disclosure rules for substance use treatment are stricter and go into more detail. Most generalist platforms simply do not model them, so staff work around the system.
Healthcare ยท India & South Asia
One in four treatment facilities is still running on a mix of EHR and paper.
Not because the software does not exist. Because almost none of it handles 42 CFR Part 2 properly.
1 in 4
substance use and mental health treatment facilities use a mix of electronic records and paper charts.
Source: ONC data brief: EHR adoption among substance use and mental health treatment facilities, 2024
In India
This is what it actually runs on here.
Platforms in this market
- Kipu
- Sunwave
- Lightning Step
- Ritten
- 42 CFR Part 2
- ASAM criteria
- Medicaid MCO portals
- FHIR R4
These are the platforms we have shipped against. Name the ones you run and we will tell you straight whether we know them.
Rules that apply here
- the Mental Healthcare Act 2017
- state licensing
- the DPDP Act 2023
We read the rule before the call. It is the cheapest way to prove we did the work.
What is happening
Four systems, four versions of the same client. None of them wrong.
The payer mix is brutal
Medicaid managed care, commercial, and county-funded contracts in the same building, each with different authorisation rules, documentation standards and billing formats.
Residential and outpatient need different systems, and get one
Residential needs bed and census management, withdrawal documentation, eMAR and billing that survives utilisation review. Day programmes live on group documentation and attendance-driven billing.
Utilisation review eats clinical time
Continued-stay authorisations require clinical justification assembled by hand, repeatedly, for the same patient.
However hard, whatever it is
Four systems is one example. Bring whatever yours is.
This page is about one view across the client record. If your problem is intake, staffing or a payer who keeps saying no, that is the same work.
-
01 We sit with you
Days where the work happens, not a workshop in a meeting room. We watch the job get done and write down the shortcuts nobody wrote down.
-
02 We read everything
Your data, your rules, your vendors and their documentation, and the published research on your sector. We report what is actually in there.
-
03 We break it to first principles
Not which tool fixes this. What is actually causing it, taken apart until we reach the piece that cannot be divided further.
-
04 Then we build
Weeks, not quarters. By this point we are not guessing what to build, and guessing is the thing that makes projects long.
Where we sit
Your EHR stays. We build the one view across every system that holds a client.
4
What you get
- Consent modelled Part 2 handled in the system, not around it
- Authorisations Continued-stay packets assembled from the record
- One census Beds, groups and attendance in one operational picture
3
Built new for you — none of this exists in your stack today
- A phone check-in a client can finish in a minute
- An authorisation tracker that warns before the days run out
- A census board for the wall of the nurses station
2
The client-record layer Reads your systems. Puts nothing in a chart without sign-off.
Connectors, one agreed meaning per field, and a model reading what no
field holds. Accuracy measured on your own records.
1
- Kipu
- Sunwave
- Lightning Step
- Ritten
- 42 CFR Part 2
What you already run — unchanged, and still yours
If a clinic records it, we can reach it. An EHR with no API, a fax that still arrives, a spreadsheet a counsellor keeps. All of it can be joined.
-
No API -
No documentation -
A terminal from 1994 -
It arrives as paper -
The vendor said no -
It reports nothing
Not a list of limits. Name yours on the call.
And once we can reach it, a model can read it. Most of the value here is in the sources nobody ever structured — the note, the letter, the screen.
Intelligence, plumbed in
The answer is in the counsellor's note, not in a tick box.
So we build retrieval over the notes, with consent rules enforced in the layer, not left to whoever writes the prompt.
How we make AI survive real data-
Connectors -
A semantic layer -
Evals you can check
What changes
Judge us on this, not on what we built.
Consent modelled Part 2 handled in the system, not around it
Consent scope, expiry and redisclosure enforced in code, with an audit trail that holds up.
Authorisations Continued-stay packets assembled from the record
The clinical justification pulled together rather than rewritten every review cycle.
One census Beds, groups and attendance in one operational picture
Across residential, PHP, IOP and outpatient, with billing that reflects what actually happened.
Who this is for
The people who feel this first
-
Executive Director -
Clinical Director -
Utilisation Review Manager -
Billing Manager -
Compliance Officer
Straight answers
The questions you would ask on the call
-
Do you understand 42 CFR Part 2?
Yes, and we treat it as a data-model problem rather than a policy document. Consent scope, duration and redisclosure rules have to be enforced by the system. If they live in a staff handbook, they will be broken under pressure.
-
We run residential and outpatient. Can one system cover both?
One operational layer can, provided it models them differently underneath. Residential is a census and medication problem; day programmes are an attendance and group-documentation problem. Treating them identically is why most platforms fit neither.
-
Where do you start?
With a free 20-minute call. If it looks like a fit, we then read your data and show you what your payer mix actually needs against what your system records. We agree that price with you first.
-
Can AI be used on clinical notes without breaking consent rules?
Only if consent is enforced in the layer, not in the prompt. We build it that way. The model sees nothing a rule has not cleared.
Do you know the rules that apply in India, Sri Lanka and Bangladesh?
For behavioral health that means the Mental Healthcare Act 2017, state licensing and the DPDP Act 2023. We read the rule before the call, so the first meeting is about your operation rather than about us catching up.
Whatever behavioral health needs here, we can make it.
What you already run stays where it is. Around it we build software, hardware and the process itself. Here that means a phone check-in a client can finish in a minute.
See everything we build-
Software -
Hardware -
Ways of working -
Whole ventures
Honest about the numbers
The figure above is from ONC data brief: EHR adoption among substance use and mental health treatment facilities, 2024, for behavioral health.
We have not localised it, because a number nobody can check is worth less than a real one plus this sentence. The pattern travels. The size of it in your market is a question for the call.
Same industry, other markets