Behavioral health archival: Netsmart, Credible, Anasazi and 42 CFR Part 2

42 CFR Part 2 is the federal regulation governing the confidentiality of substance-use-disorder (SUD) treatment records. It requires patient consent for every disclosure (with limited exceptions), prohibits re-disclosure without additional consent, and applies stricter audit requirements than HIPAA. An archive holding SUD records must enforce these rules at the record level, not just the user level.

Behavioral-health programs keep more narrative content than most medical settings: assessments, treatment plans, progress and group notes, and scanned consents. The archive has to carry each record's consent status and SUD flag forward from the source system, so that the right disclosure rules still apply years after the legacy platform is retired.

The project follows the same sequence as any legacy EHR decommissioning, with two extra checkpoints. First, the source system's consent and disclosure model is mapped before extraction, so no SUD record lands in the archive without its controls. Second, release-of-information workflows are tested against Part 2 scenarios during the read-only window, before the legacy platform is shut down. Retention is set per state; see hospital record retention by state.

Behavioral-health programs most often archive Netsmart myEvolv, Credible and Anasazi, plus a long tail of state-specific behavioral-health EHRs. The trigger is usually the same as in acute care: an enterprise EHR consolidation, after which the legacy platform has to be retired without losing the legal record. Because these systems hold substance-use-disorder treatment records, the archive inherits 42 CFR Part 2 obligations on day one.

Each source is loaded as its own workstream. BytePad ingests it through pre-built connectors and standards-based paths for HL7, FHIR, X12 and free text, with schema validation and record-count reconciliation on every load and chain-of-custody preserved from extract to archive. Scanned consents and narrative notes become searchable through OCR and AI Global Search.

There is no single federal number. Hospital-based programs fall under the Medicare Conditions of Participation floor of at least 5 years (42 CFR 482.24), and state licensing rules are usually longer, commonly 5 to 10 years after discharge or last treatment, with longer periods for minors. Retention is therefore set per state and per record type; see hospital record retention by state or look up a state in the retention lookup tool.

Substance-use-disorder records keep their 42 CFR Part 2 consent and re-disclosure controls for as long as they are retained. Records under litigation hold, audit or open investigation must be excluded from disposition until the hold is released, so the archive has to enforce holds at the record level rather than by system. The disposition process itself is covered in defensible disposition of healthcare records.

Treat the archive as a production clinical system, not cold storage. The baseline is HITRUST r2, SOC 2 Type II and HIPAA Privacy and Security Rule alignment, with role-based and attribute-based access control, encryption in transit and at rest, and a tamper-evident audit log of every access and disposition decision. Behavioral-health archives add 42 CFR Part 2 consent and re-disclosure controls at the record level, so a user who can open a general medical record cannot automatically open an SUD record for the same patient.

Yes, when the archive is integrated with the active EHR. The common patterns are a Chart Review link into the archive viewer and a SMART on FHIR app embedded in Epic Hyperdrive that calls the archive's FHIR R4 endpoints; both are described in Epic integration for archived data. For behavioral-health content, the archive applies its own Part 2 controls on every retrieval, so the integration does not bypass consent rules that the legacy system enforced.