Compliance for Recovery Centers

Yes. Substance use disorder treatment facilities and behavioral health programs are covered entities under HIPAA whenever they handle protected health information — which includes treatment records, intake assessments, insurance billing, and medication logs. Every employee who touches PHI, from counselors and case managers to billing staff and receptionists, is required to receive HIPAA training. Civil penalties reach up to $2.19 million per violation category per year. Criminal violations can result in up to 10 years in federal prison.

Yes, for any clinical staff with occupational exposure to blood or other potentially infectious materials. In rehab and recovery settings, this includes staff who administer medications, handle needles (including needle exchange or medication-assisted treatment programs), assist with wound care, or respond to client medical emergencies. OSHA's Bloodborne Pathogens standard (29 CFR 1910.1030) requires initial training at hire and annual retraining. Violations can result in fines up to $16,550 per citation, with willful violations reaching $165,514.

42 CFR Part 2 is a federal regulation that provides additional confidentiality protections for records from substance use disorder treatment programs that are federally assisted — meaning they receive any federal funding, including Medicare or Medicaid reimbursement, or operate under a DEA registration. Part 2 is stricter than HIPAA: it generally prohibits disclosure of SUD treatment records without patient consent, even to other treating providers. If your facility treats substance use disorders and receives any federal assistance, 42 CFR Part 2 almost certainly applies alongside HIPAA.

Yes. Free forever, for up to 25 team members. No credit card required.

Yes. Free forever, for up to 25 team members. No credit card required.

HIPAA requires training for all new employees and retraining whenever policies or procedures change. Most behavioral health facilities train annually to stay current and maintain audit-readiness. Staff turnover is high in recovery settings — Stampwell makes it easy to onboard new counselors, technicians, and administrative staff into compliance the same day they join.

OSHA (29 CFR 1910.1030) requires Bloodborne Pathogens training at the time of initial assignment and at least annually thereafter. New tasks with occupational exposure also trigger required retraining.

It depends on whether the facility qualifies as a covered entity — that is, whether it provides healthcare services and transmits health information electronically. Many sober living homes are not covered entities and are not directly subject to HIPAA. However, if a sober living home coordinates care with a treatment provider or handles insurance billing, those activities may bring HIPAA into play. When in doubt, consulting with a healthcare attorney is the right call.

CARF International and The Joint Commission are the two primary accreditation bodies for behavioral health and substance use disorder treatment programs. Both require documented evidence of staff training in HIPAA privacy and security as part of their accreditation standards. State licensing agencies typically impose similar requirements. Stampwell's audit log and certificates give surveyors timestamped proof on demand — no scrambling before an inspection.

Yes. Every Stampwell certificate is recorded twice: as a printable certificate for you and your team, and on the Stampwell certificate ledger. An auditor scans the QR code on the certificate and checks it against the ledger, so it can be independently verified and cannot be tampered with.

Yes. Stampwell automatically logs everything your compliance program produces: every training completion, every signed policy and employee attestation, and every officer appointment, all timestamped. You can demonstrate compliance during an HHS OCR HIPAA audit or an OSHA inspection, and your records are always ready to download.

Yes. KnowQo is now Stampwell. We renamed the company in 2026. Same team, same software, same free tier. Anything you have read about KnowQo HIPAA compliance software describes Stampwell.