Compliance

42 CFR Part 2 and HIPAA, in plain language

This page explains the rules MASE designs around. It is not a legal opinion, a certification, or a promise that a survey will pass.

42 CFR Part 2

42 CFR Part 2 is the federal rule that limits disclosure of substance use disorder treatment records. It is stricter than a general medical record in who may receive the information and how consent works.

Health OS is the EMR MASE offers for behavioral health and opioid treatment programs. Workflows that change a controlled inventory count or override an alert are recorded, and an override requires a human e-signature. Those are product controls. They do not, by themselves, make a clinic compliant.

HIPAA

HIPAA is the federal rule for protected health information held by covered entities and their business associates. MASE treats clinical records as in-scope for that kind of agreement when a clinic uses Health OS for care. This marketing website is separate: its forms and /api/ask endpoint do not accept patient records. Do not type a name, date of birth, medication dose, or record number into them.

Decision support

Alerts are decision support. A person makes the clinical decision. Eva can handle crisis calls for MASE and Serenity Rehabilitation Center, and she does not e-sign an EMR override.

Where this is in use

MASE is live at Serenity Rehabilitation Center in Pontiac, Michigan, and at one practice in Texas. That is the published footprint. Accreditation, payer enrollment, and survey results are clinic-specific and are not stated as MASE statistics.

Questions about a business associate agreement go to info@mase.health or the contact page.