> ## Documentation Index > Fetch the complete documentation index at: https://docs.encoreos.io/llms.txt > Use this file to discover all available pages before exploring further. # Trust & Compliance > How Encore OS approaches HIPAA, SOC 2 Type II, and 42 CFR Part 2 — regulatory posture, module compliance trackers, ONC certification, and audit evidence. Encore OS is built for regulated behavioral-health operations. Every module, integration, and audit trail is designed against three frameworks from day one: Administrative, physical, and technical safeguards for ePHI across every workflow. Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. Heightened protections for substance use disorder records, with application-level consent and SUD tagging built in. ## Start here Platform-wide regulatory compliance status across all applicable frameworks. How protected health information is classified, tagged, and handled. Part 2 consent gating and DS4P labeling for substance use disorder records. The external regulatory sources our compliance documentation is grounded in. ## Module compliance trackers Per-module trackers map each domain's regulatory obligations to implementation status: FLSA, FMLA, ERISA, COBRA, ACA, I-9, OSHA, EEOC, and credentialing. IRS, GAAP/FASB, grant/OMB requirements, and internal controls. DHS licensure, NARR standards, Fair Housing, fire safety, and zoning. CARF, Joint Commission, HEDIS, NOMs, incident reporting, and nonprofit governance. HIPAA Security Rule, HITECH, NIST CSF, CIS Controls, and breach notification. CAN-SPAM, TCPA, call recording, and telemarketing rules. FCRA background-check and TCPA messaging compliance. ## ONC certification The path to ONC Health IT certification. Current criteria gaps and their status. Implementation plan for regulatory readiness. ## Audit evidence Per-feature [compliance evidence packages](/compliance/evidence/index) tie specific implementations to specific regulatory requirements; they are used during audits and accreditation surveys. For day-to-day governance operations — policy library, accreditation cycles, audits, risk register, and training — see the [Governance & Compliance module](/gr/overview).