Part 2 120-day court-order application window

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.66(a)(3) requires a discovery-based court-order application within a reasonable period and no later than 120 days after the investigative agency discovers it received Part 2 records. The 120 days are an outer boundary, not an automatic filing schedule. Security and the immediate stop on use and disclosure begin at discovery.

The clock begins with discovery

42 CFR 2.66 ties the period to the agency's discovery that it received Part 2 records. Define how actual discovery is recorded and how reasonable diligence, alerts, counsel notification, holidays, appeals, and multiple data sets affect the timeline.

One hundred twenty days is a ceiling

Do not schedule the application automatically for day 120. Counsel should determine the reasonable filing date from the facts, court procedure, containment status, source, record volume, investigation, and evidence needed. Use an earlier internal deadline with escalation before missed milestones.

No-use controls continue during the period

The agency immediately ceases use and disclosure while it seeks an order. Map copies, derivatives, searches, reports, notes, testimony, models, shared folders, backups, and users. Prevent investigative work from continuing under a “pending legal review” label.

Support the start date

Document the first verified recognition that the agency had received Part 2 records, who recognized them, the evidence supporting that conclusion, and when counsel and control owners were notified. Preserve source messages, access logs, alerts, request history, and dataset details. Resolve uncertain or competing dates promptly with qualified counsel.

Separate later-discovered datasets, copies, or sources only when the facts support a distinct discovery event. Avoid resetting an existing clock through reclassification or transfer.

Set two deadlines

Counsel determines what reasonable timing means for the matter. Set an earlier internal filing or disposition deadline based on containment, volume, provenance, court procedure, evidence development, and risks. Independently calculate and record the 120-day ceiling, including the calendar convention and approval owner.

Use milestone alerts for jurisdiction review, diligence evidence, application drafting, factual declarations, proposed order, filing, and proof. Escalate delay before either deadline is threatened.

Maintain the no-use environment

Keep primary records and derivatives secured while the agency evaluates the path. Block searches, investigative analysis, referrals, reports, testimony, automated tools, external production, and public use. Review access logs and new copies throughout the period rather than treating the initial lock as sufficient.

The 2024 final rule created this discovery pathway. Local filing practice cannot suspend the federal security and no-use controls.

Record the outcome

Preserve the filed application, filing timestamp, accepted docket, entered order, denial, appeal status, withdrawal, lawful return, destruction, and every extension or correction. Filing by the ceiling does not permit use before the court enters a compliant order and valid process is satisfied.

If the agency does not apply, complete return or destruction within a reasonable period and no later than 120 days. A finally rejected application triggers immediate return or destruction after court notice.

Handle related datasets and court outcomes

Maintain a separate row for each supported discovery event, source, record set, and disposition while linking related matters. A single case can contain clocks with different evidence and deadlines. Track withdrawal, rejection, reconsideration, and appeal without assuming that litigation pauses security or no-use duties. When rejection is no longer appealable, switch the affected records immediately to the return-or-destroy workflow and verify the trigger date.

Require a second person to verify every start date, ceiling, filing receipt, and final-disposition trigger.

Example with deadline tracking

Seven discovered-record matters enter the tracker. Six have a verified discovery date, reasonable internal deadline, 120-day ceiling, and disposition owner; one lacks a supported start event. Clock readiness is 6 of 7 matters.

Owner controls

The 2024 final rule supplies current timing. Use discovery evidence, dual deadlines, automatic escalation, use-and-disclosure holds, copy inventories, filing proof, court outcomes, and disposition confirmation.

120-day-control checklist

• verify and preserve the discovery event and supporting evidence;
• calculate an earlier reasonable deadline and the separate 120-day ceiling;
• assign milestones, owners, escalation dates, and filing proof;
• keep records, derivatives, systems, and people under no-use controls;
• distinguish filing from court authorization and compulsory process; and
• document the order, appeal, return, destruction, or other final outcome.

The safest tracker shows both time duties and the continuing use restriction. A countdown alone cannot demonstrate compliance.