Part 2 60-day diligence window

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.3(b)(1)(v) requires all listed reasonable-diligence actions within a reasonable period, no more than 60 days before the records request, subpoena, other demand, or undercover-agent or informant placement. Sixty days is the outer boundary. The reasonable period may be shorter when provider or action facts change.

The endpoint is the investigative action

42 CFR 2.3 measures timing before the demand or placement. Record the planned and actual event dates, each diligence-action date, calculated age, time zone, owner, and any rescheduling.

Every listed action needs current evidence

A recent website check does not refresh an older locator or notice review. Track SAMHSA, state, provider-site, and notice actions separately. Use the oldest required completed action when testing full-package freshness.

Reasonable timing can be shorter

Set internal review periods based on source volatility, changed facts, high-risk ambiguity, and court or agency workflow. Refresh after a material change or when the event moves beyond the supported window.

Define the investigative endpoint

Record the exact request, subpoena, other demand, or on-site placement, its target provider and site, planned execution date, matter owner, and counsel. Distinguish draft date, approval, issuance, service, delivery, and actual placement. Select the endpoint required by the live facts rather than an administrative milestone chosen for convenience.

Link multiple demands or placements separately when their dates, sites, or entities differ.

Date every diligence action

Capture the SAMHSA locator search, available state database search, provider website or physical-location check, and available Patient Notice or HIPAA Notice of Privacy Practices review. Record completion time, source, provider identity, reviewer, saved evidence, and result for each. The sequence is only as current as its oldest required action.

Use a tracker that calculates age and prevents an expired action from being overlooked inside a combined memorandum.

Apply reasonable timing

Set an internal freshness expectation based on provider change risk, evidence conflict, service volatility, rebranding, acquisition, new locations, notice revisions, and the investigative action. A result can become stale before day 60. Refresh any source affected by material new information and document why the update was needed.

The outer boundary does not convert old evidence into reasonable diligence when current facts have changed.

Handle delays and rescheduling

When the demand or placement moves, recalculate every action. Pause issuance, service, credential activation, or on-site activity until expired checks are refreshed and counsel reapproves the record. Preserve the original and refreshed evidence rather than overwriting dates. For rolling demands or multiple sites, create separate expiry logic.

Do not backdate screenshots or rely on an undated browser tab. The evidence should reproduce what was known at the relevant time.

Verify the final gate

Before action, a second person should confirm provider and site match, all listed checks, applicable availability, source dates, result conflicts, the reasonable-period analysis, and the no-more-than-60-day limit. Link approval to the final instrument or placement plan and retain it with the matter.

If the record suggests Part 2 applies, follow the correct authority and safeguards. Timely diligence does not itself permit access or disclosure.

Build system-enforced expiry

Store each source check as a separate dated record rather than one free-text completion date. Calculate reasonable-review and outer-limit status against the final action date. Block service, credential activation, or on-site start when any required item is missing, expired, or tied to another provider. Allow overrides only through documented counsel approval and corrective action.

Audit clock calculations around month length, time zones, amended service dates, delayed placements, and cloned matters. Retain the formula and source timestamps so a reviewer can reproduce the result without patient data.

Test alert delivery and backup ownership.

Example and controls

Twelve diligence packages support planned demands. Ten keep every applicable action within the approved window; two contain one expired source. Package readiness is 10 of 12, with both expired packages held.

Sixty-day-window checklist

• identify the exact demand, service, or on-site placement endpoint;
• date and preserve every listed diligence action separately;
• calculate freshness from the oldest applicable required check;
• refresh earlier when provider or investigative facts materially change;
• recalculate after delay, rescheduling, new site, or rolling activity; and
• use independent final review tied to the exact approved action.

A defensible clock is source-specific and event-specific. One recent search cannot refresh the rest of the diligence sequence.