Part 2 alternate-source request rule

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.13(b) keeps Part 2 restrictions in force even when the lawful holder believes the person seeking information has another means of obtaining it. Public records, another provider, a family member, social media, an employer, a payer, a court file, or the patient may supply related information without authorizing this holder's response. eCFR displays the provision as current through August 20, 2026 and last amended August 13, 2026. The HHS fact sheet confirms the February 16, 2026 compliance date.

Availability elsewhere changes no local duty

Current 42 CFR 2.13 covers a requester who has other means of obtaining the information. Record the local holder, source record, requester, proposed recipient, purpose, authority, information set, deadline, and response.

Keep each holder's decision separate

A payer, court, family member, hospital, school, employer, vendor, and Part 2 program can have different authority. Track sender, recipient, record source, disclosure basis, notice, redisclosure restriction, and later use for each movement.

Keep the local decision independent

Record the local holder, Part 2 source, patient named, requester, claimed alternate source, information sought, proposed purpose, authority, deadline, and response owner. Do not validate the alternate source, correct it, or compare it with the protected record before a permitted use or disclosure route is established.

Related public or outside information may be inaccurate, incomplete, about another person, or governed by different law. A public fact can also become more revealing when a program confirms its accuracy or adds treatment context.

Trace provenance for every copy

Map sender, recipient, record creator, source program, receipt route, consent or other authority, notice, system, purpose, date, copies, and later use. Distinguish an outside provider's own record from a Part 2 record it received, a court filing from the program's chart, and a patient's statement from the program's confirmation.

If the organization receives outside material, classify and secure that record separately. Avoid copying unverified claims into the clinical record or using them for treatment, payment, legal, employment, or safety decisions without the applicable verification and professional process.

Respond without confirming status

Authenticate and route the request through the same Part 2 gate used for any disclosure. When authority is missing or unresolved, use approved neutral language. Do not tell the requester to obtain the record elsewhere in a way that confirms which source or facility has it.

Preserve the request, alternate-source claim, response, decision, and follow-up. Investigate revealing responses, mismatched records, or imported inaccuracies through privacy, clinical, security, and correction procedures.

Example

Ten alternate-source claims are sampled. Eight have independent authority review, scoped response, neutral wording, and log evidence; two relied on a public post. Control completion is 8 of 10 claims.

Record the local holder's decision

Classify the request as supported by a named local Part 2 route, narrowed, answered neutrally, denied, or unresolved. State holder, source record, requester, alternate-source claim, patient named, purpose, authority, data, deadline, decision-maker, and exact response. Keep the conclusion tied to this holder and action.

If outside material enters the organization, record its source, creator, receipt route, verification status, system, users, purpose, retention, and relationship to the protected record. Mark disputed or unverified content so it is not silently treated as clinical or legal fact.

For a revealing or inaccurate response, preserve evidence, contain further handling, notify privacy and appropriate clinical or legal owners, correct recipients and systems as directed, and complete incident review.

Test the process with public social media, a court file, a family statement, and another provider's record. Confirm that staff neither validate the outside source nor disclose local status.

Alternate-source request checklist

• identify the local holder, protected source, requester, claim, purpose, and deadline;
• avoid validating, correcting, comparing, or elaborating on outside information;
• track provenance, authority, notice, copies, systems, and later use for every record;
• classify imported outside material without merging it into protected source facts;
• use a neutral response when local disclosure authority is missing or unresolved; and
• preserve and correct inaccurate or revealing handling with documented follow-up.

Another possible source does not change this holder's Part 2 duties. Current authority, provenance, identifiability, state law, recipient, purpose, and exact response need qualified privacy and legal review.