Part 2 Attorney General research-identity privilege

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.21 identifies administrative action under Controlled Substances Act section 502(c) and 21 CFR part 1316 as a research-identity protection that can coexist with Part 2. The operative implementing provision is 21 CFR 1316.23, where a qualifying researcher may petition the DEA Administrator for a grant of confidentiality. The grant is evidenced by an issued letter, not by the research topic alone.

Use the right federal route

Current 42 CFR 2.21 identifies the Attorney General authority alongside the HHS authority. Determine whether the research falls within the Controlled Substances Act route, which official acted, and which current implementing provisions and authorization govern.

Part 1316 has broader content

The cited 21 CFR part 1316 contains multiple administrative subparts. Identify the research-identity provisions rather than treating the entire part as one privilege. Counsel should validate project, controlled-substance scope, researcher, authorization, and conditions.

Maintain demand-ready evidence

Preserve the signed instrument, application, amendments, personnel, subject population, identifiers, dates, exceptions, legal contact, compulsory-demand workflow, Part 2 decision, response, disclosure history, and termination or extension evidence.

Establish eligibility for the DEA route

Section 1316.23 concerns a bona fide project directly related to enforcement of laws under the Attorney General's jurisdiction involving drugs or substances that are or may be controlled. The rule describes qualifying research funded wholly or partly by the Department of Justice and qualifying externally funded research of a nature the Attorney General would be authorized to conduct.

Record the legal basis, project purpose, protocol, principal investigator, qualifications, sites, funding, controlled-substance activity, registration if applicable, subject risks, protections, social risks, requested identifiers, and why confidentiality is necessary. Involve counsel and research compliance familiar with the exact DEA process.

Authenticate the grant letter and its limits

The petition itself is not the grant. The issued letter identifies the researcher, registration when applicable, project title and purpose, location, authority for people engaged in the research to withhold subject names and identifying characteristics, any limits, and the subjects to whom the perpetual protection pertains.

Preserve the signed letter, petition, protocol, agency correspondence, limits, amendments, project dates, personnel, subject population, identifiers, and completion letter. Map each person with identifying access to duties connected with the protected research. Do not substitute an HHS certificate, IRB approval, grant award, or DEA registration for the section 1316.23 instrument.

Keep confidentiality distinct from other permissions

The research-identity grant concerns compelled identification. Section 1316.24 separately addresses exemption from prosecution for certain researchers; the two should not be conflated. Part 2, consent, HIPAA, human-subject rules, state law, controlled-substance requirements, contracts, and institutional policy remain separate gates.

Voluntary data exchange, secondary use, collaborators, repositories, vendors, publication, audits, and incidents need their own authority and controls. Minimize identifying information, secure linkage keys, restrict roles, log access and exports, and verify recipients and purposes.

Prepare for demands and project completion

Centralize subpoenas, orders, testimony, agency demands, discovery, and informal requests. Preserve and time-stamp the demand, identify subject and data scope, authenticate the grant, analyze any limits, evaluate Part 2, and let authorized counsel determine objections, protective relief, response, or production.

Under section 1316.23, the researcher must notify the Administrator within 30 days after project completion; DEA then issues a closing letter with project dates, and the original grant is returned. Calendar and document that process while retaining a controlled copy and subject mapping needed to prove the perpetual protection described in the rule.

Audit active and completed projects for the issued letter, limits, covered personnel, participant timing, controlled identifiers, amendments, completion notice, closing letter, and demand procedure. Correct gaps while agency correspondence and project evidence remain available.

Example

Nine claimed authorizations reach review. Six identify the issuing authority, current instrument, research scope, covered people and subjects, dates, conditions, Part 2 analysis, and demand owner; three cite the statute alone. Readiness is 6 of 9 claims.

Attorney General route checklist

• confirm the project fits section 1316.23 and identify funding and controlled-substance scope;
• preserve the petition, protocol, issued grant letter, limits, correspondence, and registration;
• map researchers, personnel, sites, subjects, identifiers, duties, dates, and amendments;
• distinguish confidentiality from prosecution exemptions and all disclosure permissions;
• route every compulsory demand through grant, Part 2, and counsel review; and
• complete the 30-day project-close notice and preserve the closing history.

The DEA grant is not interchangeable with an HHS certificate. Use the authority and instrument actually issued for the qualifying project.