Part 2 central registry definition

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The HHS Part 2 final-rule fact sheet confirms the February 16, 2026 compliance date for applicable 2024 changes. The published final rule provides the rulemaking record. Central-registry decisions also need the live definition and 42 CFR 2.34, which specifies when multiple-enrollment disclosures may occur, what information may be shared, and the limits on use.

The registry has a specific enrollment purpose

42 CFR 2.11 links the registry to withdrawal-management or maintenance-treatment applications and duplicate-enrollment prevention. Record the organization, member programs, states, services, purpose, authority, fields, matching logic, and dates.

Identity matching needs safeguards

Define permitted identifiers, normalization, false-match review, corrections, uncertain results, minimum access, disclosures, notifications, security, logs, incident response, retention, and disposition. A match should trigger the authorized workflow rather than an unsupported clinical or legal conclusion.

Program and registry roles remain separate

Verify each member program, cross-state participation, agreements, consent or exception path, and workforce responsibility. Map HIPAA, state prescription or treatment rules, and other applicable requirements separately.

Keep the registry tied to its defined purpose

A central registry obtains patient-identifying information from at least two member programs about applicants for withdrawal management or maintenance treatment to avoid concurrent enrollment. Record the registry legal entity, member programs, covered services, participating states, governing agreements, data fields, matching logic, and effective dates.

Do not use the label for a general health information exchange, prescription database, referral directory, or enterprise index without testing every definition element. If a system serves several purposes, separate the central-registry data, permissions, users, queries, and logs from unrelated functions.

Apply the section 2.34 disclosure limits

Section 2.34 permits specified disclosures at defined events, including acceptance for treatment and certain treatment changes or interruptions. It limits the information to patient identity, drug type and dosage, and relevant dates, and requires written consent that meets the section's stated conditions. Build those event, field, consent, and recipient constraints into the workflow.

The provision also addresses member inquiries and certain requests from non-member treating providers. Verify the requester, treating relationship when applicable, permitted purpose, exact response fields, and communication needed to correct an error or prevent multiple enrollment or improper prescribing. Avoid returning a full chart or using a match as a broad clinical conclusion.

Manage identity matching safely

Define normalized identifiers, confidence rules, manual review, false-positive handling, duplicate records, corrections, and uncertain matches. Show reviewers the source and strength of each match without exposing more information than needed. A probable match should pause the automated response and route to an authorized reviewer.

Track who queried, the member or provider involved, purpose, input identifiers, result, disclosed fields, resolution, and dates. Give patients and programs a secure correction route. Test access, monitoring, incident response, retention, backup, and termination controls.

Maintain member and state evidence

Verify that each member is a qualifying withdrawal-management or maintenance-treatment program and meets the state-relationship element. Preserve current agreements, program status, state participation, service dates, contacts, and reporting routes. Suspend exchange when evidence expires or a program leaves until the applicable continuation or disposition rules are reviewed.

Example

Twelve registry matches enter review. Nine have source, identifiers, member status, match evidence, and resolution; three lack a second-source check. Match completeness is 9 of 12.

Central-registry checklist

• document the registry, at least two current member programs, services, and state relationships;
• limit activity to the defined enrollment and coordinated-care purposes;
• enforce section 2.34 events, consent, data fields, recipients, and use limits;
• validate identity matches and route uncertain results for human review;
• log queries, responses, corrections, incidents, and membership changes; and
• recheck agreements, program status, and system behavior on a fixed schedule.

This definition does not authorize a specific query or disclosure. The exact consent, program, registry, requester, purpose, information, state law, and current Part 2 provision require qualified review.

A registry decision record should identify the inquiry, requesting member or treating provider, patient identifiers supplied, matching sources, confidence state, permitted purpose, consent, response fields, reviewer, date, and resolution. Record false matches and corrections as operational safety events, notify affected source systems, and verify that an erroneous response no longer appears in later queries. Report match quality with raw counts and denominators while keeping patient-identifying detail out of broadly shared dashboards.

Sample completed and unmatched queries during periodic review to confirm that the live response still follows the approved data and purpose limits.