Part 2 child-abuse original-record protection

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The final sentence of live 42 CFR 2.12(c)(6) expressly keeps Part 2 restrictions on the original SUD patient records maintained by the program, including their use and disclosure in civil or criminal proceedings arising from the child-abuse or neglect report. Current section 2.31(d) also requires proceeding consent to remain separate from consent for another purpose. eCFR displays Title 42 as current through August 20, 2026 and last amended August 13, 2026. The HHS fact sheet confirms the February 16, 2026 compliance date.

The report and source record are separate

Current 42 CFR 2.12 permits the state-law report and preserves restrictions on the original records. Store the report event, source records, disclosure log, authority, recipient, and later requests as distinct objects with role-limited access.

Later proceedings need a fresh legal review

Route subpoenas, warrants, agency requests, testimony demands, discovery, record-access requests, and law-enforcement follow-up to the designated privacy and legal owners. Track patient consent, any required Part 2 court order, scope, dates, notice, objections, and production record.

Preserve accuracy and provenance

Retain the report as sent, confirmation, contemporaneous notes, original clinical record, later corrections, authorship, timestamps, access history, and legal holds. Avoid copying the full SUD record into a broadly accessible incident system.

Separate the reporting event from the clinical source

Create a report record containing the state-law basis, reporter, authority, facts communicated, time, confirmation, and required follow-up. Link it to the relevant clinical source without copying the full chart into a broadly accessible incident, legal, or child-safety system. Keep record provenance, authorship, date, access controls, and retention intact.

The report may contain information drawn from the record, but the exception does not open the original record. Mark which artifact is the report, which is the Part 2 source, and which later document was created by another authority. Preserve those boundaries in exports, scans, litigation systems, and health-information exchanges.

Build a new gate for every later demand

Route subpoenas, warrants, court orders, discovery, testimony, interviews, agency follow-up, law-enforcement requests, parent or guardian access, and expert review to privacy and experienced counsel. Authenticate the requester and record the proceeding, target, purpose, requested records, date range, deadline, consent, proposed Part 2 order, notice, objections, decision, and approver.

Lawful reporting and lawful receipt of the report do not establish authority to use or disclose the original record in a proceeding. If consent is proposed, verify the current elements and the separate-proceeding rule in section 2.31(d). If a court order is proposed, verify the applicable Part 2 subpart rather than relying on a general subpoena or state-law demand.

Preserve evidence and prevent overproduction

Apply a legal hold without broadening access. Collect from the authoritative source, deduplicate carefully, review attachments and metadata, segregate unrelated patients and periods, redact or withhold as directed, and keep a production index showing what was sent, to whom, when, under which authority, and by which secure route.

Train records, clinical, child-safety, legal, and IT teams to recognize that an earlier mandated report is not a blanket production basis. Test subpoenas and portal requests with tabletop exercises and document corrective actions.

Example

Eleven post-report requests are reviewed. Eight have a verified requester, authority, scope, responsive-record set, and approval; three rely only on the earlier child-protection report. Release readiness is 8 of 11 requests.

Record the request outcome

Classify each later demand as approved under named authority, narrowed, objected to, denied, or pending qualified review. State the original record, report relationship, proceeding, target, scope, deadline, decision-maker, and next action. Keep unresolved records restricted and preserve every version exchanged with requester, counsel, or court.

After production, verify receipt, restrictions, correction route, retained copies, and the production index. A later supplemental request starts a new scope review.

Original-record protection checklist

• keep the state-law report and original Part 2 record as distinct artifacts;
• preserve provenance, access history, corrections, and the report confirmation;
• authenticate every later requester, proceeding, target, purpose, and scope;
• verify separate Part 2 consent or the applicable court-order requirements;
• minimize and log any approved production, including withheld or redacted material; and
• train and test staff against the assumption that reporting opened the chart.

This protection does not prevent the required child-safety report or determine the outcome of a later legal request. Current Part 2, state reporting law, court rules, custody and minor law, HIPAA, and the specific demand need qualified review.