Part 2 child-abuse reporting exception

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The live 42 CFR 2.12(c)(6) states that Part 2's use and disclosure restrictions do not apply to reporting under state law incidents of suspected child abuse and neglect to the appropriate state or local authorities. The state reporting rule supplies the reporter, threshold, timing, and channel. eCFR displays section 2.12 as current through August 20, 2026 and last amended August 13, 2026. The HHS fact sheet confirms the February 16, 2026 compliance date for the amended Part 2 framework.

State law defines the reporting duty

The Part 2 provision points to reporting under state law. Map who must report, the triggering threshold, timing, hotline or agency, required information, documentation, internal escalation, emergency action, and protections for the child for each jurisdiction.

Use the proper reporting channel

Verify the authority, contact route, reporter, time, information requested by the reporting process, confirmation or reference number, and follow-up instructions. A supervisor or privacy review should support rapid action without displacing an individual reporter's legal duty.

Maintain a jurisdiction-specific reporting map

For every state where the program serves patients or staff may encounter a child, document who must report, what suspicion threshold applies, how quickly the report must be made, which state or local authority receives it, required content, hotline and online routes, written follow-up, record-retention duties, and protections or penalties. Cite the current statute, regulation, and agency instructions with a review date.

Resolve cross-border care, telehealth, travel, tribal, military, and unclear-location cases in advance where possible. Give staff a 24-hour escalation path to a child-safety lead and counsel without making internal approval a prerequisite that delays an individual reporter's duty.

Respond to safety and reporting as linked tracks

Address immediate danger through emergency and clinical procedures while the mandated report proceeds. Identify the child, alleged conduct, available facts, location, alleged perpetrator if required, urgent risks, reporter, authority, time, and confirmation number. Separate firsthand observations, the child's words, information from others, and professional conclusions.

Use the official reporting channel and verify the recipient. Send only the information the state reporting process requires or otherwise supports. Do not copy a broad clinical record into a report merely because the authority may later request it.

Document without obstructing the duty

Preserve the report as made, hotline or agency confirmation, contemporaneous clinical and incident notes, safety actions, supervisor or counsel contact, and follow-up instructions. Avoid editing the original entry to reflect later facts; add dated corrections or supplements with authorship and source.

Track each later request, interview, family communication, treatment coordination, law-enforcement contact, subpoena, or proceeding separately. Apply Part 2, HIPAA, state privacy, professional, custody, minor-consent, and legal-process rules to that new event.

Example

Nine suspected-abuse reports are sampled. Eight have a state-law trigger, proper agency, timely report, information record, and reference number; one was sent only to an internal mailbox. Completion is 8 of 9 reports.

Close the report without closing later review

Record whether the reporting duty was met, when, by whom, through which authority, with what information, and with which confirmation. Document immediate safety action, failed contact attempts, agency instructions, required supplement, responsible owner, and next deadline. Keep internal consultation separate from the legally operative report.

If a report was late, misdirected, or incomplete, protect the child first, contact the correct authority, preserve the original event, and obtain qualified legal guidance on correction. Review whether the failure arose from training, unclear jurisdiction, missing after-hours coverage, technology, or inappropriate approval requirements.

Complete follow-up by testing the repaired path and retaining evidence. A revised policy alone does not prove that a reporter can reach the right authority promptly during a real event.

Child-abuse reporting checklist

• maintain current state-specific thresholds, reporters, timing, authority, and channels;
• make immediate child-safety and emergency routes easy to reach;
• verify the recipient and report the supported facts through the official process;
• preserve the report, confirmation, source, safety action, and later corrections;
• protect the original Part 2 record and review every follow-up request separately; and
• audit timeliness, completeness, failed contacts, and corrective training.

This exception does not define a state's reporting duty or authorize broad disclosure after the report. Current state law, the child's safety, record provenance, Part 2, and every later recipient and purpose require qualified clinical, privacy, and legal review.