Part 2 concurrent research-privilege coverage

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.21 recognizes that Part 2 can operate concurrently with administrative action under two research-identity authorities: the HHS route associated with 42 CFR part 2a and the Attorney General route implemented in 21 CFR part 1316. Part 2 restricts covered patient-information uses and disclosures, while an applicable research grant or certificate protects authorized researchers from compelled identification of covered subjects.

The protections answer different questions

Current 42 CFR 2.21 distinguishes Part 2's use-and-disclosure restrictions from research privilege against compulsion. Record the Part 2 program and record analysis separately from the research project, subject, authorization, covered people, identifiers, effective period, and proceeding.

Coverage must be proven

The HHS regulations in 42 CFR part 2a describe a research-identity authorization framework, project scope, applications, effects, exceptions, and termination. Other statutory certificate regimes may also exist. Counsel should identify the exact authority controlling the project.

Route demands through both layers

Preserve the demand, issuer, jurisdiction, deadline, records, subject cohort, certificate or authorization, Part 2 pathway, objections, consent, exceptions, court process, response, and later use. One layer's permission does not erase the other layer.

Prove each layer independently

For Part 2, document the program, holder, patient records, disclosure or use, purpose, recipient, consent or other pathway, minimum information, and later-use limits. For research protection, preserve the actual certificate, grant letter, or other administrative instrument, issuing authority, project, protocol, investigators and covered personnel, subjects, identifying characteristics, effective period, amendments, conditions, exceptions, and termination history.

Funding, IRB approval, a protocol number, research consent, or a generic certificate reference does not prove either layer. Match the person seeking protection and the subject whose identity is requested to the operative instrument.

Keep the legal functions separate

Part 2 analysis is required for voluntary exchange, research access, repositories, vendors, collaborators, publications, audits, and legal process involving covered patient information. Research privilege analysis focuses on whether a covered person may be compelled in a proceeding to identify covered subjects. One favorable conclusion does not erase a condition, prohibition, or exception in the other framework.

Other rules may also apply, including human-subject protections, HIPAA, state law, contracts, data-use agreements, institutional policy, and newer certificate regimes. Maintain a source-specific matrix instead of treating “research confidentiality” as a single control.

Govern people, data, and lifecycle changes

Keep a current list of personnel whose duties give them access to identifying information and evidence that each person is connected with the protected project. Map direct identifiers, indirect identifying characteristics, coded data, linkage keys, source records, extracts, backups, derived files, correspondence, and testimony. Apply role access, training, confidentiality obligations, secure transfer, logging, incident response, and offboarding.

Review site additions, personnel changes, protocol amendments, new data sources, expanded aims, renewed dates, project completion, repository transfer, and secondary research before assuming protection continues. The HHS and Attorney General routes have different instruments and lifecycle rules.

Route legal process through both reviews

Centralize subpoenas, orders, warrants, testimony requests, interrogatories, agency demands, and informal requests. Preserve the request and records, restrict circulation, calendar deadlines, identify subjects and data, authenticate the protection, test exceptions, analyze Part 2, and let authorized counsel decide objections, notice, protective relief, testimony, or production.

Avoid confirming subject participation before review. If a production is authorized, document why, limit it to the approved scope, verify the recipient and secure method, and preserve what left and any use or sealing conditions.

Audit concurrent coverage

Sample projects and demands for both analyses, current instruments, personnel and subject matching, source versions, exception review, approved responses, and closure. Correct access, training, project records, or legal-process controls when a claimed protection cannot be proven.

Example

Twelve research disclosure demands are classified. Nine have Part 2 status, project and subject scope, privilege evidence, effective dates, authorized holder, counsel decision, response, and closure; three cite only a grant number. Readiness is 9 of 12 demands.

Concurrent-coverage checklist

• establish Part 2 status, purpose, recipient, pathway, scope, and later-use conditions;
• authenticate the specific HHS or Attorney General research instrument and authority;
• map projects, people, subjects, identifiers, dates, amendments, and exceptions;
• keep Part 2, research privilege, human-subject, HIPAA, state, and contract gates distinct;
• centralize legal process and require counsel-approved objections or production; and
• retest personnel, protocol, site, data, secondary-use, and lifecycle changes.

Concurrent protection means two supported analyses apply to the same facts. It is not a single combined permission or a label attached to the project.