Part 2 crime-on-premises communication

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The live 42 CFR 2.12(c)(5) removes Part 2's use and disclosure restrictions from a narrowly defined communication by Part 2 program personnel to law-enforcement agencies or officials. The communication must relate directly to a patient's crime on program premises, crime against program personnel, or threat to commit such a crime, and it is limited to the circumstances listed in the provision. eCFR displays the section as current through August 20, 2026 and last amended August 13, 2026. The HHS fact sheet confirms the February 16, 2026 compliance date for the 2024 amendments.

The trigger and recipient are specific

The current 42 CFR 2.12 exception identifies who may communicate, who may receive the communication, and which incident qualifies. Record the location, personnel relationship, conduct or threat, time, reporter, law-enforcement recipient, and decision authority.

The information boundary is narrow

The rule limits the communication to incident circumstances, including the person's patient status, name, address, and last known whereabouts. Build an incident-specific release checklist and route requests for records, history, diagnoses, notes, or treatment detail through a separate Part 2 analysis.

Safety response continues in parallel

Follow emergency, medical, workplace-safety, mandated-reporting, and evidence-preservation procedures that apply. Preserve the original clinical and incident records, disclosure log, exact information sent, recipient, time, method, and any later legal demand.

Confirm the incident fits the trigger

Record what occurred or was threatened, who was involved, where it occurred, the relationship to program premises or personnel, the time, available contemporaneous evidence, and who made the initial safety decision. Keep observed facts, reported statements, clinical impressions, and later conclusions distinct.

The route is not a general exception for disruptive conduct, off-site crime, past criminal history, suspected possession unrelated to the qualifying incident, or a broad safety concern. An urgent event may require emergency, workplace-safety, clinical, or other action in parallel, but each additional disclosure needs its own supported basis.

Keep the communication within the listed boundary

Section 2.12 limits the content to the circumstances of the incident, including patient status, name, address, and last known whereabouts. Create an approved incident form or script that captures only the supported facts. Avoid attaching a chart, assessment, medication list, progress notes, diagnoses, unrelated history, contacts, or a patient roster.

Authenticate the law-enforcement recipient through an independent route. Record the agency, official, callback or badge information, reporter, fields communicated, purpose, date, method, incident number, and any response. Preserve the exact version or contemporaneous account of an oral communication.

Separate follow-up requests

A later request for interviews, video, records, testimony, search, subpoena compliance, or evidence should enter a new privacy and legal review. Preserve the request, patient and program status, requested data, legal instrument, deadline, scope, objections, consent or court-order analysis, decision, and production log.

After the immediate event, contain access, protect clinical and incident files, conduct any required security or workplace review, correct inaccurate disclosures, and support affected staff and patients. Train front-desk, clinical, security, on-call, and management personnel on the rapid route and the point at which counsel must take over.

Example

Ten law-enforcement contacts are reviewed. Seven identify a qualifying incident, authorized reporter, permitted data, recipient, and disclosure record; three include unrelated treatment history. Readiness is 7 of 10 contacts.

Record an incident-specific decision

Classify each contact as supported by the narrow route, narrowed before communication, handled under another identified authority, denied, or escalated. Name the qualifying conduct, permitted fields, recipient, decision-maker, reporter, time, and follow-up owner. For an urgent oral contact, complete the record promptly after safety permits.

Review any excessive contact for containment, recipient follow-up, correction, incident analysis, and retraining. Verify the fix with a later tabletop or sample rather than closing on a policy reminder.

Crime-communication checklist

• document the qualifying crime or threat, location, personnel relationship, and time;
• use authorized program personnel and authenticate the law-enforcement recipient;
• limit content to incident circumstances and the specific listed identifying details;
• keep clinical history, records, testimony, and later evidence requests behind a new gate;
• preserve the exact communication, recipient, method, incident number, and follow-up; and
• test the response path in training and correct any excessive disclosure.

This route does not authorize a general law-enforcement investigation or release of the patient's record. Incident facts, immediate safety needs, current Part 2 provisions, state law, and later legal demands require separate qualified review.