Part 2 criminal-justice official-duty limit

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The duty and matter define scope

42 CFR 2.35 ties permitted use and redisclosure to official duties regarding the same conditional release or action. Record the matter, monitoring responsibility, information supplied, authorized purpose, receiving person, and downstream handling expectation.

Translate the official duty into a concrete monitoring question. Determine whether the recipient needs attendance, participation, progress, completion, test results, incidents, or another defined element. A request for the full chart, counseling notes, unrelated episodes, family information, or all future records needs separate scope and authority analysis.

Preserve the condition or order, recipient assignment, consent, approved report content, dates, and communication of the limit. Staff should be able to explain why every element relates to the covered duty without speculating about the recipient's broader interests.

Recipient access should remain role limited

Send information to the verified official or approved secure destination. Avoid broad group mailboxes, unrestricted case folders, or copied recipients whose need has not been established. Confirm changes in assignment and terminate obsolete access where the delivery system permits control.

Use case-specific access, least-privilege roles, secure transfer, expiration, download or forwarding controls where supported, and recipient confirmation. Shared agency systems need a documented review of who can see the information and why. A correctly addressed email can still create overbroad access through a distribution group or shared drive.

At transfer, completion, leave, reassignment, or final disposition, remove obsolete destinations and stop scheduled reports until the new facts are validated. Preserve historical assignment without granting current access.

Communicate and track the boundary

Include current Part 2 accompanying materials and a clear official-duty instruction under approved policy. Record recipient questions, requested forwarding, secondary use, changed matter, and response. An acknowledgment may support training, but it does not replace recipient qualification or technical controls.

Keep reports tagged to the matter and consent without placing Part 2 status in unsafe filenames or broad task descriptions. Maintain a recipient-visible contact for questions before use outside the understood monitoring function.

A new purpose needs a new analysis

A request tied to prosecution, another investigation, media, research, personnel action, or general intelligence may fall outside the official-duty limit. Hold the action and route the facts through the designated Part 2 privacy and legal process.

The same applies to new charges, testimony, discovery, immigration, licensing, child-welfare, benefits, or employment action. Similar facts or the same agency do not make the new purpose part of the original conditional release. Preserve the request and do not let urgency become authority.

Detect and respond to downstream drift

Review access logs, forwarded messages, added recipients, copied reports, case-folder permissions, downstream exports, and requests for different fields. Compare activity with the documented duty. Seek recipient cooperation and legal direction when program controls cannot directly remove a copy.

If information was used or redisclosed outside the supported duty, contain access where feasible, preserve evidence, identify recipients and decisions, and route privacy, security, legal, clinical, and patient communication actions. Review other matters using the same agency workflow.

Assign the response an accountable owner, documented next action, prompt review deadline, and escalation route.

Example with downstream requests

Ten downstream-use requests are reviewed. Seven concern documented monitoring duties for the same action; three involve unrelated agency work. Official-duty fit is 7 of 10 requests.

The program approves only the seven supported uses and refers the remaining requests to the designated legal process. It removes one broad case-folder group, confirms the current monitoring officials, and checks prior reports for the same access pattern.

Official-duty checklist

• Connect every use or redisclosure to one matter and monitoring duty.
• Select only information needed for the defined question.
• Verify recipients, shared-system access, and secure destinations.
• Stop old access on transfer, reassignment, completion, or disposition.
• Communicate current Part 2 boundaries and a question route.
• Hold investigation, testimony, research, employment, and other new purposes.
• Investigate downstream drift and related agency workflows.

Owner controls

The 2024 final rule supplies current context. Use purpose-coded disclosures, recipient attestations where appropriate, secure channels, access limits, matter changes, redisclosure review, incident routing, and audits.

Monitor report content, recipients, shared destinations, access changes, secondary-use requests, stopped accounts, forwarding, incidents, and corrections. Audit from each recipient action back to the same official duty and from active matters into least-privilege evidence. Retest after agency, assignment, platform, consent, or reporting changes.