Part 2 deceased-patient cause-of-death disclosure

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.15(b)(1) says Part 2 does not restrict disclosure of patient-identifying information relating to a deceased patient's cause of death under laws requiring collection of death or other vital statistics or permitting inquiry into the cause of death. Paragraph (b)(2) keeps other identifying uses and disclosures subject to Part 2. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended framework.

The route needs a qualifying law

Current 42 CFR 2.15 identifies two legal paths. Record jurisdiction, statute or rule, official or agency, authority, decedent, inquiry, required fields, purpose, deadline, source records, information disclosed, and response.

Cause-of-death scope is narrower than the chart

Determine which facts relate to the cause-of-death collection or inquiry. Clinical history, unrelated treatment, family information, billing, communications, and complete notes may require a different Part 2 basis.

Death does not end every privacy duty

Verify state confidentiality, medical examiner or coroner law, HIPAA where applicable, personal-representative rights, autopsy and toxicology rules, law enforcement, court process, research, media, contracts, security, and retention separately.

Identify the qualifying law before selecting records

Preserve the current statute, regulation, order, official instructions, or other legal authority that requires vital-statistics collection or permits the cause-of-death inquiry. Record jurisdiction, agency or official, case, decedent, purpose, questions or required fields, deadline, and response method. A death certificate, obituary, official title, family request, subpoena, or general investigation does not by itself define the paragraph (b)(1) scope.

Authenticate the requester through an independent government directory or established channel. Verify credentials, case identifier, callback, delivery endpoint, amendments, and whether another official or clinical certifier must participate.

Connect each disclosed fact to cause of death

List requested elements and map each to the qualifying law and inquiry. Identify the authoritative source, clinical owner, accuracy status, and reason the fact relates to cause of death. Separate verified facts, professional opinions, preliminary results, and uncertainty.

Do not attach the complete SUD chart merely because some pages may be relevant. Treatment history, family information, another patient's data, billing, psychotherapy or counseling detail, unrelated diagnoses, and administrative communications require their own relevance and authority analysis.

Coordinate legal, privacy, and clinical roles

Privacy and counsel determine the disclosure route and scope. A medical examiner, coroner, physician, toxicologist, certifier, records custodian, or other qualified professional addresses questions within their role. Preserve authorship and avoid having administrative staff create clinical conclusions.

Review HIPAA where applicable, state confidentiality, medical-examiner or coroner law, autopsy and toxicology rules, mandatory reporting, court process, personal-representative rights, retention, and security separately. Paragraph (b)(1) removes a Part 2 restriction only within its terms.

Use a controlled response and correction path

Apply a hold, preserve originals, select responsive facts, obtain approval, transmit securely, confirm receipt, and log exact information, recipient, authority, purpose, time, and responder. Track rejected vital-statistics submissions, supplemental questions, testimony, corrected findings, and amended certificates as new events requiring review.

If excess information was sent, contain further access, preserve evidence, involve privacy and security, assess notice duties, request return or deletion when appropriate, and correct the workflow.

Keep family and estate requests on their own route

A family member or estate representative may want the same cause-of-death information for grief, benefits, probate, litigation, or personal understanding. That purpose does not automatically become a vital-statistics report or official inquiry. Verify personal-representative status, written consent requirements, court process, and other applicable law separately.

Use a neutral intake response while authority is unresolved. Explain generally which documents may be needed without confirming that the deceased person was a Part 2 patient. Track requester, claimed role, purpose, documents, deadline, reviewer, and outcome.

Before disclosure, ask which law qualifies, which official is authorized, which fact answers the death question, whether the information is verified, why a smaller response will not work, and how correction will occur. These questions should be answerable from the disclosure record.

Example

Twelve death-information requests are assessed. Nine have qualifying law, official, inquiry, purpose, field set, approval, and disclosure evidence; three seek the complete SUD file. Readiness is 9 of 12 requests.

Cause-of-death disclosure checklist

• preserve the current law requiring collection or permitting inquiry;
• authenticate the official, case, authority, questions, endpoint, and deadline;
• map every fact to cause of death and the authorized purpose;
• separate clinical, legal, privacy, records, and certifier roles;
• secure, confirm, and log the exact response and any correction; and
• use a separate Part 2 analysis for unrelated records or later requests.

Death alone does not open the chart. The qualifying law, official, purpose, facts, and scope determine whether paragraph (b)(1) applies.