Part 2 deceased-patient continuing protection

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.15(b)(2) says any use or disclosure identifying a deceased patient as having an SUD, other than the qualifying cause-of-death routes in paragraph (b)(1), remains subject to Part 2. When written consent is required, the personal representative may give it. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended framework.

The cause-of-death route is limited

Current 42 CFR 2.15 preserves Part 2 for any other identifying use or disclosure. Classify the requester, recipient, relationship, purpose, record, source, patient status, legal process, consent need, and applicable exception.

Personal representatives have defined authority

Verify who qualifies under applicable law, the appointment or priority, scope, restrictions, duration, conflict, and requested action. Family relationship, executor nomination, obituary contact, payer status, or possession of records may prove something different.

Systems should retain post-death controls

Update patient status without removing access limits, notices, audit history, disclosure rules, legal holds, incident routing, retention, amendment, secure destruction, and vendor controls. Review automated portal, billing, directory, and marketing flows.

Triage every post-death request by purpose

Record requester, verified identity, relationship, claimed authority, recipient, purpose, information, dates, patient status, legal documents, deadline, and proposed delivery. Classify vital statistics, cause-of-death inquiry, personal-representative consent, court process, family access, estate administration, payment, litigation, research, public records, media, provider contact, memorial, or another use.

Do not confirm the person received SUD services while asking for missing authority. A death certificate, obituary, family relationship, executor nomination, insurance role, possession of a portal credential, or prior involvement may establish facts without authorizing the requested disclosure.

Verify the applicable Part 2 route

For paragraph (b)(1), preserve the law requiring vital-statistics collection or permitting cause-of-death inquiry and limit the response accordingly. For written consent, authenticate the personal representative under applicable law and complete the current consent requirements. Court orders, proceedings, research, audits, and other uses must satisfy their own routes.

Review HIPAA where applicable, state confidentiality, estate and probate law, medical-examiner or coroner law, contracts, record ownership, retention, legal holds, professional duties, and security separately. A Part 2 permission does not settle every other rule.

Preserve controls after the death indicator changes

Keep role-based access, confidential flags, consent and revocation history, accounting or disclosure logs, legal holds, amendment history, retention, destruction, incident response, and vendor restrictions. Disable inappropriate portal proxies, family notifications, appointment reminders, marketing, surveys, directory listings, and routine outreach without erasing evidence.

Review billing, collections, payer, quality, research, export, backup, data warehouse, training, and test environments. A post-death workflow should not copy SUD information into a less protected system.

Handle family and estate communication carefully

Use neutral scripts and a secure document-intake route. Explain generally which proof may be required without stating whether a record exists. When authority is verified, limit information to the consent or other applicable route and document what was provided.

If multiple people claim authority, an estate is disputed, or disclosure may create harm, pause and use qualified estates and privacy counsel. Track deadlines and preserve records while the dispute is resolved.

Maintain a post-death decision register

For every request, record requester, identity verification, claimed and verified authority, purpose, recipient, information, Part 2 route, other law, approval, disclosure, date, and follow-up. Link cause-of-death reports, personal-representative consents, court matters, research decisions, billing events, and denials without merging their authorities.

Use the register to find repeat requests, conflicting representatives, reopened estates, disclosures to the same recipient for different purposes, and systems still sending automated messages. Restrict access because the register itself may reveal protected status.

Families and representatives can ask what proof is required, which law governs, what information may be provided, whether a narrower record meets the need, how long review takes, and who can address a dispute. Answer generally until identity and authority are established.

Example

Fourteen post-death requests are assessed. Ten have requester authority, purpose, Part 2 route, scope, approval, delivery, and log evidence; four rely on kinship. Readiness is 10 of 14 requests.

Continuing-protection checklist

• triage requester, authority, purpose, information, recipient, and deadline;
• avoid confirming SUD treatment while authority remains unresolved;
• apply the precise cause-of-death, consent, court, research, or other route;
• keep access, consent, audit, hold, retention, incident, and vendor controls active;
• disable inappropriate automation without deleting evidence; and
• narrow, secure, log, and reassess every post-death disclosure.

Death changes some authority questions, but it does not generally remove Part 2 protection from identifying SUD information.