Part 2 direct-administrative-control communication

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The live 42 CFR 2.12(c)(3) addresses need-based communication between a Part 2 program and an entity that has direct administrative control over it. Section 2.12(d)(2)(i)(B) separately applies Part 2 restrictions to that controlling person for information received through this route. eCFR displays the section as current through August 20, 2026 and last amended August 13, 2026. The HHS fact sheet confirms the February 16, 2026 compliance date for the amended rule.

Direct control needs governance evidence

42 CFR 2.12 identifies the relationship. Record the program, controlling entity, organizational chart, bylaws or agreement, delegated authority, reporting line, effective dates, personnel, duties, and information.

Ownership and administrative control differ

A parent, investor, management company, affiliate, landlord, vendor, or payer may lack direct administrative control. Qualified counsel should classify complex ownership, MSO, joint-venture, government, and delegated structures.

Need remains person- and duty-specific

Apply role access, purpose limitation, minimum data, secure channels, logs, workforce rules, termination, incident response, HIPAA, state law, contracts, and professional duties. Recheck after reorganization.

Prove the direct-control relationship

Identify the exact program and controlling entity. Retain current bylaws, operating or management agreements, delegations, board authority, reporting structure, appointment powers, budgets, policies, and effective dates that show direct administrative control. Describe the actual powers instead of relying on “parent,” “owner,” or “manager.”

Map intermediate entities, joint ventures, government units, professional corporations, management-service organizations, investors, sponsors, and affiliates. Shared ownership, branding, premises, payroll, technology, or vendors may exist without the required control relationship. Send complex or divided authority to experienced counsel.

Require need for each recipient

List the personnel within the controlling entity who need information for duties arising from the program's SUD diagnosis, treatment, or referral. Record role, assigned task, patient or cohort, information, purpose, frequency, system, approval, and end date. Governance authority does not establish a need for identifiable clinical details.

Configure least-role access, secure transfer, recipient verification, export limits, logs, termination, and incident escalation. Use de-identified or aggregated information when it satisfies the task. Review service accounts, shared mailboxes, board materials, executive dashboards, legal files, and analytics separately.

Govern the recipient and later use

Because section 2.12(d) applies restrictions to direct-administrative-control recipients, document how the controlling entity protects, uses, rediscloses, retains, and disposes of the information. Train recipients, route legal demands, investigate improper access, and keep the communication and resulting action reviewable.

Reassess after a merger, acquisition, governance amendment, delegation, new manager, site transfer, service change, restructuring, or recipient-duty change. Preserve prior diagrams and decisions for records and communications from older configurations.

Example

Eight cross-entity flows are reviewed. Six have direct-control, duty, need, data, and recipient evidence; two rely on shared ownership. Readiness is 6 of 8 flows.

Decide at the flow level

For every communication, record one result: administrative-control route supported, internal-program route applies instead, another authority is required, or the request is unresolved. Cite governance evidence, recipient duty, data need, program and period, reviewer, and next review. Do not convert a relationship-level conclusion into unrestricted access.

Approved flows should state fields, patient or cohort scope, frequency, system, transmission, allowed use, retention, and exit condition. Denied or narrowed requests need a safe response and escalation route. Unresolved flows should remain restricted while governance or legal evidence is obtained.

Verify the live implementation using a test account and a recent communication. Inspect inherited groups, dashboards, shared drives, board packets, exports, email forwarding, support impersonation, and integrations. Compare logs with the approved recipient list.

If the controlling entity changes, terminate obsolete access before enabling the successor. Preserve prior governance and communication records because a new owner or manager cannot retroactively validate an older flow.

Document exceptions, interim restrictions, corrective owners, completion evidence, and a follow-up sample for every failed control.

Direct-administrative-control checklist

• identify the exact program, controlling entity, authority, and effective dates;
• distinguish direct control from ownership, affiliation, management, or shared services;
• tie each recipient and data element to a current covered duty;
• minimize information and govern dashboards, board files, exports, and automation;
• apply recipient restrictions, logging, legal-demand, incident, and retention controls; and
• recheck after governance, ownership, program, service, or duty changes.

This route does not give every owner, director, manager, or affiliate access to Part 2 information. Direct control, recipient need, current restrictions, HIPAA, state law, contracts, and the specific communication require qualified review.