Part 2 discontinued-program consented record transfer

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.19(a)(1) permits a patient to give written consent meeting 42 CFR 2.31 to transfer records to the acquiring program or another program the patient designates. The method of obtaining that consent must minimize the likelihood of disclosing patient-identifying information to a third party. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended framework.

The patient chooses the destination

Under 42 CFR 2.19, consent may designate the acquiring program or another program. Keep treatment options, transition help, records access, and communication clear. Avoid presenting acquisition as automatic permission to transfer every Part 2 record.

Validate the consent

The written consent must meet § 2.31. Confirm patient identity, authorized discloser, meaningful record description, recipient, purpose, revocation language, expiration, required signature, date, and any additional statements or special rules that apply.

Minimize disclosure while seeking consent

Use verified private channels, neutral envelopes and messages, approved portals, minimum identifying content, correct-recipient checks, accessible language and communication, failed-delivery handling, proxy-authority review, revocation tracking, and staff scripts.

Offer a real destination choice

Explain closure, acquiring organization, other available programs, continuity options, record access, transfer scope, timing, consequences of declining, and default disposition in accessible language. Do not imply that treatment, medication, a refund, account resolution, or another benefit depends on selecting the acquirer when that is not accurate.

Record the patient's designated recipient rather than substituting the buyer, parent company, storage vendor, or referral partner. Verify that the receiving program exists, can accept the record securely, and understands any applicable Part 2 duties.

Obtain consent without revealing status

Use verified contact preferences, neutral sender and envelope, nonrevealing subject line, private portal or conversation, correct-recipient checks, interpreter and disability support, and a safe callback process. Avoid voicemail, postcards, group messages, household email, or vendor campaigns that identify the Part 2 program or purpose to another person.

Track returned mail, bounced messages, wrong numbers, portal proxy, deceased patients, minors, representatives, incapacity, unsafe contacts, and failed authentication. Limit outreach frequency and identifying detail. A closure deadline does not justify broad disclosure while seeking consent.

Validate the complete section 2.31 consent

Confirm patient and signer authority, authorized discloser, recipient, meaningful information description, purpose, expiration or event, revocation method, consequences of refusal, redisclosure statement where applicable, signature, and date. Preserve the exact form, explanation, delivery, and current status.

Compare the consent with the planned record set and recipient endpoint immediately before transfer. Exclude dates, services, media, or programs outside scope. Stop after revocation or expiration except to the extent prior reliance remains protected under the rule.

Transfer securely and prove receipt

Inventory records, files, attachments, messages, media, dates, and patient count. Verify destination, encrypt or use an approved secure channel, restrict temporary access, preserve integrity, reconcile counts, confirm receipt, and record exceptions. Avoid sending broad system exports when patient-level transfers are authorized.

The receiving program should acknowledge what it accepted, any corruption or mismatch, and the responsible contact. Resolve rejected or partial transfers while the closing program retains secure custody.

Close the source and unresolved cases

After verified transfer, document whether the closing program must retain a copy under law or may remove or destroy it under section 2.19. Apply holds, retention, security, vendor, backup, and sanitization rules to every remaining copy.

For no response, declined consent, invalid consent, unreachable patient, or failed recipient, use another supported disposition path rather than leaving records in an abandoned system. Preserve outreach, decision, authority, custody, and final evidence.

Example

Fifteen closure transfers are scheduled. Twelve have valid consent, verified recipient, private outreach, transfer inventory, secure method, receipt, and source closure; three have expired or incomplete consents. Readiness is 12 of 15 transfers.

Consented-transfer checklist

• explain closure, destination options, transfer scope, timing, and consequences accessibly;
• obtain consent through verified, neutral, private, and nonrevealing contact;
• complete every applicable section 2.31 element and verify signer authority;
• match consent to exact records, dates, program, recipient, endpoint, and status;
• secure, inventory, reconcile, confirm, and document the transfer; and
• apply lawful retention or destruction to source copies and unresolved cases.

Acquisition does not itself transfer Part 2 records. Patient choice, complete consent, private outreach, secure delivery, and final source disposition all matter.

Reconfirm the patient's selected destination immediately before transfer.