Part 2 federal-and-state disclosure matrix

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

A federal-and-state matrix operationalizes live 42 CFR 2.20: Part 2 does not occupy the entire field, a federal permission cannot authorize a state-law violation, and state law cannot authorize or compel a Part 2-prohibited act. The matrix supports decisions, but qualified reviewers remain responsible for applicability and interpretation.

Use one row per real decision

The relationship rule in 42 CFR 2.20 requires both sources to be respected. Avoid one national yes-or-no flag. Separate treatment, payment, operations, emergency, reporting, audit, research, legal process, patient access, payer, and public-health routes.

Name source effect precisely

Use fields for permits, requires, prohibits, limits, silent, uncertain, superseded, and pending interpretation. Record applicability, exception, minimum information, recipient restrictions, notice, redisclosure, retention, deadline, counsel decision, and review trigger.

Keep the matrix advisory and current

The 2024 final rule confirms the federal baseline. Authorized roles decide legal and privacy questions. Systems can flag expired sources, missing fields, conflict, and hold states while preserving both versions and the final human decision.

Design rows around decisions, not topics

Use one row for a defined holder, record class, patient group, action, purpose, recipient class, jurisdiction, and effective period. Split a row when any of those facts changes the result. Broad labels such as “payer,” “research,” or “legal” hide meaningful differences in recipient, purpose, process, and authority.

Include separate routes for treatment, payment, operations, public health, emergencies, audits, research, reporting, patient access, personal representatives, minors, subpoenas, court orders, data exchange, vendors, and records crossing state lines. Link each row to the real workflow and system control it governs.

Capture enough fields to reproduce the conclusion

Useful fields include row identifier, owner, last reviewer, facts, federal source and version, federal effect and conditions, state source and version, state effect and conditions, other law, consent or order, exception, conflict result, minimum data, recipient verification, notice, redisclosure or use limit, security method, evidence, outcome, effective date, expiration, and change trigger.

Use precise statuses such as permitted if conditions met, required if conditions met, prohibited, silent, uncertain, superseded, pending counsel, release, partial release, authorization needed, order needed, or hold. Define the vocabulary so “allowed” never conceals an unmet condition.

Govern sources, review, and automation

Store links or controlled copies of primary sources with publication and effective dates. Assign federal and state-law reviewers, document interpretations, and retain prior versions when a rule changes. The 2024 final rule is a federal rulemaking source, not a substitute for current state authority.

Systems may use approved matrix rows to prompt, route, block, minimize, and log a disclosure. Require a human review when jurisdiction, record status, purpose, requester, exception, or source currency is uncertain. Prevent local copies from becoming an unofficial shadow matrix.

Test the matrix against real scenarios

Create cases spanning multiple states, remote staff, telehealth, payers, exchanges, minors, personal representatives, emergencies, research, vendors, audits, subpoenas, and amended orders. For each, confirm the selected row, result, evidence, controls, and escalation. Include cases where federal and state outcomes differ.

Audit released and withheld requests against the matrix. Investigate false releases, unnecessary holds, incorrect jurisdictions, expired sources, unsupported overrides, and rows that no workflow uses. Feed corrections back into the source, training, system rule, and prior affected decisions.

Keep uncertainty visible

An unresolved row should show the open question, owner, protective interim state, deadline, and affected requests. Do not convert silence or ambiguity into permission. Preserve materials and route urgent cases while the conclusion is developed.

Publish a controlled revision log showing what changed, why, who approved it, which workflows and prior decisions are affected, and when the replacement takes effect. Retire stale copies and confirm downstream systems received the same version.

Example

Twenty matrix rows are audited. Sixteen have exact sources, scope, effect, conditions, conflict result, owner, effective date, release test, and evidence; four use an unlabeled 'allowed' status. Completeness is 16 of 20 rows.

Disclosure-matrix checklist

• define one decision per row using holder, record, patient, action, purpose, recipient, and jurisdiction;
• link current federal, state, and other sources with scope, conditions, versions, and dates;
• use explicit outcomes for release, partial release, consent, order, uncertainty, and hold;
• connect approved rows to workflows, systems, evidence, owners, and controlled overrides;
• test multistate and exception scenarios plus both released and withheld cases; and
• retain versions, surface unresolved questions, and update training and affected decisions.

The matrix is valuable when another qualified reviewer can reproduce the conclusion from its facts and sources. A bare red, yellow, or green flag cannot do that.