Part 2 general regulation-copy response

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.13(c)(2) permits giving an inquiring party a copy of Part 2 and advising generally that it restricts disclosure of SUD patient records. It bars affirmatively stating that Part 2 restricts disclosure of the records of the identified person named in the request. eCFR displays the section as current through August 20, 2026 and last amended August 13, 2026. The HHS fact sheet confirms the February 16, 2026 compliance date for the amended framework.

The explanation stays detached from the person

Current 42 CFR 2.13 permits general information about the regulation while barring person-specific confirmation. Use a current official link or approved copy, neutral introduction, and no patient, program, service, date, record, or status detail.

Attachments and system behavior can disclose

A neutral letter can be undermined by a patient-specific subject line, filename, portal status, ticket category, staff signature, routing address, program-branded template, delivery receipt, or prior message. Review the complete response package.

Pair the script with internal escalation

Authenticate and log the requester, identify claimed authority, preserve legal process, calculate deadlines, route privacy or counsel review, and maintain nonconfirming communication. Update scripts when the rule, source URL, organizational structure, or contact channel changes.

Keep education detached from the named person

Use a current official link or approved copy, a neutral introduction, and general process instructions. Avoid the patient name, record existence, program, service, clinician, date, status, treatment, denial reason, or a statement that the regulation governs that person's records.

Do not tailor the explanation with facts learned from a protected record. A response that begins generally can become confirming through a follow-up sentence, routing choice, sender identity, or attachment selected for the specific person.

Review the complete response package

Inspect subject line, recipient, copied addresses, sender, signature, email domain, template branding, file name, document properties, tracked changes, ticket category, portal status, delivery route, and prior thread. Use neutral storage and audit labels inside systems visible to broad staff.

Separate the educational response from secure intake for consent, subpoenas, orders, or other claimed authority. Explain how to submit documents without indicating that a matching record or patient relationship exists.

Maintain current materials and escalation

Assign an owner to check the official link, approved copy, script, contact route, and version after rule or organizational changes. Prevent outdated local summaries from substituting for current regulatory text.

Record requester identity and contact, patient named, general material sent, channel, version, date, responder, authority documents received, deadline, and escalation in a restricted log. If metadata or wording revealed status, preserve evidence, contain further communication, complete incident review, and test remediation.

Example

Ten general responses are assessed. Eight contain current official material, neutral wording, safe metadata, approved delivery, and audit evidence; two use patient-specific subject lines. Readiness is 8 of 10 responses.

Record the educational response

Classify each contact as appropriate for general materials, routed for secure authority review, answered through another approved neutral process, or escalated after a revealing response. Record requester, patient named, channel, official material and version, exact introduction, sender, delivery, reviewer, and next action.

Use a controlled template that inserts no patient value into subject, body, attachment name, metadata, ticket title, or portal state. Verify the official link at send time and keep a fallback approved copy for outages.

Test the response as the recipient sees it, including sender identity, branding, prior thread, delivery notification, and any automatic routing. Confirm that submitting follow-up authority documents does not change the public-facing response in a way that confirms a match.

For defects, preserve the original package, contain further contact, perform incident review, correct template and system behavior, and document a successful follow-up test.

Retain the affected request, recipient, version, correction, reviewer, and closure evidence.

Archive securely.

General-regulation response checklist

• use a current official Part 2 link or approved copy and neutral introduction;
• omit person, program, record, service, date, provider, status, and treatment details;
• inspect subject, sender, branding, file name, metadata, routing, and prior messages;
• keep educational material separate from secure authority-document intake;
• version and review scripts, links, copies, owners, and escalation contacts; and
• log and correct any person-specific or context-revealing response.

Providing general regulations does not answer the request or establish authority to disclose. Current Part 2, exact wording, system context, claimed authority, other law, and any later response require qualified review.