Part 2 informal-caregiver security exception

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.16(a)(2) says family, friends, and other informal caregivers who are lawful holders are not required to comply with the formal-policy requirements in paragraph (a). The definition of lawful holder depends on receiving records through Part 2-compliant written consent with notice or through a statutory or regulatory exception. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended framework.

Classify both lawful-holder and informal-caregiver status

The current exception requires the person to fit the rule's lawful-holder definition and be family, a friend, or another informal caregiver. Record source, disclosure basis, notice, relationship, role, payment, organization, purpose, information, and date.

The exception has a narrow target

Paragraph (a) contains the formal security policy duty. Other use, disclosure, redisclosure, proceeding, subpoena, consent, state-law, contract, device, and safety issues require their own analysis. Avoid describing the person as exempt from Part 2 generally.

Practical safety guidance can still help

Offer plain-language guidance on private conversations, secure devices, strong screen locks, safe messaging, correct recipients, paper storage, lost-device response, phishing, shared accounts, disposal, and whom to call with a concern.

Confirm both informal-caregiver and lawful-holder status

Record the person's identity, relationship and caregiving role, whether the role is informal rather than professional or organizational, how the records were received, the consent or exception, accompanying notice, information, purpose, date, and any restrictions. A family relationship alone does not establish lawful-holder status, and receiving information improperly does not create the exception.

Analyze paid caregivers, agencies, residential programs, schools, employers, legal representatives, contractors, applications, and service vendors separately. Their role may fall outside “family, friends, and other informal caregivers” even when they help the patient daily.

Understand what the exception does and does not do

Paragraph (a)(2) removes the requirement that the qualifying informal caregiver maintain the formal policies and procedures described in paragraph (a). It does not itself authorize the original disclosure, expand the consent, permit unrelated use or redisclosure, change the recipient, or erase other Part 2 provisions and applicable laws.

Read the consent and accompanying notice. Identify which information was received, why, what the caregiver may do, whether further disclosure is permitted, and how a change or revocation affects future information flow. Route uncertainty to the Part 2 program or qualified privacy counsel.

Offer practical safeguards without mischaracterizing them

Programs can give plain-language instructions for private conversation, screen locks, device updates, strong passcodes, account sharing, secure messages, paper storage, safe disposal, backup, lost devices, phishing, household access, and emergency contact. Tailor the advice to disability, language, technology, housing, and caregiving realities.

Avoid presenting voluntary good practice as the formal paragraph (a) duty or making unrealistic promises. The caregiver may have obligations under another law, court order, agreement, professional role, or platform term that require separate review.

Plan for mistakes, changes, and return of information

Give the caregiver a clear contact for misdirected messages, lost devices, exposed paper, wrong-person access, suspicious links, family conflict, changed authority, patient revocation, or questions about sharing. The program should contain its own systems, preserve relevant evidence, and assess breach or notice duties that apply to the program.

When the caregiving role ends, discuss future communications, portal proxy, device or paper copies, secure return or disposal, and any continuing restrictions. Document changes in the program's consent, access, and messaging systems.

Review caregiver-selected technology separately

A family member may copy information into a calendar, messaging app, cloud folder, caregiver platform, school tool, employer device, or shared household account. The paragraph (a) exception does not decide whether the original disclosure or later sharing is permitted, and it does not make the technology a Part 2 program tool.

Before sending information directly into a caregiver-selected service, verify the patient's consent, recipient, purpose, scope, destination, account ownership, notification behavior, household access, and feasible alternative. Explain which security features the program controls and which it does not.

The caregiver can ask what information is necessary, who else may see it, whether a paper or portal option is safer, how future messages stop, and what to do after a device or account change. Keep the answer practical and accessible.

Example

Twelve lawful-holder files are classified. Nine support an informal family, friend, or caregiver role and preserve disclosure and notice evidence; three involve paid service vendors. Exception fit is 9 of 12 files.

Informal-caregiver exception checklist

• verify identity, informal role, lawful-holder route, consent or exception, and notice;
• separate family and friend caregivers from organizations, professionals, and vendors;
• treat the exception as relief from paragraph (a) formal policies only;
• honor the information, purpose, recipient, and redisclosure limits that still apply;
• offer accessible voluntary safeguards and a clear incident contact; and
• update consent, portal, messaging, return, and disposal when the role changes.

The exception recognizes the reality of informal care. It is not a blanket permission to obtain, use, disclose, or redistribute SUD records.