Part 2 intermediary definition

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The HHS Part 2 final-rule fact sheet summarizes the 2024 consent, redisclosure, proceeding, breach, and patient-right changes and confirms the February 16, 2026 compliance date. The Federal Register final rule provides the adopted text and agency explanation. Intermediary workflows built around older consent language should be retested against the live eCFR, the current recipient categories, and the actual participant data flow.

The exclusions and receipt path matter

42 CFR 2.11 excludes three recipient categories and ties intermediary receipt to general-designation consent. Record legal entity, role, consent, records, purpose, participant network, date, and accompanying notice.

Participant disclosure needs relationship evidence

Before release, verify participant identity, membership, treating provider relationship, requested information, purpose, consent scope, and current restrictions. Preserve the disclosure-list information and dates required by applicable Part 2 provisions.

Intermediary status does not replace other roles

Map HIPAA, state law, contracts, professional scope, security, incident response, retention, legal demands, and downstream use separately. Reclassify when the organization, function, participant, or data route changes.

Classify the receiving entity first

The definition excludes a Part 2 program, HIPAA covered entity, and business associate. Identify the exact legal entity that receives the records and evaluate its role for that transaction. A platform, exchange, network, affiliate, or contractor may use a familiar “intermediary” label while the facts place it in an excluded category.

Record ownership, services, contracts, HIPAA status, business-associate relationships, member-participant structure, and systems receiving data. Reclassify after mergers, contracting changes, new products, or a different receipt route. One organization's status can vary across workflows.

Tie receipt to the general designation

Intermediary status depends on receipt under a general designation in written patient consent. Preserve the signed consent, version, signer authority, scope, records, purpose, intermediary, dates, restrictions, revocation status, and required accompanying notice. Confirm that the data actually received matches the consent rather than treating possession as proof of authority.

Create a consent-to-data map that lists source programs, feeds, fields, copies, and derivatives. Block records outside scope and define how revocation, expiration, correction, or a changed participant affects future activity and retained copies.

Verify every member-participant disclosure

Before release, confirm that the recipient is a current member participant and has a treating provider relationship with the patient. Record participant legal entity, membership dates, relationship evidence, requested records, purpose, consent scope, disclosure date, and reviewer. A directory listing, network affiliation, or sent referral does not by itself prove a treating relationship.

Use the disclosure-list and notice requirements that apply to the specific workflow. Give patients the required access to disclosure information through a secure and understandable process. Correct participant, relationship, and date errors with an audit trail.

Control downstream systems and uses

Limit participant access to approved records and purpose. Test search, bulk export, analytics, support tools, logs, backups, legal holds, incident response, and deletion. Map HIPAA, state law, security, professional scope, contracts, and legal-process restrictions separately because intermediary status does not settle them.

When a participant leaves, close access, stop feeds, inventory retained records, preserve required logs, and document return, destruction, or continuing authority. When the intermediary's role changes, determine whether a new consent or disclosure structure is needed before data continues to flow.

Example

Ten intermediary disclosures are reviewed. Eight have consent, membership, treating relationship, scope, and log evidence; two lack relationship proof. Readiness is 8 of 10 disclosures.

Intermediary control checklist

• verify that the receiving entity is outside all three excluded categories;
• retain current general-designation consent and the accompanying notice;
• map source records, systems, copies, restrictions, and revocation handling;
• confirm membership and treating-provider evidence for each disclosure;
• maintain required disclosure information, access logs, and correction history; and
• reassess after entity, contract, participant, purpose, or data-route changes.

This definition does not approve a particular consent, treating relationship, use, or disclosure. Current Part 2 provisions, HIPAA, state law, contracts, and the facts require qualified privacy and legal review.

Keep a dated intermediary decision record that names the legal entity, excluded-category analysis, consent version, source programs, participant roster, treating-relationship evidence, systems, permitted data, purpose, disclosure-log location, privacy owner, and next review. Mark unknown fields as unresolved and block the affected feed or participant rather than filling gaps by assumption. When consent, membership, or relationship evidence changes, preserve the earlier state and identify every later disclosure that needs recheck, correction, or patient-facing follow-up.

Reconcile that record with the live participant directory and access configuration before each scheduled review closes.