Part 2 intermediary disclosure-list right

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Intermediary status is a threshold fact

42 CFR 2.22 lists this right separately from the accounting of electronic-record disclosures. Determine which organization or service qualifies as an intermediary and which disclosures fall within its list obligation before assembling the response.

Maintain an intermediary register with legal and public name, service, Part 2 relationship, systems, records received, consent structure, disclosure functions, active dates, contract owner, privacy contact, event sources, retention, export method, and last qualified review. Do not classify a vendor, exchange, HIE, contractor, covered entity, or business associate as an intermediary solely from its label.

Accept the request without requiring legal vocabulary

Publish a monitored route and train staff to recognize requests for a list of who an intermediary disclosed records to. Preserve receipt, patient or representative, safe contact, program and record scope, intermediary, requested period, language or accessibility needs, and owner. Clarify only decision-relevant facts. Route a different accounting or access request to the proper process without making the patient start over.

Protect the request queue and communications because the context can reveal SUD program participation. Use safe messages and role-based access. Preserve original receipt when intake transfers the case.

The three-year window needs precise events

Record the request date, boundary date, disclosure date, recipient, amount and kind of record, purpose, consent or other authority, source system, duplicates, corrections, and response date. Preserve the query logic and exports used.

Calculate the three-year period through an approved rule and time zone. Inventory every intermediary system active during the window, including APIs, HIEs, portals, secure messaging, document exchange, vendor tools, archives, acquired platforms, and retired queues. Keep source active dates, schema, identifiers, provenance, retention, migration, export, and known gaps.

Normalize events without erasing original timestamps. Define treatment of retries, failed transmissions, batches, multi-recipient events, corrected identity, duplicates, and test data. Map each included disclosure to recipient, date, amount and kind of records, purpose or authority, source, consent context, and correction history as required. Qualified review should resolve exclusions and ambiguous intermediary flows.

Reconcile and validate the list

Compare source inventory, sources queried, raw events, exclusions, duplicates, final records, and unresolved gaps. Sample final rows into original logs and patient records. Use a second reviewer for identity, intermediary, period, record scope, recipient, completeness, and safe delivery. Prevent another person's information or irrelevant security details from entering the response.

If a source is missing, retain the request under an accountable recovery plan and explain supported limitations through qualified review. Do not close a list merely because the active platform returned data. Preserve query code or parameters, exports, decisions, response, delivery, and later corrections.

Govern intermediaries and migrations prospectively

Contracts and technical designs should require event capture, retention, correction, secure export, timely response support, and transition assistance. Test disclosure-list extraction before onboarding completion and periodically afterward. Before termination or migration, export the full applicable history with schema and provenance and validate it independently.

When intermediary status, service, consent structure, disclosure capability, or law changes, update the notice, register, request workflow, and event mapping together. Historical requests still need the facts that governed during the requested period.

Example with source coverage

An intermediary maps eight sources for the three-year period. Seven produce validated disclosure data; one retired queue lacks an export. Source completeness is 7 of 8 systems. The request stays open with a recovery owner.

The owner restores the retired queue from an archive, validates its schema and event samples, and adds qualifying rows. The evidence retains the initial 7-of-8 gap and final 8-of-8 coverage. The patient receives the complete list through the approved safe route.

Intermediary-list checklist

• Make a qualified intermediary determination and maintain a register.
• Accept plain requests and preserve receipt and safe contact.
• Inventory every active, legacy, vendor, and migrated event source.
• Apply one three-year boundary and current inclusion rules.
• Normalize events while preserving original evidence and provenance.
• Reconcile, second-review, and securely deliver the response.
• Test export and transition controls before systems retire.

Owner controls

The 2024 final rule explains the aligned accounting framework. Use an intermediary register, event schema, record provenance, migration controls, secure delivery, correction path, complaint route, and retrieval tests.

Monitor intermediary reviews, requests, source coverage, retrieval age, missing exports, corrections, secure delivery, complaints, and migrations. Audit from response rows into original evidence and from registered intermediary systems into tested list output. Retain historical classifications and mapping versions.