Part 2 intermediary information-description field

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.24(b)(2) requires a brief description of the patient-identifying information disclosed for each event. The description should tell the patient what category of information left without reproducing unnecessary clinical detail. It must come from the actual payload, document set, or reliable disclosure evidence rather than a generic request label.

Describe what actually left

42 CFR 2.24(b)(2) requires a brief description. Use evidence such as document manifest, payload schema, attachment list, release selection, field log, or transmission record. Avoid vague labels such as 'records' when the source supports a clearer category.

Balance clarity and minimization

Useful descriptions may identify assessment, progress note, medication record, billing information, dates of service, referral, discharge summary, or specified data categories. Exclude clinical narrative and details unnecessary to explain the disclosure.

Keep each entry coherent

Match the description to the general-designation consent, recipient, disclosure date, patient, route, version, correction, and source evidence. If one event contains distinct record categories, list them clearly without inflating the number of disclosures.

Reconstruct the content that actually left

Use release selections, document manifests, payload schemas, message metadata, attachment lists, field-level audit logs, interface profiles, export records, and recipient acknowledgments. Map the disclosure identifier to the correct payload version, patient, recipient, date, consent, and correction. Avoid relying only on what the requester asked for when the transmitted set differed.

Account for structured data, PDFs, notes, images, audio, assessments, treatment plans, medication records, referrals, billing and claims data, demographics, dates of service, summaries, attachments, and linked material. Record unavailable or ambiguous evidence for review.

Make the description brief but meaningful

Use patient-understandable categories such as “assessment and treatment plan dated…,” “billing and dates-of-service information,” or another accurate summary supported by the source. A label like “records,” “medical,” “document,” or a system code usually provides too little information to distinguish events.

At the other extreme, avoid copying diagnoses, narrative notes, medication detail, symptoms, or other sensitive content that the patient does not need to understand the disclosure. Establish a controlled vocabulary with room for specific qualifiers.

Handle mixed and changed payloads

When one event includes several record categories, name them coherently in one entry rather than creating unsupported disclosure counts. For split deliveries or multiple recipients, preserve the relationship between each entity and the content it received. Distinguish retries of the same payload from supplemental or corrected information.

Version the description when a later investigation changes the payload determination. Keep the source value, normalized categories, reviewer, reason, effective date, and prior patient response.

Align with consent and recipient scope

Compare the information description with the specific and meaningful record description in consent, the intermediary general designation, recipient relationship, purpose, and actual disclosure. A mismatch may indicate an unauthorized release, incorrect consent match, faulty interface, or wrong response entry and requires privacy review.

Do not use the response process to rewrite consent or excuse a disclosure outside its scope. Preserve evidence, contain any ongoing issue, and follow incident and correction procedures.

Review, deliver, and audit

Have qualified staff sample descriptions against the source payload and confirm clarity, minimization, date, recipient, and event count. Protect the response itself during generation and delivery because a list of disclosure descriptions can reveal sensitive patterns.

Track vague labels, excessive detail, unsupported categories, missing attachments, source gaps, corrections, patient questions, and incidents. Repair templates, controlled vocabulary, export mapping, staff training, and upstream logs when the same error repeats.

Assign vocabulary ownership and version review to privacy and records roles. When clinical systems add a document type or data element, map it before production use and test how the description will appear to a patient.

Example

Twenty disclosure descriptions are reviewed. Seventeen match the source payload, use understandable categories, avoid excess detail, and align with recipient and date; three say only 'medical records.' Field completeness is 17 of 20 entries.

Information-description checklist

• reconstruct the actual payload from manifests, schemas, logs, attachments, and versions;
• use concise, patient-understandable categories that distinguish the disclosure;
• minimize clinical detail while avoiding vague labels such as “records” or “medical”;
• keep mixed, split, retried, supplemental, and corrected payloads coherent;
• compare content with consent, recipient, purpose, date, and general designation; and
• protect the response, correct errors, investigate mismatches, and repair source controls.

The description is brief, but it is not decorative. It is the patient's best view of what information each recipient obtained.