Part 2 intermediary written-list request

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.24 requires an intermediary to give a patient, upon written request, a list of entities to which records were disclosed under the general designation authorized by 42 CFR 2.31(a)(4)(ii)(B). The request right is tied to that consent route. It covers the prior three years and carries a response deadline of 30 or fewer days after receipt.

The right depends on a general designation

Current 42 CFR 2.24 applies when the patient consented under the general-designation route. Match the requester, consent, named intermediary, participating recipients, effective period, revocation, and disclosures made pursuant to that designation.

Make written intake accessible

Accept applicable paper or electronic writing, provide language and disability access, avoid unnecessary barriers, identify the request date and channel, acknowledge receipt, resolve identity or scope gaps promptly, and preserve the original request.

Connect consent and disclosure evidence

42 CFR 2.31 supplies the intermediary general-designation framework. Search disclosure logs, interfaces, recipient rosters, messages, releases, and corrections. Keep unrelated disclosures outside the list while documenting the rule used.

Confirm that the intermediary-list rule applies

Identify the patient, written request, named intermediary, operative consent, general designation, participant or class, treating-provider relationship where required, consent effective period, revocation, and requested time range. Separate disclosures made under directly named recipients, other consents, patient access, legal process, exceptions, or internal uses.

An organization may play more than one role. Record which entity served as the intermediary for the specific consent and which systems or vendors acted on its behalf. Do not route the request solely by brand name.

Accept and preserve accessible writing

Define accepted paper and electronic channels, including mail, portal, secure message, email, fax, hand delivery, and authorized accessibility accommodations. Capture the original content, attachments, receipt timestamp, channel, patient contact, requested period, format, language or disability needs, and any representative authority.

Acknowledge receipt through a safe channel and explain next steps. Resolve identity, authority, or scope questions promptly without silently replacing the original receipt date. Avoid requiring the patient to use a particular form when another valid writing contains the needed request.

Match consent and search disclosure evidence

Retrieve the consent version and establish that it uses the intermediary general-designation route. Search active and legacy disclosure logs, interface events, release modules, recipient directories, participant rosters, secure messages, manual transmissions, vendor records, corrections, and acknowledgments. Preserve source identifiers and time zones.

Reconcile the patient, consent, intermediary, recipient entity, disclosure date, brief information description, and evidence for every included event. Investigate unmatched transmissions, missing periods, duplicate retries, acquired systems, renamed recipients, and vendor gaps rather than omitting them silently.

Build and review the response

Limit the list to disclosures within the applicable three-year window made under the general designation. For each, provide the recipient entity name, disclosure date, and brief description required by section 2.24. Use understandable normalized names while retaining the source value and evidence.

Have an authorized reviewer confirm identity, consent match, lookback, sources, completeness, fields, corrections, minimum content, and secure-delivery destination. Document empty results and verified limitations carefully.

Meet the deadline and close evidence

Calculate 30 or fewer days from receipt under the approved calendar method. Escalate early when legacy retrieval, identity disputes, vendor delay, or system failure threatens completion. The rule does not state that routine clarification resets the clock.

Record final list version, reviewer, delivery method, timestamp, recipient verification, receipt or failed delivery, complaint, corrected response, and closure. Audit mature requests using due dates and keep late or open items in the denominator.

Retain the response evidence under the approved records schedule.

Example

Thirteen written requests reach intake review. Ten match a general-designation consent and have identity, scope, receipt, owner, search plan, deadline, and acknowledgment; three lack a consent match. Readiness is 10 of 13 requests.

Written-list-request checklist

• verify the patient, intermediary, written request, consent, general designation, and authority;
• preserve original receipt and support accessible paper and electronic intake;
• search and reconcile active, legacy, manual, interface, participant, and vendor evidence;
• include only in-scope disclosures with recipient, date, and brief information description;
• calculate and protect the 30-day deadline without silent clock resets; and
• securely deliver, prove completion, correct errors, and retain limitations and complaints.

The written request starts a defined reconstruction task. Reliable response depends on linking consent, recipient, date, payload, and evidence for every disclosure in scope.