Part 2 lawful-holder contractor redisclosure

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.33(b)(3) and (c) permits a lawful holder that is not a covered entity or business associate to redisclose consented Part 2 records as necessary to contractors, subcontractors, or voluntary legal representatives carrying out payment or health care operations specified in the consent. Written binding terms, the section 2.32 notice, safeguards, incident reporting, necessary-information limits, and narrow contract-agent handling apply.

Confirm the route and the task

Current 42 CFR 2.33(b)(3) and (c) applies to payment or health care operations specified in the consent. Record lawful-holder status, HIPAA status, task, consented purpose, vendor role, information, term, owner, and release decision.

Build the contract before access

Use a written contract or comparable legal instrument that binds the recipient to Part 2, requires the disclosure notice, safeguards the information, and routes unauthorized uses, disclosures, or breaches back to the lawful holder. Address subcontractors and contract agents explicitly.

Keep the legal pathways distinct

The HHS Part 2 fact sheet does not turn this contract into a HIPAA business-associate agreement or general authorization. Determine which agreements, privacy laws, security duties, professional rules, and state requirements separately apply.

Confirm the lawful-holder route

Document how the organization lawfully received the Part 2 information, why it is not a covered entity or business associate for the activity, the consented payment or health care operations purpose, and the specific task performed on its behalf. Preserve recipient, source, consent, records, dates, reviewer, and classification evidence.

Do not use this branch for treatment, a contractor's independent purpose, general analytics, marketing, or work beyond the consented payment or operations activity.

Map every recipient and task

List the contractor, subcontractor, voluntary legal representative, and any proposed contract agent. For each, record legal name, service, data fields, systems, locations, users, access method, retention, subprocessing, owner, and termination plan. Verify that the task is truly for the lawful holder.

Procurement labels such as vendor or counsel do not establish eligibility. A representative acting independently or for another client needs separate analysis.

Put required terms in place

Before access, execute a written contract or comparable legal instrument binding the recipient to Part 2 upon receipt. Require the section 2.32 notice, appropriate safeguards against unauthorized use and disclosure, and reporting of unauthorized uses, disclosures, or breaches to the lawful holder. Address subcontractors, contract agents, correction, return, deletion, audit, and termination.

Review the operative agreement and incorporated schedules together. A security policy, purchase order, or confidentiality clause alone may omit the rule's required obligations.

Limit information and downstream handling

Release only information necessary for the recipient's defined duties under the instrument. Use field and role controls, environment separation, time limits, logging, export restrictions, and approval for changes. Inspect actual payloads and access rather than relying on a contract description.

The instrument cannot permit third-party redisclosure unless the third party is a contract agent helping the contractor or subcontractor provide the described services, and that agent may further disclose only back to the contractor or originating lawful holder. Map and test that return-only flow.

Operate and close the relationship

Verify access, notice, safeguards, events, incidents, corrections, subprocessor changes, and audits throughout the term. Require prompt escalation with facts needed for the lawful holder's assessment. Suspend access when terms, task, consent, classification, or security evidence no longer supports it.

At termination, disable users and routes, retrieve or securely dispose of information as the approved instrument requires, resolve retained copies, preserve required evidence, and test that downstream agents no longer have access. The HHS fact sheet offers context but does not replace contract review.

Example

Eighteen vendor access grants are audited. Fifteen have lawful-holder and HIPAA classification, consented task, signed terms, limited fields, notice, safeguards, incident routing, and downstream controls; three use procurement terms alone. Readiness is 15 of 18 grants.

Lawful-holder contractor checklist

• prove lawful receipt, non-HIPAA status, consented purpose, and on-behalf-of task;
• inventory contractors, subcontractors, representatives, agents, data, and systems;
• execute binding written terms before access and furnish the section 2.32 notice;
• require safeguards, incident reporting, necessary-data limits, and audit evidence;
• constrain agents to helping with the service and returning information upstream; and
• govern changes, suspension, termination, access removal, return, and deletion.

The contract implements a narrow redisclosure route. It should mirror the actual data flow, service, recipients, and controls rather than merely naming Part 2.