Part 2 mixed-use-facility presence acknowledgment

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.13(c)(1) permits acknowledgment of an identified patient's presence when the health-care facility or component is not publicly identified as providing only SUD diagnosis, treatment, or referral and the acknowledgment does not reveal that the patient has an SUD. Both conditions matter. eCFR displays the section as current through August 20, 2026 and last amended August 13, 2026. The HHS fact sheet confirms the February 16, 2026 compliance date for the amended framework.

The facility must avoid an SUD-only public identity

Current 42 CFR 2.13 ties the rule to how the facility or component is publicly identified. Review names, service descriptions, signs, websites, directories, maps, phone trees, referral materials, scheduling labels, and public profiles.

The response must reveal no SUD status

Define exactly which presence fact may be shared, with whom, through which channel, and under what other privacy rules. Avoid naming an SUD unit, specialist, program, appointment type, referral source, or treatment reason.

Other authority still applies

Verify HIPAA directory and involved-person rules where applicable, state privacy law, minors and representative authority, confidential-communication requests, safety restrictions, custody orders, patient preferences, facility policy, and contracts.

Classify the actual facility or component

Record legal name, public name, building, component, services, signs, website, map, directory, phone tree, referral materials, scheduling labels, public profiles, and effective dates. Determine whether a reasonable member of the public would identify the exact facility or component as only an SUD service.

Review hospitals with addiction units, behavioral-health centers, shared clinics, co-located programs, telehealth, mobile services, specialty floors, and common entrances separately. Public identity can change after rebranding, service launch, relocation, or directory updates.

Define a presence-only response

State which basic fact may be acknowledged, to which verified requester, for which purpose, during which period, and through which channel. Exclude SUD program, unit, clinician, specialty, appointment type, diagnosis, referral source, treatment, medication, schedule detail, and reason for presence.

Apply HIPAA directory and involved-person rules where relevant, state privacy, patient preferences, confidential-communication requests, custody and representative authority, safety restrictions, contracts, and facility policy. Part 2 permissibility does not require the organization to acknowledge presence.

Prevent contextual disclosure

Review wording, transfer destination, caller identification, hold music, staff title, email domain, portal path, visitor badge, pickup location, unit name, and surrounding conversation. A nominally neutral “yes” may reveal SUD status when paired with an identified specialty component.

Train staff and test phone, front desk, portal, transport, family, payer, employer, media, and government requests. Log any permitted acknowledgment and investigate revealing responses or mismatched facility classification.

Example

Thirteen directory responses are reviewed. Ten have facility-classification, patient, requester, allowed response, privacy check, and log evidence; three name an SUD service line. Readiness is 10 of 13 responses.

Record a facility-specific response rule

For each facility and component, document public identity, effective dates, permitted presence wording, prohibited contextual details, other privacy conditions, accountable owner, and next review. Mark configurations unresolved when signs, websites, directories, phone routing, or service descriptions conflict.

Classify each request as eligible for the narrow acknowledgment, restricted by patient preference or other law, answered neutrally, denied, or escalated. Record requester, patient, purpose, channel, response, authority, and follow-up without exposing SUD status in the log's broad-facing fields.

Test the response from outside the organization. Include a call, front-desk inquiry, portal or directory search, transport pickup, and after-hours route. Confirm that staff and systems do not reveal unit, specialty, clinician, appointment type, or reason for presence.

After a revealing response, preserve evidence, contain further disclosure, complete incident review, correct public and internal configuration, and verify the repair.

Retain the affected request, recipient, response, correction, reviewer, and successful follow-up test evidence.

Record closure.

Mixed-use presence checklist

• document the public identity of the exact facility or component and effective dates;
• review specialty units, shared sites, directories, signs, websites, and phone trees;
• define the narrow presence fact, verified requester, purpose, period, and channel;
• exclude SUD unit, provider, diagnosis, service, appointment, and referral details;
• apply HIPAA, state law, preferences, custody, safety, and policy separately; and
• test contextual clues, system routing, staff wording, and facility changes.

The rule permits a narrow acknowledgment only when it reveals no SUD status and does not override other privacy restrictions. Facility identity, context, recipient, patient preferences, and exact wording need qualified review.