Part 2 multiple-enrollment prevention disclosure

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.34 permits a Part 2 program to make a narrowly defined disclosure to a central registry or to a withdrawal-management or maintenance-treatment program not more than 200 miles away to prevent multiple enrollment. The rule requires a listed treatment event, special written consent, a limited payload, and recipient-purpose controls. It is not a general authorization for care coordination or full-record exchange.

Confirm that the pathway fits

Current 42 CFR 2.34 applies to a Part 2 program and specified registry or treatment-program routes. Classify the disclosing program, recipient, event, distance where applicable, patient, consent, purpose, and data before release. It is not a general care-coordination permission.

Build one release gate

Require a permitted treatment event, current written consent, allowed recipient, verified distance where relevant, limited data fields, secure route, recipient-purpose notice, owner, and evidence. Hold the disclosure when any element is missing or conflicts.

Keep other authority separate

The consent must satisfy 42 CFR 2.31 plus the special § 2.34 terms. State prescription-monitoring, pharmacy, controlled-substance, health-information-exchange, and payer rules answer separate questions. Qualified privacy and legal roles should resolve overlap.

Verify the disclosing program and recipient

Document that the sender is a Part 2 program and identify the relevant withdrawal-management or maintenance-treatment function. Classify the proposed recipient as a central registry or qualifying program. For a program recipient, preserve its type, authoritative name and address, operating status, and distance decision.

Do not infer eligibility from a vendor label, payer relationship, referral, network membership, pharmacy status, or general SUD service. Route uncertain program and registry classifications to privacy and counsel.

Confirm a listed treatment event

Section 2.34(a)(1) names acceptance for treatment, a change in drug type or dosage, and treatment interruption, resumption, or termination. Capture the exact event, effective time, clinical source, responsible role, medication details where relevant, version, and corrections. An appointment cancellation, claim change, portal message, or eligibility check does not establish the treatment state by itself.

Use one event identifier through the release workflow. Prevent retries, late documentation, corrected orders, and reversed states from creating duplicate or stale disclosures.

Validate consent and the allowed payload

The written consent must satisfy 42 CFR 2.31 and section 2.34's recipient instructions. Confirm patient and representative authority, discloser, records, purpose, recipient, revocation, expiration, signature, date, named registries and known programs, and any valid 200-mile program designation.

Limit the transmitted content to patient-identifying information, drug type and dosage, and relevant dates. Use an allowlist, block narrative and attachments, and inspect the actual payload and hidden metadata before release.

Enforce purpose and recipient controls

The initial route is for preventing multiple enrollment. Central registries and recipient programs have the use and redisclosure limits in paragraph (b), with specific later coordination provisions elsewhere in the section. Do not turn registry participation into a standing permission for unrelated clinical, billing, payer, research, or law-enforcement use.

Verify the destination, secure method, recipient authentication, transmission, acknowledgment, correction, notice, and audit evidence. Keep other state, pharmacy, controlled-substance, prescription-monitoring, and exchange rules on their own legal paths.

Test the complete release gate

Configure the workflow to require program and recipient classification, event, consent, distance where applicable, payload, purpose, security, approver, and evidence. Hold incomplete events and display the missing element. Limit overrides and require documented qualified approval.

Audit released, blocked, corrected, and retried events. Investigate wrong recipients, absent consent, distance gaps, payload expansion, stale clinical states, missing acknowledgments, and downstream use outside the permitted purpose.

For an unauthorized or misdirected message, stop further transmission, preserve evidence, contact privacy and clinical owners, assess patient and medication risk, correct the receiving system, and complete applicable incident and notice procedures.

Example

Fourteen proposed disclosures reach review. Eleven have a qualifying program, event, recipient, consent, distance decision, limited data, and release evidence; three use a generic data-sharing form. Release readiness is 11 of 14 disclosures.

Multiple-enrollment disclosure checklist

• verify the Part 2 program and central-registry or qualifying-program recipient;
• document the exact treatment event, clinical source, timestamp, and correction state;
• validate section 2.31 consent plus the special registry and program instructions;
• limit content to identifying information, drug type and dosage, and relevant dates;
• enforce distance, purpose, recipient, security, acknowledgment, and audit controls; and
• test releases, holds, retries, corrections, overrides, and downstream use.

Every element is a gate. A valid event or consent alone does not support the section 2.34 disclosure.