Part 2 notified-recipient restriction

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The live 42 CFR 2.12(d)(2)(i)(C) identifies the direct sender classes and requires notification of the prohibition on redisclosure under section 2.32. Section 2.32 supplies two approved notice statements. It also requires consent-based disclosures to include a copy of the consent or a clear explanation of its scope. eCFR displays Title 42 as current through August 20, 2026 and last amended August 13, 2026.

Direct receipt and notice are evidence gates

The current recipient rule identifies the covered sender classes and notification condition. Record the sender, receiver, endpoint, patient or cohort, record set, authority, purpose, transmission, receipt, notice version, delivery evidence, and date.

Notice should travel with the record workflow

Build the required notice into approved exchange routes, exports, portals, interfaces, attachments, and manual releases. Test rendering, recipient visibility, delivery, correction, replay, and audit logs. Preserve the rule version used for older disclosures.

Later action needs classification

A recipient's access, internal use, redisclosure, subpoena response, investigation support, analytics, retention, and deletion may have different authority. Route each through current Part 2, HIPAA where applicable, state law, contract, and legal-demand controls.

Capture the disclosure and notice together

Record source, recipient legal entity and endpoint, patient or cohort, records, purpose, authority, consent if used, disclosure date, transmission, notice statement, consent copy or scope explanation, delivery evidence, and responsible sender. Keep the notice connected to each disclosed record and any export rather than relying on a general contract clause.

Test portals, direct messaging, fax, secure email, application programming interfaces, health-information exchange, record downloads, attachments, bulk files, print, and manual releases. Verify that the notice is readable, travels with retransmission or replay where required, appears to the actual recipient, and remains in the audit record.

Distinguish recipient categories and later action

Classify whether the receiver is a covered entity, business associate, intermediary, other lawful holder, or another person and why. Section 2.12 notes that a Part 2 program, covered entity, or business associate receiving records under one treatment, payment, and health-care-operations consent need not segregate or segment those records. That rule does not erase proceeding restrictions or resolve every later use and disclosure.

For access, treatment, payment, operations, analytics, research, legal demand, law enforcement, employment, payer activity, redisclosure, retention, or deletion, record the new purpose, authority, user, data, recipient, and dates. Preserve the original notice and provenance through derived reports, summaries, and copies.

Correct failed notice delivery

If a notice is missing, truncated, detached, or unverified, contain further use and redisclosure. Preserve logs and payloads, notify privacy and legal owners, and determine the affected records and recipients. Correct the workflow and assess incident or breach obligations. Do not add a notice retroactively and treat that alone as proof the original disclosure was compliant.

Example

Sixteen direct disclosures are reviewed. Thirteen have matched sender, recipient, record, authority, purpose, notice, and delivery evidence; three have an unverified notice field. Completeness is 13 of 16 disclosures.

Record and verify the recipient decision

Classify each disclosure as complete, corrected before delivery, contained after a notice failure, or unresolved. State the source, recipient, data, authority, notice version, consent scope, endpoint, delivery evidence, owner, and next action. Keep unresolved records from further use or redisclosure while qualified reviewers determine the response.

After correction, test the same channel with the real file type and recipient view. Confirm that the notice and scope explanation remain visible after download, forwarding, import, or replay and that the audit log connects them to the disclosed record.

Include a manual fallback for outages and unsupported formats. The fallback should identify who adds the notice, which version applies, how the consent scope travels, how delivery is confirmed, and where the disclosure evidence is retained. Test that route separately because an automated-channel result does not validate a manual release.

Notified-recipient checklist

• identify sender class, recipient, record set, purpose, authority, and endpoint;
• attach an approved section 2.32 notice and consent copy or scope explanation;
• test display and durable delivery across every manual and automated channel;
• preserve notice, provenance, copies, derived outputs, and recipient classification;
• apply a new authority gate to later use, redisclosure, proceedings, and retention; and
• contain, investigate, and correct missing or defective notices.

A notice does not itself authorize the original disclosure or every later action. Current Part 2, consent, recipient status, HIPAA, state law, contracts, and the actual data flow require qualified review.