Part 2 off-premises identification-card restriction

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.18 applies to required immediate possession away from Part 2 program premises. No person may require a patient in that setting to carry a card or other object that identifies the patient as having an SUD. The section separately allows required cards or identification objects on program premises. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended framework.

The rule focuses on required possession

Current 42 CFR 2.18 addresses an item a patient must carry while away from the Part 2 program. Record who requires it, where it must be carried, what it reveals directly or through an ordinary scan or label, and which alternative serves the operational purpose.

Check ordinary workflows

Assess transit, pharmacy, housing, school, employment, community services, referrals, off-site groups, emergency kits, appointment reminders, and digital credentials. A neutral identifier can still create risk when its issuer, text, color, logo, or linked display reveals SUD status.

Redesign the process

Use neutral credentials, minimum fields, private verification, optional patient-controlled storage, correct-recipient checks, secure digital presentation, staff training, loss response, and a channel for patient concerns. Verify other identification laws separately.

Identify the requirement, object, place, and inference

Record who issues or requires the item, whether possession is mandatory, and when and where the patient must carry or display it. Identify the operational purpose and what an ordinary observer, scanner, application, or connected system can infer. Review text, logo, color, program name, provider, barcode, QR code, radio-frequency tag, link, notification, issuer, and surrounding context.

Map the boundary of program premises for main sites, shared buildings, parking, transportation, mobile units, residential settings, off-site groups, pharmacy trips, school, work, court, community activities, and telehealth. Obtain qualified review for ambiguous locations rather than defining premises solely for convenience.

Inventory physical and digital objects

Include badges, cards, bracelets, lanyards, tokens, passes, medication or dosing cards, schedules, transport papers, key tags, housing documents, emergency cards, device lock screens, wallet passes, portal QR codes, check-in codes, and app notifications. A neutral numeric code may still reveal SUD status when paired with a named issuer or public lookup.

Review vendors and partner organizations that issue, scan, print, transport, or require an object. Their requirement can create the same patient risk even when the Part 2 program did not design the item.

Redesign around neutral verification

Use a general health-system or neutral credential, minimum information, private identity check, secure system lookup, one-time code, optional patient-controlled storage, or staff verification when feasible. Separate operational eligibility from visible SUD status and restrict scanner results to the authorized user and purpose.

Test with someone who knows the local program, a casual observer, a school or employer, a transportation provider, and a person scanning a lost item. Review misdelivery, screenshots, expired objects, shared devices, notification previews, and offline fallback.

Distinguish patient choice from required possession

A patient may choose to carry information for care, safety, or convenience. Document voluntary choice without conditioning treatment, transport, medication, housing, or another benefit on off-premises possession of an identifying object. Offer an accessible alternative and explain loss and exposure risks.

Give patients a route to question, replace, disable, or report an item without confirming SUD status to an unauthorized caller. After loss or exposure, disable lookup, preserve evidence, assess disclosure and breach duties, support the patient, correct the design, and test the repair.

Review burden and accessibility

Ask whether the neutral alternative works for people without smartphones, stable internet, literacy, English fluency, vision, hearing, memory, dexterity, or private device access. A privacy redesign should not create a barrier to medication, transport, entry, or care. Test the alternative with patients and frontline staff before retiring the old object.

Example

Thirteen off-site identification objects are reviewed. Ten are neutral, purpose-limited, privately verified, optional outside the program, and supported by loss procedures; three display the program's SUD service name. Readiness is 10 of 13 objects.

Off-premises object checklist

• identify issuer, requirement, purpose, object, premises boundary, and disclosure inference;
• inventory cards, badges, paper, tokens, tags, barcodes, apps, screens, and notifications;
• review partners and vendors that issue, scan, transport, or require the object;
• use neutral, minimum, private, and accessible verification alternatives;
• separate voluntary patient choice from a condition of service or benefit; and
• disable, investigate, support, remediate, and retest lost or revealing objects.

The rule addresses required immediate possession away from program premises. Other privacy, safety, identification, and access rules still need separate review.