Part 2 patient-access criminal-use restriction

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.23(b) keeps information obtained through patient access subject to the restriction in 42 CFR 2.12(d)(1). That restriction bars using or disclosing covered records to initiate or substantiate criminal charges against the patient or to conduct a criminal investigation of the patient, absent the authority Part 2 requires. Receiving a copy through patient access does not strip that provenance.

Access does not erase the protection

Current 42 CFR 2.23(b) carries the criminal-use restriction forward after patient access. Record provenance so a later holder or responder can identify that the material came from Part 2 records and route legal process correctly.

Protect each delivery route

Address paper copies, downloads, portals, email, personal representatives, designated recipients, lawyers, correctional settings, cloud storage, device loss, subpoenas, testimony, and law-enforcement requests. Use qualified counsel for any investigation or proceeding.

Separate access from legal response

The 2024 final rule is the current rulemaking source. Patient access staff can fulfill an access request. Privacy and legal owners evaluate later demands, consent, court orders, prohibitions, notice, sealing, objections, and production.

Preserve provenance across every copy

Link paper, portal, download, export, message, and representative copies to the source Part 2 record and access event. Keep patient, program, record range, date, format, recipient, delivery route, access basis, and restriction metadata in a protected log. Use a concise handling notice where qualified reviewers determine it is appropriate.

Copies may move into personal devices, cloud storage, legal files, correctional settings, benefits matters, employment disputes, family litigation, or other systems. The organization cannot control every later action by a patient, but it should avoid producing an unlabeled or untraceable copy that its own teams or vendors later mistake for ordinary evidence.

Recognize prohibited criminal uses

The current section 2.12(d)(1) restriction addresses initiating or substantiating criminal charges, conducting criminal investigation, introducing records or related testimony, informing decisions in proceedings, law-enforcement purposes, and warrant applications, unless Part 2's required consent or court-order authority exists. It applies regardless of whether the record was obtained through patient access.

Do not infer that a patient's possession, voluntary sharing, public filing, or prior disclosure creates a general waiver. Counsel should analyze the exact record, act, recipient, proceeding, consent, order, and other law.

Route demands away from the access team

Centralize subpoenas, warrants, law-enforcement inquiries, testimony requests, discovery, correctional requests, and informal contacts. Access staff should preserve the demand and avoid confirming patient status or producing from the access queue. Privacy and counsel determine Part 2 status, validity, consent, applicable subpart E route, notice, objections, sealing, and scope.

Issue a hold when appropriate while authority is resolved. Preservation is distinct from disclosure. Prevent automated legal-hold or e-discovery tools from sending access copies to outside reviewers without the approved legal path.

Control approved responses and incidents

When production is legally authorized, use the exact approved set, recipient, secure method, redactions or limits, accompanying notice, and deadline. Preserve the authority, reasoning, delivery, receipt, and later use conditions. Reanalyze amendments or added testimony from the beginning.

If an access copy is used or disclosed for an unauthorized criminal purpose, contain further access, preserve evidence, notify privacy, security, and counsel, identify recipients and proceedings, evaluate required mitigation and notices, and document correction. Avoid destroying material subject to a legal hold.

Test the boundary in practice

Sample legal requests involving patient-access copies. Verify provenance, neutral intake, hold, qualified review, consent or court order, objections, approved set, use limits, delivery, and closure. Train records, portals, vendors, legal operations, security, and clinical staff on the escalation trigger.

Example

Nine legal requests involve copies previously provided through access. Seven preserve provenance, hold the records, route counsel, document the Part 2 analysis, and close the response; two enter ordinary subpoena production. Readiness is 7 of 9 requests.

Criminal-use restriction checklist

• preserve Part 2 provenance for every access copy, export, portal event, and representative;
• identify criminal investigation, charge, evidence, proceeding, testimony, and warrant uses;
• centralize demands and keep access staff and automated tools from producing directly;
• distinguish preservation from disclosure and require the proper consent or court-order route;
• control and document every approved production, recipient, notice, limit, and amendment; and
• investigate unauthorized use, mitigate it, retain evidence, and repair controls.

Patient access expands the patient's ability to inspect and copy. It does not convert protected SUD records into unrestricted criminal evidence.