Part 2 patient definition

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The HHS Part 2 final-rule fact sheet summarizes the 2024 changes to consent, patient rights, notices, complaints, and breach notification, with applicable compliance required by February 16, 2026. The published final rule provides the rulemaking record. The live eCFR definition includes applicants, current patients, former patients, and the specified post-arrest eligibility group, so current-census logic alone cannot identify every protected record.

Application can be enough

42 CFR 2.11 reaches people who applied, even before treatment begins. Record the program, application or service event, date, purpose, status, source evidence, and applicable HIPAA context without exposing the person's status broadly.

Former status remains within the definition

Discharge, denial, withdrawal, transfer, death, long inactivity, or record archiving does not erase the historical classification. Apply current authority, access, retention, complaint, court-order, and disclosure rules to the record event.

Post-arrest evaluation has a defined route

The definition includes a person identified after arrest to determine eligibility for a Part 2 program. Distinguish evaluation purpose, program status, legal authority, decision participants, records, and later uses.

Link patient status to a Part 2 program event

The definition requires an application for, or receipt of, SUD diagnosis, treatment, or referral at a Part 2 program. Record the exact program, legal entity, service or application event, date, source system, and evidence. A general relationship with a health system, an unrelated diagnosis, or a patient label copied from another affiliate does not answer whether this definition is met.

Protect the classification itself. A roster, work queue, file name, portal label, or support ticket that reveals application or service status can create privacy risk even when it contains little clinical detail. Limit access to people who need the information for an authorized role and purpose.

Include applicants and former patients

Coverage does not begin only after admission or a completed session. An application can bring a person within the definition when it is made to a Part 2 program for the covered SUD services. Record withdrawn, denied, waitlisted, referred, and incomplete applications accurately without using broad labels that imply facts not established.

Former-patient status also remains in the definition. Discharge, transfer, death, archived storage, or a long lapse in services does not erase the historical link between the person and the Part 2 program. Design retention, access, disclosure, incident, and legal-demand workflows so inactive records keep their classification.

Handle the post-arrest route carefully

The definition includes a person who, after arrest on a criminal charge, is identified as having an SUD to determine eligibility to participate in a Part 2 program. Preserve the evaluation purpose, program, source, participants, date, decision, and legal authority. Do not reuse that record for another proceeding or investigation without analysis of Part 2's current restrictions and any required consent or court order.

Separate related roles and authorities

When HIPAA applies, the rule connects “patient” with HIPAA's “individual” terminology, but Part 2 status, personal-representative authority, consent, access, and disclosure remain distinct questions. Verify who may act for the person under applicable law and which records are relevant to that authority. Family involvement or an emergency contact designation does not automatically establish access rights.

Define correction and appeal routes when systems assign the wrong status. Preserve the original entry, evidence reviewed, corrected conclusion, owner, and date rather than silently overwriting history.

Example

Fourteen identity records are reviewed. Eleven correctly map applicant, current, former, or post-arrest status with program evidence; three rely on a current census only. Completeness is 11 of 14.

Patient-definition checklist

• identify the exact Part 2 program and qualifying application or service event;
• include applicants, current patients, former patients, and the specified post-arrest group;
• protect status indicators in rosters, messages, logs, and archived records;
• verify personal-representative, consent, and disclosure authority separately;
• retain historical dates and evidence through transfer, discharge, or correction; and
• route proceeding, law-enforcement, and uncertain uses for current legal review.

The definition does not establish eligibility, consent authority, access rights, or a permitted disclosure. Those questions require their own Part 2, HIPAA, state-law, and fact-specific analysis by qualified reviewers.

For operational use, store the qualifying event, program, status category, effective date, source evidence, and privacy owner in a protected classification record. Expose only the minimum status needed for each workflow. When a correction occurs, notify systems and recipients that relied on the earlier label, evaluate any resulting access or disclosure issue, and retain a dated audit trail of the correction and follow-up.