Part 2 PDMP consent prerequisite

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.36 states that a Part 2 program or other lawful holder must obtain patient consent under 42 CFR 2.31 before reporting records to a prescription drug monitoring program. The timing is explicit. A state mandate, treatment relationship, intake signature, or PDMP enrollment cannot substitute for the required consent.

Consent comes before transmission

Current 42 CFR 2.36 states that consent must be obtained prior to reporting. Capture the signed version, authority, date and time, patient, discloser, PDMP recipient, information, purpose, expiration, revocation state, and the release linked to it.

Do not treat registration as consent

Patient enrollment, intake signatures, a general privacy acknowledgment, pharmacy pickup, portal use, benefit verification, PDMP account setup, or an employment agreement does not establish the required Part 2 consent. Test the actual instrument.

Apply the consent standard

Current 42 CFR 2.31 supplies the required elements and defect rules. Hold the report for a missing, expired, deficient, materially false, or known-revoked consent. Qualified owners should resolve conflicting state obligations.

Prepare a specific, understandable consent

Identify the patient, authorized discloser, meaningful medication and reporting information, applicable PDMP recipient or permitted designation, reporting purpose, revocation right and method, expiration, signature, date, and representative authority. Present the language in a form the patient can understand and preserve accessibility or interpreter support.

Do not bury the consent in a general privacy acknowledgment, pharmacy terms, portal agreement, treatment consent, or broad release that does not meet section 2.31.

Validate before every transmission

Match the signed record to the actual patient, program or lawful holder, medication event, state PDMP, data fields, purpose, and reporting time. Confirm the consent is complete, current, unrevoked, and free from a known material defect or false statement. Preserve the matched values and reviewer.

Consent status should be evaluated at transmission, including queued, retried, corrected, and downtime reports. A consent that was current when the event occurred may no longer support a later transmission.

Propagate revocation and expiration

Give patients a usable written-revocation path and capture receipt, identity, consent version, processor, affected systems, open reports, and implementation evidence. Stop new reports relying on that consent according to the governed legal and operational process. Preserve earlier completed activity separately.

Use versioned status, acknowledgments, exception queues, and reconciliation across EHR, pharmacy, interface, vendor, and manual workflows. A consent flag in one application is incomplete if a batch export still transmits.

Handle the state-law conflict visibly

When applicable state law requires a report and Part 2 consent is missing, deficient, revoked, or disputed, block or hold the release and escalate promptly to Part 2 privacy, state PDMP or pharmacy expertise, and experienced counsel. Preserve both sources, event facts, timing, decision, and communication.

Avoid workarounds that relabel the report, suppress the Part 2 origin, or send through another account. Operational pressure does not resolve the legal conflict.

Audit forms and releases

Review consent templates, translated versions, signature authority, patient presentation, matching logic, revocations, expirations, overrides, reports, retries, corrections, and downstream copies. Include patients who declined or did not complete consent so reporting gaps are visible without treating declination as a defect.

When an unsupported report occurs, contain it, preserve the signed form and payload, identify recipients, assess notification and correction duties, repair the workflow, and test remediation.

Track how long valid consent takes to reach every reporting system and how often staff encounter mismatches. Review the denominator of due reports, not only those successfully transmitted. Separate patient declination, incomplete consent, identity conflict, expired form, revocation, technical delay, and legal hold so operational pressure does not collapse different decisions into one override category. Use those findings to improve forms, explanations, routing, and escalation.

Example

Twenty reports are due under a configured state rule. Seventeen have consent that matches the patient, discloser, PDMP, information, purpose, dates, and signature; three rely on a general release. Consent readiness is 17 of 20 reports.

PDMP consent checklist

• use a section 2.31 consent that clearly describes discloser, information, recipient, and purpose;
• preserve signature, date, authority, expiration, revocation, and patient presentation;
• match consent to every original, retry, correction, batch, and downtime transmission;
• propagate written revocation and expiration across all dependent systems;
• block and escalate conflicts with a state reporting mandate; and
• audit templates, status, overrides, declined forms, payloads, incidents, and fixes.

Consent is a pre-transmission control. Its completeness and current state must be visible in the same workflow that sends the report.