Part 2 prescription-monitoring disclosure

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.36 permits a Part 2 program or other lawful holder to report SUD medication prescribed or dispensed by the Part 2 program to the applicable state prescription drug monitoring program when applicable state law requires the report. The discloser must obtain patient consent under section 2.31 before reporting. Program or lawful-holder status, medication source, state mandate, recipient, and prior consent all remain gates.

All conditions travel together

Current 42 CFR 2.36 names the discloser, medication source, recipient, state-law condition, and prior-consent requirement. Build one release gate that verifies each element rather than treating PDMP reporting as a general exception to Part 2.

Map the report to its source

Preserve the patient, program, lawful-holder role, prescription or dispensing event, medication, quantity and units required by the current state rule, prescriber or dispenser, service date, consent, PDMP, submission, response, correction, and reviewer.

Keep adjacent duties separate

The consent must meet 42 CFR 2.31. State controlled-substance, pharmacy, prescriber, licensing, PDMP, privacy, minor, and retention rules may add duties. They do not silently remove the federal consent gate; route conflicts to qualified counsel.

Classify the sender and event

Document whether the sender is the Part 2 program or another lawful holder, how the holder received the information, and which program prescribed or dispensed the SUD medication. Preserve patient, medication, event type, responsible professional, facility, date and time, source record, corrections, and reviewer.

Do not infer a qualifying event from a claim, medication list, intake note, outside prescription, or pharmacy history alone. Resolve who actually prescribed or dispensed and whether section 2.36 covers that source.

Verify the current state mandate

Identify the applicable jurisdiction and controlling statute, regulation, board rule, agency instruction, and technical specification. Record covered roles, medications, events, fields, exclusions, deadline, effective dates, and hierarchy among sources. State PDMP requirements can change independently of Part 2.

Use primary state sources and qualified pharmacy, prescribing, privacy, and legal review. A vendor configuration or multistate summary is useful for monitoring but is not the final authority.

Obtain consent before reporting

Validate consent meeting 42 CFR 2.31 before transmission. Match the patient, discloser, meaningful information, applicable PDMP recipient, purpose, revocation, expiration, signature, date, and representative authority to the actual report. Preserve the signed version and current state.

If state law requires reporting but valid Part 2 consent is absent or disputed, hold automated release and route the conflict to qualified owners. Do not hide the conflict through a generic system override.

Control the payload and destination

Map the state-required fields to the verified program prescribing or dispensing record and the signed scope. Exclude unrelated medications, counseling notes, diagnoses, payer data, attachments, and free text. Inspect hidden segments, metadata, logs, vendor transformations, and the actual outbound message.

Authenticate the applicable state PDMP, account, production endpoint, intermediary, certificate, environment, and acknowledgment. Keep interstate and hub routing visible in the recipient and consent analysis.

Reconcile reporting and corrections

Link the legal rule version, consent, source event, payload, submission, response, rejection, retry, correction, and final status. Use idempotency and version controls so technical retries do not create duplicate or stale reports. Reconcile PDMP acknowledgments to local records.

Audit required events, completed reports, consent holds, exclusions, errors, corrections, downtime reports, and late submissions. Investigate missing consent, wrong state, wrong program source, excess data, misroutes, rejected messages, and uncorrected records.

Assign a named owner for each unresolved report and define when clinical, pharmacy, privacy, technical, or legal staff must join. Give patients a contact for consent and correction questions without exposing PDMP credentials or internal security detail. Review error trends with the state authority or integration vendor through approved channels, then update mapping, training, and tests. A closed technical ticket should not close the compliance record until the PDMP state and local source agree.

Example

Sixteen proposed reports reach review. Thirteen have a qualifying discloser, program-originated SUD medication, current state mandate, applicable PDMP, valid consent, approved fields, and submission evidence; three lack consent. Release readiness is 13 of 16 reports.

Prescription-monitoring checklist

• verify Part 2 program or lawful-holder status and the program-originated event;
• anchor the mandate to current primary state law and technical requirements;
• obtain and validate section 2.31 consent before any transmission;
• limit fields to the state requirement, source event, and signed scope;
• authenticate the applicable PDMP and every routing intermediary; and
• reconcile acknowledgments, retries, corrections, holds, downtime, and audit evidence.

PDMP reporting under this route requires the state and federal conditions to work together. One does not silently replace the other.