Part 2 program-order patient-use prohibition

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.66(d)(2) prohibits using or disclosing information obtained under a program-investigation order to investigate or prosecute a patient in a criminal matter. It also prohibits using that information as the basis for an application under section 2.65. The restriction follows source information and its derivatives across teams and systems.

The prohibition applies to two patient pathways

42 CFR 2.66 prohibits direct criminal investigation or prosecution of a patient and use as the basis for a patient-order application. Tag source records, derivatives, reports, testimony, leads, queries, exports, and notes so recipients can identify the restriction.

Separate teams do not erase provenance

A referral to another unit, prosecutor, task force, vendor, analyst, or database remains a use or disclosure. Prevent patient-focused searches, alerts, watchlists, scoring, investigative leads, or testimony from this source. Route questionable contacts to qualified Part 2 counsel.

Monitor outputs and later requests

Review agency reports, public documents, court filings, discovery, subpoenas, cross-matter access, and retention or destruction. Record every downstream request and decision. Investigative value to a patient case cannot supply the missing authority.

Mark the protected provenance

Tag source records, fields, testimony, exports, reports, notes, leads, quotations, attachments, and derivative datasets with the section 2.66 matter and patient-use restriction. Preserve order version, purpose, recipients, access history, and lineage. Keep the marker visible when content is copied, summarized, transformed, or moved.

Separate program-side subject information from patient-identifying information wherever technically and legally feasible. Access to one does not create authority for the other.

Block patient-focused actions

Prevent patient searches, profiles, alerts, watchlists, referrals, warrants, charging decisions, subpoenas, testimony, or investigative leads based on protected program-order information. A transfer to another unit, prosecutor, task force, contractor, data warehouse, or analyst remains a use or disclosure.

Configure purpose-bound access and query monitoring where systems allow. Route uncertain requests to qualified Part 2 counsel before anyone confirms or shares a fact.

Evaluate downstream requests

Record requester, purpose, source, records, proposed action, other evidence, and decision. Check whether apparently independent evidence was located, shaped, or verified through the protected source. Do not use the section 2.66 material as the basis for a patient-order application under section 2.65.

Legal process directed to the holder does not automatically overcome the prohibition. Preserve it and use the designated counsel-controlled response route.

Audit and contain incidents

Review access logs, searches, reports, referrals, court filings, public documents, cross-matter transfers, vendor activity, retention, and disposition. Sample derivatives and recipient systems, not only the original production. Reconcile amendments and closure across all labeled copies.

If patient-focused use occurs, stop further activity, preserve evidence, restrict access, notify counsel and privacy owners, assess correction and notification duties, and document remediation. Avoid spreading the information while investigating the event.

Test claims of independent evidence

Require a source chronology for any patient-related fact that resembles program-order material. Record when the other evidence was obtained, who found it, which search or referral produced it, and whether protected information shaped the question, location, verification, or decision. Counsel should assess independence before use. A later public source or separate witness may still be derivative if the protected record directed investigators to it.

Keep the independence decision with the proposed action and supporting sources. If provenance remains uncertain, maintain the block and seek a ruling or other qualified legal direction before proceeding.

Revisit the decision when new source or access evidence appears.

Example with downstream leads

Eight proposed leads derive from program-order information. All eight concern patients rather than the program-side subjects. Patient-use release readiness is 0 of 8 leads; each is blocked and legally routed.

Owner controls

The 2024 final rule supplies current protection. Use provenance labels, purpose-bound access, cross-matter blocks, recipient notices, query monitoring, legal-demand intake, incident response, and periodic audits.

Patient-use-firewall checklist

• label protected source information and every derivative with its provenance;
• separate program-side evidence from patient-identifying content;
• block patient searches, leads, referrals, warrants, charges, and testimony;
• test transfers, apparently independent evidence, and section 2.65 requests;
• monitor recipients, systems, vendors, reports, and public outputs; and
• contain, assess, correct, and document any prohibited patient-focused use.

The firewall follows the information rather than an organizational chart. New teams, formats, or case numbers do not remove the restriction.