Part 2 public-health disclosure

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.54 permits a Part 2 program to disclose records for public health purposes without patient consent only when the disclosure is to a public health authority as defined in Part 2 and the disclosed content is de-identified under 45 CFR 164.514(b) so there is no reasonable basis to believe it can identify a patient. Recipient and output are independent gates.

Verify the two conditions

Current 42 CFR 2.54 requires a qualifying recipient and de-identified content. Record the authority, legal mandate or function, request, purpose, dataset, method, reviewer, release version, secure route, date, and evidence. A public-interest purpose alone does not satisfy the rule.

Test the released output

Review direct identifiers, dates, geography, rare conditions, small cells, free text, images, device identifiers, linkage keys, metadata, companion files, and combined datasets. Preserve the exact export rather than treating a source-table label as proof.

Use a recognized method

Current 45 CFR 164.514(b) describes expert determination and Safe Harbor. Record which method applies, its documentation, assumptions, actual-knowledge assessment where relevant, data version, changes, and re-review trigger.

Confirm the sender, purpose, and recipient

Document that the sender is a Part 2 program, the proposed activity is for public health purposes, and the destination meets the cross-referenced public-health-authority definition. Preserve the authority, official mandate, request, purpose, legal source, recipient contacts, any agent or contractor relationship, and qualified reviewer.

A socially beneficial project, registry, university, nonprofit, quality initiative, payer, vendor, or research study does not qualify by description alone. Resolve the actual recipient and function.

Select a de-identification method

Use one of the methods in 45 CFR 164.514(b): a documented expert determination using appropriate statistical and scientific principles, or Safe Harbor with the specified identifiers removed and the required actual-knowledge condition. Record the method, qualifications where relevant, inputs, assumptions, code or procedure, controls, date, and approval.

Obtain qualified privacy, de-identification, and legal review for how the cross-reference applies to the specific Part 2 program and dataset. Removing names or calling a file aggregate is not enough.

Inspect the exact output

Review direct identifiers, dates, locations, ages, rare diagnoses or events, small cells, provider and facility patterns, free text, images, audio, device and network data, URLs, account values, linkage keys, filenames, metadata, logs, companion files, and outputs combined from multiple tables. Preserve the final dataset version or protected integrity record.

Test transformations and suppressions after joins, filters, exports, formatting, and vendor processing. A de-identified source table can produce an identifying output when combined or narrowed.

Control transfer and recipient use

Authenticate the authority and any intermediary, approve a secure route, limit users and access, record the exact release, and preserve acknowledgment. Contractual and security controls can reduce risk, but they do not substitute for section 2.54's de-identified-content condition.

Analyze separate state public-health, privacy, research, security, data-use, and records requirements. If identifiable records are needed, use another supported authority rather than stretching this no-consent route.

Reassess and audit

Trigger review when data, schema, code, population, geography, time range, rare events, external information, linkage ability, recipient, purpose, access, or public-release status changes. Version expert determinations, Safe Harbor evidence, transformations, and approvals.

Audit proposed, approved, blocked, corrected, and recurring disclosures. Investigate misclassified recipients, unreviewed intermediaries, free text, small cells, stale methods, mismatched outputs, unexpected linkage, and datasets released outside the approved route.

Create a release record that a second reviewer can reproduce without opening the identifiable source unnecessarily. It should identify the approved purpose, authority and agents, method evidence, transformation version, output integrity value, recipient route, controls, decision, and date. Keep a protected path for the underlying evidence and separate it from the de-identified deliverable. When a recipient requests clarification, answer from the approved output or rerun review rather than sending source rows through email or support tickets.

Example

Thirteen proposed public-health releases reach review. Ten have verified authority status, a documented de-identification method, inspected output, no-reasonable-basis decision, purpose, route, and evidence; three contain unreviewed free text. Readiness is 10 of 13 releases.

Public-health disclosure checklist

• verify Part 2 program status, public health purpose, and qualifying authority;
• map every agent, intermediary, request, legal function, and destination;
• apply and document expert determination or Safe Harbor to the release version;
• inspect fields, combinations, free text, metadata, companion files, and linkage risk;
• authenticate and secure the transfer while preserving output and acknowledgment; and
• reassess changed data, code, populations, recipients, purposes, and external context.

The route is narrow by design. Public health purpose and de-identified content must both be supported before patient consent can be omitted.