Part 2 record definition

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The HHS Part 2 final-rule fact sheet describes current consent, redisclosure, breach, patient-right, notice, and proceeding protections, and confirms the February 16, 2026 compliance date. It also notes that the rule does not require segregation or segmentation of Part 2 data. The Federal Register final rule provides the adopted text and agency discussion. Whether records are segmented is a system-design choice; classification and applicable restrictions still follow the information and its source.

Format does not control the definition

42 CFR 2.11 reaches oral communication and operational media alongside clinical records. Map databases, notes, messages, calls, recordings, claims, attachments, images, paper, portals, analytics, logs, exports, and vendor-held copies.

The oral-treatment boundary is narrow

Information conveyed orally by a Part 2 program to a non-Part 2 provider for treatment with patient consent does not become a Part 2 record in that provider's hands merely because the provider writes it down. Preserve the facts supporting every element.

Other transmitted records keep their character

Records transmitted to a non-Part 2 provider remain Part 2 records in that provider's hands, although the provider may segregate them. Segregation supports control; it does not change the source classification.

Inventory information beyond the clinical chart

The definition covers information whether recorded or not, created, received, or acquired by a Part 2 program and relating to a patient. Clinical notes are only one part of the inventory. Include referral and intake data, billing, claims, scheduling, email, voicemail, texts, call recordings, portal messages, images, paper, spreadsheets, analytics, audit logs, support tickets, exports, and vendor-held copies.

Record source program, patient relationship, content, medium, system, owner, recipients, copies, derivatives, and dates. An enterprise data catalog that marks only the EHR can leave governed information exposed in ordinary operational tools.

Apply the oral-treatment boundary exactly

The eCFR states that information conveyed orally by a Part 2 program to a non-Part 2 provider for treatment purposes with patient consent does not become a Part 2 record in that provider's possession merely because the provider writes it down. Preserve evidence for every element: oral conveyance, sending program, non-Part 2 provider, treatment purpose, patient consent, receiving record, and date.

Do not extend that narrow result to a transmitted document, attachment, portal message, structured feed, recording, or another route. The regulation separately states that records otherwise transmitted to a non-Part 2 provider retain their character in the recipient's hands, although the provider may segregate them.

Follow copies and derivatives

Classification work should address downloads, copied text, screenshots, summaries, warehouse tables, reports, backups, model inputs, and vendor support artifacts. Determine whether each derivative contains or reveals information from the source record and what authority governs its use or disclosure. Data transformation, renaming, or movement to a general health record does not by itself erase provenance.

Apply access, consent, notice, redisclosure, proceeding, incident, retention, and disposition controls across the mapped lifecycle. Preserve labels and lineage when systems migrate so a receiving team does not mistake shared storage for ordinary unrestricted data.

Design practical record controls

Use data-classification fields that capture source, program status, consent or exception, restrictions, and owner without broadly exposing patient status. Test search, printing, bulk export, API, portal, analytics, legal-hold, and deletion workflows. Give workforce members a route to report misplaced records and correct classification with an audit trail.

Reassess when a new integration, vendor, archive, AI tool, or reporting process receives the data. The current use may be permitted while a later reuse needs different authority.

Example

Eighteen information flows are classified. Fourteen map source, medium, relation to a patient, recipient, consent, oral or transmitted route, and resulting status; four omit provenance. Completeness is 14 of 18 flows.

Part 2 record checklist

• inventory clinical, operational, oral, paper, message, analytics, and vendor information;
• retain source-program and patient-relationship provenance for copies and derivatives;
• document every element before applying the narrow oral-treatment boundary;
• distinguish oral conveyance from transmitted records that retain Part 2 character;
• test access, export, portal, backup, migration, incident, and deletion controls; and
• reauthorize new recipients, purposes, and downstream uses under current rules.

This definition does not decide whether a specific use or disclosure is permitted, whether information is de-identified, or which retention period applies. Current Part 2 provisions, HIPAA, state law, contracts, professional duties, and the facts require separate qualified review.

Keep a dated lineage record so reviewers can trace every governed copy back to its source program and authority.