Part 2 referral-and-intake information coverage

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The live coverage explanation in 42 CFR 2.12(e)(1) expressly includes identifying referral and intake information about patients receiving SUD diagnosis, treatment, or referral for treatment when created by a Part 2 program. It also lists treatment or rehabilitation programs, employee-assistance programs, programs in general hospitals, school-based programs, and qualifying private practitioners as examples of covered settings. eCFR displays section 2.12 as current through August 20, 2026 and last amended August 13, 2026. The HHS Part 2 fact sheet confirms the February 16, 2026 compliance date for the 2024 amendments.

Coverage can begin before treatment sessions

The coverage explanation expressly includes referral and intake information. Map the program, patient status, service purpose, identifying content, source, creator, system, date, disposition, federal-assistance status, and relevant historical period.

Collect for a defined intake decision

Limit each field to an identified routing, safety, access, clinical, payer, or scheduling purpose. Separate inquiry, clinical assessment, program acceptance, waitlist, referral, authorization, scheduling, and first service. Give each state an owner and access rule.

Control every intake surface

Review web forms, phone systems, voicemail, email, portals, referral networks, faxes, spreadsheets, CRM queues, analytics, backups, vendors, exports, and deletion paths. Route emergency and mandated-reporting events through applicable procedures.

Decide when a contact enters the covered workflow

Map the program, service, federal-assistance status, holding out, creator, patient or prospective-patient state, contact purpose, information, date, and system. Distinguish a general anonymous inquiry from an identifying referral or intake record created for SUD diagnosis, treatment, or referral. Record the supported trigger instead of assigning every website visit or phone call one label.

Define states such as inquiry, referral received, outreach attempted, screening, assessment, accepted, waitlisted, referred elsewhere, declined, no response, scheduled, and admitted. Give each state an owner, permitted purpose, access group, retention rule, communication template, and transition evidence.

Minimize collection and exposure

For each field, name the routing, safety, access, clinical, payer, or scheduling decision it supports. Delay sensitive detail until it is needed. Configure neutral messages and caller identification so voicemail, text preview, email subject, calendar, referral status, and portal notification do not reveal SUD program contact to an unverified person.

Review forms, call recordings, voicemail, fax, email, portals, referral networks, customer-relationship systems, spreadsheets, waitlists, analytics, pixels, chat, artificial-intelligence tools, backups, vendors, and exports. Apply QSO, business-associate, consent, security, and state-law review to each actual data path.

Plan disposition and correction

Define how duplicates, wrong-person referrals, minors, guardians, custody disputes, failed outreach, misdirected records, declined services, out-of-area requests, emergencies, and mandated reports are handled. Preserve the source and correction history without leaving unnecessary copies in shared inboxes.

Audit intake surfaces for program identification, access, inactive accounts, data fields, vendor handling, notice, retention, deletion, and incident response. Test one record through every disposition and record gaps with an owner and due date.

Example

Eighteen intake surfaces are inventoried. Fifteen have program-status, data, purpose, access, retention, vendor, and disclosure controls; three are legacy mailboxes. Control completeness is 15 of 18 surfaces.

Decide what happens to each intake record

Assign every intake state a documented outcome: retained for an active supported purpose, transferred to a named program or provider, restricted while facts are resolved, corrected, or disposed of under the approved schedule. Record the person, source, program, status, data, authority, owner, dates, systems, copies, and next action.

For an abandoned or declined intake, determine which information must remain for legal, clinical, safety, audit, or operational reasons and remove unnecessary copies. For a wrong-person or misdirected referral, contain access, authenticate the intended recipient, preserve correction history, and complete incident review.

Verify outcomes in the live systems. Search shared mailboxes, downloads, exports, vendor consoles, reports, backups, and queues for lingering copies. A closed intake status does not prove that the underlying data was retained or deleted correctly.

Retain the search result and corrective evidence.

Referral-and-intake checklist

• map program status, contact type, creator, identifying data, purpose, and trigger;
• define intake states, owners, access, transitions, communications, and retention;
• collect only information needed for the next supported decision;
• protect caller identity, messages, forms, queues, vendors, analytics, and exports;
• handle wrong-person, duplicate, minor, emergency, and declined-service records; and
• test every surface and disposition with corrective follow-up.

Coverage depends on the program, person, information, purpose, and creation facts. Current Part 2, HIPAA, state law, minor and custody rules, and the proposed use or disclosure need qualified review.