Part 2 researcher and auditor order exclusion

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.62 provides that a Part 2 court order may not authorize qualifying researchers, auditors, or evaluators that received patient-identifying information without consent to disclose it or use it for a criminal investigation or prosecution of a patient. Section 2.66 may separately authorize use or disclosure to investigate or prosecute the person holding the records.

The exclusion protects patient data received for limited work

42 CFR 2.62 applies to recipients meeting the cited research criteria in 42 CFR 2.52 and audit or evaluation recipients under 42 CFR 2.53. Record the original source, consent status, recipient category, project, data set, purpose, and downstream request.

A criminal-use request should trigger a stop

Block disclosure, access expansion, search, export, testimony, or analytic work aimed at investigating or prosecuting a patient. Preserve the demand and data, restrict the matter, and route it to qualified Part 2 counsel. Avoid voluntary cooperation that bypasses the exclusion.

Recipient investigation is a different pathway

The rule preserves the possibility of an order under 42 CFR 2.66 to investigate or prosecute the researcher, auditor, evaluator, program, or other holder. That authority cannot be repurposed to investigate or prosecute a patient and carries separate findings and scope limits.

Confirm the original recipient and pathway

Document the researcher, auditor, or evaluator, the exact eligibility criteria and Part 2 provision used, source program or holder, data, patient-identifying content, purpose, agreement, date, systems, users, and whether consent was absent. Trace subsequent copies and subcontractors. The exclusion depends on the qualifying receipt, not a generic research or audit label.

Separate records received with consent or through another pathway and analyze them independently.

Classify the proposed use

Identify the requester, investigation, subject, target, offense, proceeding, purpose, records, and intended recipients. Determine whether the request would disclose the protected information or use it to conduct a criminal investigation or prosecution of a patient. Do not relabel law-enforcement analytics, evidence development, referral, or testimony as evaluation.

Preserve the facts and counsel's analysis without exposing more patient information to the applicant.

Enforce the patient prohibition

Block queries, exports, matching, testimony, reports, and staff access that would support the prohibited patient investigation or prosecution. Keep identity keys, linkages, source files, backups, and derived outputs under the original purpose restrictions. A court-order request does not suspend section 2.62 while pending.

The 2024 final rule confirms the current structure. Use the operative eCFR and specific source pathway for the decision.

Distinguish investigation of the holder

When the proposed target is the researcher, auditor, evaluator, program, or other holder rather than a patient, section 2.62 points to the separate section 2.66 order pathway. Route that matter to experienced counsel. Verify target, jurisdiction, material evidence, notice, findings, scope, public identity protection, and patient-use prohibition under the applicable provisions.

Do not use a holder investigation as a pretext to build a case against a patient or as a basis for a patient order.

Govern and audit the data

Maintain an inventory of nonconsensual research, audit, and evaluation datasets, legal bases, data, identities, users, keys, outputs, contracts, retention, and destruction. Tag prohibited law-enforcement purposes and restrict legal-response and vendor workflows. Train recipients on escalation.

Audit requests, user access, external disclosures, queries, data matching, subpoenas, orders, testimony, publications, retention, and termination. Investigate any patient-directed use, contain it, preserve evidence, assess duties, and correct controls.

Example with downstream demands

Seven criminal-use demands reach research or audit recipients. All seven involve data originally received without patient consent for the limited project. Patient criminal-use release readiness is 0 of 7 demands; each remains blocked and legally routed.

Owner controls

The 2024 final rule supplies current protection. Use provenance tags, consent-status fields, recipient-pathway codes, legal-demand stops, environment segregation, export controls, counsel review, and incident escalation.

Researcher-and-auditor checklist

• prove the qualifying nonconsensual research, audit, or evaluation receipt;
• identify the requested use, disclosure, investigation target, and recipients;
• block criminal investigation or prosecution of a patient through this data;
• use the separate current pathway for a supported investigation of the holder;
• protect identity keys, derived outputs, vendors, backups, and testimony; and
• audit access, requests, legal process, matching, retention, and incidents.

The exclusion protects patient-directed law-enforcement use. It does not immunize a qualifying holder from a properly authorized investigation of its own conduct.