Part 2 researcher redisclosure limit

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Receipt carries Part 2 duties

42 CFR 2.52 states that the researcher is fully bound by Part 2 and, when necessary, resists judicial efforts to gain access except as the regulation permits. Agreements should identify legal-demand routing, preservation, response authority, and the bar on voluntary production outside a valid pathway.

Before receipt, name the principal investigator, institution, approved users, systems, protocol, data set, source, purpose, sites, subcontractors, and dates. Put the researcher duties into the data-use agreement, access configuration, training, incident plan, and project closeout. A contract clause without technical or operational enforcement is incomplete.

Route subpoenas, warrants, discovery, public-record requests, regulator demands, litigation holds, and informal lawyer or law-enforcement contacts to designated counsel immediately. Preserve the demand and data without producing it unless the current Part 2 process permits the response.

Reports require aggregate deidentified data

Research reports may include Part 2 data only in aggregate form deidentified under 45 CFR 164.514(b) so there is no reasonable basis to believe it identifies a patient. A study code, removed name, small cell, or internal pseudonym does not by itself establish compliant de-identification.

Create an output-review process for tables, figures, abstracts, manuscripts, presentations, dashboards, model outputs, appendices, code repositories, demonstrations, and public data. Review direct and indirect identifiers, rare conditions, dates, geography, small groups, quotations, free text, images, and combinations that can reveal a person.

Preserve the de-identification method, qualified analysis where used, transformations, cell rules, reviewer, version, and release decision. A sponsor, journal, conference, or open-science requirement does not override the Part 2 reporting condition.

Restrict redisclosure and new uses

Inventory every destination, user, vendor, collaborator, cloud service, backup, analytics platform, code environment, and transfer. Prevent onward sharing for another study, teaching, product development, general repository use, AI training, recruitment, marketing, or law enforcement. A new protocol or collaborator requires qualified review before access.

The rule's source-return and approved linkage routes should be represented explicitly. Keep linkage keys, direct identifiers, analytic data, outputs, and source communications in governed locations. Do not treat an internal affiliate or sponsor as part of the original recipient automatically.

Security, destruction, and retention coexist

Maintain and destroy patient-identifying information under the Part 2 security policies in 42 CFR 2.16. Retain records as federal, state, and local law requires. Define which records are research data, regulatory evidence, consent or waiver records, linkage files, and destruction evidence.

Use an information inventory with copy owner, purpose, location, format, encryption, access, backup, retention source, hold, disposition date, method, and evidence. Reconcile laptops, removable media, email, collaboration tools, cloud snapshots, logs, derived files, and vendor copies. Sanitization should make disposed information non-retrievable under the applicable control.

Retention and destruction can point in different directions for different artifacts. Qualified research, legal, privacy, and records owners should resolve the schedule without keeping identifiable analytic copies “just in case” or destroying required oversight evidence.

Monitor and respond

Review access, exports, failed logins, added users, new tools, output submissions, legal demands, incidents, protocol changes, and inactive projects. Suspend transfer and access when approval, agreement, security, or recipient status expires.

If unauthorized use, redisclosure, or exposure occurs, contain access, preserve evidence, identify people and copies, and route privacy, security, research, legal, clinical, and patient communication decisions. Review other projects using the same recipient, vendor, or environment.

Example with researcher controls

Ten recipient plans are reviewed. Eight cover redisclosure, reporting, de-identification, security, destruction, retention, and legal demands; two omit material duties. Control readiness is 8 of 10 plans.

The institution adds a legal-demand route and complete copy inventory to one plan. The other project remains held because its cloud vendor can reuse data. The eight approved plans proceed with named users and output review while the original measure stays visible.

Researcher-duty checklist

• Name every user, system, vendor, purpose, copy, and project date.
• Restrict redisclosure to the supported Part 2 pathways.
• Review all reports and outputs for aggregate de-identification.
• Route legal demands through designated Part 2 counsel.
• Reconcile security, retention, destruction, and legal-hold duties.
• Suspend access on approval, agreement, or protocol expiry.
• Contain unauthorized use and examine related projects or environments.

Owner controls

The 2024 final rule supplies current context. Use recipient agreements, approved environments, access review, export limits, report disclosure review, de-identification evidence, retention schedules, destruction certificates, and demand escalation.

Monitor users, exports, outputs, redisclosure requests, new vendors, legal demands, retention exceptions, destruction, inactive projects, and incidents. Audit from every copy and public output back to approved purpose and control evidence, then from recipient environments into current access. Retest after protocol, platform, staffing, vendor, or legal-process changes.