Part 2 state authorization limit

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.20 prevents state law from authorizing any use or disclosure that Part 2 prohibits. A state permission can satisfy a state gate, but it cannot supply missing federal consent, court-order authority, or an applicable Part 2 permission. Each claimed source of authority must be tested within its own scope.

Identify what the state source actually does

Current 42 CFR 2.20 preserves Part 2's prohibitions against contrary state permission. Record the state authority, issuing body, action, recipient, purpose, record, conditions, date, and whether it permits, requires, or merely describes a process.

Find the Part 2 pathway

Map consent, TPO permission, medical emergency, audit, research, public health, child-abuse report, vital statistics, court order, or another applicable Part 2 route. Verify every condition and limit for the exact records and recipient.

Stop unsupported automation

The 2024 final rule is the current rulemaking source. Systems may surface sources and mismatches; an authorized privacy or legal role decides the pathway. Preserve the state source, Part 2 decision, hold, escalation, override, release evidence, and audit trail.

Classify the state document before relying on it

Identify whether the item is a statute, regulation, court rule, agency order, subpoena, license condition, payer instruction, contract, database requirement, form, manual, or guidance. Record issuer, jurisdiction, legal force, effective date, entities, data, recipient, purpose, prerequisites, and whether it permits, requires, or merely describes a process.

A familiar form or mandatory portal field may create the appearance of authority without resolving Part 2. Likewise, a contract allocates obligations between parties but cannot expand what governing law permits. Escalate ambiguous or conflicting instructions to privacy and counsel.

Locate a complete Part 2 route

Map the proposed act to the current federal provisions for consent, treatment, payment, health care operations, medical emergencies, audits and evaluations, research, public health, child-abuse reporting, vital statistics, patient access, legal process, or another supported pathway. Confirm that the provision covers the holder, records, recipient, purpose, and timing.

Verify every required condition, including form elements, limits, minimum information, documentation, notice, recipient obligations, order findings, security, and later use. A route that fits the topic but lacks a required condition is not ready for release.

Use a dual-gate decision record

For each request, show the state source and result beside the Part 2 source and result. Record facts, source versions, scope, exceptions, conflicts, reviewer, approval, release set, withheld set, transmission method, recipient verification, and closure. Attach the actual authorization, order, or other evidence rather than only a yes-or-no field.

Systems can block unsupported releases and prompt for required evidence. They should not infer a legal conclusion from request type, payer, agency, or form name. Limit override authority, require a reason and approver, and audit patterns that repeatedly bypass the federal gate.

Manage urgent and compelled requests safely

For emergencies or short deadlines, preserve the request, records, and timeline; route it immediately; identify any narrow applicable pathway; and disclose only the approved minimum. Urgency changes response time, not the need for legal authority.

When a requester cites state law, acknowledge receipt without confirming protected patient status, if appropriate. Counsel can address objections, clarification, notice, protective relief, or a valid Part 2 order. The federal final rule provides context for the current framework, but the live regulation and facts control the operational analysis.

Sample completed releases, rejected requests, and overrides. Confirm that reviewers identified both gates, used current sources, attached the operative instruments, limited the data, verified the recipient, and closed the audit trail. Reopen the underlying rule when the same missing pathway or unsupported shortcut appears more than once.

Example

Fourteen state-authorized requests are sampled. Eleven have a separate Part 2 pathway, verified conditions, owner, scope, data minimum, release evidence, and log; three rely only on the state form. Readiness is 11 of 14 requests.

State-authorization-limit checklist

• identify the state document, legal force, action, scope, conditions, and effective date;
• distinguish permission, compulsion, process instruction, contract, and nonbinding guidance;
• find the exact Part 2 pathway and verify every federal condition independently;
• preserve both analyses, instruments, reviewers, scope, transmission, and closure evidence;
• block unsupported automation and restrict, log, and audit overrides; and
• route urgent or disputed requests promptly without treating urgency as authority.

State authorization answers only the question assigned to that state source. It cannot enlarge Part 2 permission.