Part 2 state compulsion limit

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The final sentence of live 42 CFR 2.20 says state law may not compel a use or disclosure prohibited by Part 2. An official-looking demand therefore triggers a legal-process review rather than immediate production. Service, enforceability, Part 2 authority, state restrictions, notice, response, and production scope remain separate questions.

A demand and authority are separate

The second sentence of 42 CFR 2.20 bars state law from compelling Part 2-prohibited conduct. Verify issuer, jurisdiction, service, legal authority, recipient, purpose, records, patient, proceeding, deadline, objections, enforcement risk, and available Part 2 route.

Use a legal-demand workflow

Time-stamp receipt, preserve the original, issue a hold, identify the record holder, limit internal access, notify counsel and privacy, calendar deadlines, evaluate consent and court-order requirements, preserve patient notice rights, document response, and track later use.

Avoid silent production

The final rule supplies current context for the Part 2 framework. A records portal, vendor, subpoena service, or operational staff member should never release solely because a demand looks official. Require release authority and retained approval evidence.

Triage the demand without revealing protected status

Route subpoenas, summonses, warrants, agency demands, audit notices, reporting forms, discovery, testimony requests, and court communications to a controlled intake. Time-stamp receipt, preserve the original and envelope or transmission, record service details, restrict circulation, identify the apparent holder, and calendar every deadline.

Use a neutral acknowledgment approved for the request type. Staff should avoid confirming whether a named person is or was a patient, whether responsive Part 2 records exist, or what they contain before qualified review.

Separate validity from disclosure authority

Counsel should examine issuer, court or agency, jurisdiction, service, caption, parties, statutory basis, requested testimony or records, date range, purpose, enforcement mechanism, objections, notice, and available relief. A procedurally valid state demand can still lack a Part 2 disclosure path.

Privacy reviewers should determine program and record status, patient identity exposure, applicable consent, exception, or Part 2 court-order route, and any independent state restriction. Preserve the analysis even when the final response is an objection, clarification request, patient-authorized release, limited production, or no production.

Preserve first and disclose only after approval

Issue a targeted legal hold when appropriate. Preservation protects potentially responsive material while authority is resolved; it is not an external disclosure. Keep the original record set stable, document collection, maintain chain of custody, and limit internal review to assigned roles.

For approved production, verify recipient and secure method, use the authorized record and date range, apply required limits and notices, log what left, and retain proof. Do not let a vendor portal or deadline-driven workflow release a broader set than counsel approved.

Coordinate objections, orders, and deadlines

Build escalation points for insufficient service, overbreadth, protected identity, missing notice, absent findings, improper recipient, conflicting jurisdictions, and imminent deadlines. Authorized counsel decides whether to confer, object, move to quash or limit, seek protection, request a proper Part 2 order, or take another response.

Recheck any amended demand or order from the beginning. The 2024 final rule supplies federal rulemaking context, while the current regulatory text and exact process control. Document oral directions and obtain a stable written instrument before operational release.

After closure, reconcile the deadline, hold, collected set, response, production, recipient, delivery confirmation, protective conditions, fees, return or destruction terms, and later correspondence. Track whether vendors and staff followed the approved route. A post-matter review should repair intake, calendaring, source mapping, or technical controls that nearly produced an unauthorized disclosure.

Report aging demands, approaching deadlines, unresolved authority, blocked productions, and open exceptions to the accountable privacy and legal owners until each item has a documented disposition.

Example

Ten state demands reach review. Eight have verified service, authority, Part 2 analysis, counsel owner, hold, deadline, response, release scope, and closure; two were routed directly to a vendor queue. Readiness is 8 of 10 demands.

State-compulsion checklist

• centralize intake, preserve service evidence, restrict circulation, and calendar deadlines;
• acknowledge neutrally without confirming patient or record status;
• test validity, enforceability, Part 2 authority, state law, notice, and scope separately;
• preserve responsive material under controlled hold while disclosure is unresolved;
• require counsel-approved objections, orders, production set, recipient, and method; and
• log the response, release evidence, later amendments, use limits, and closure.

A state demand can require attention and preservation without creating authority to disclose. Production begins only after every required legal gate is satisfied.