Part 2 state-law field nonpreemption

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.20 says the statute behind Part 2 does not preempt the field to the exclusion of all state laws. It then gives two operational boundaries: Part 2 cannot authorize a state-law violation, and state law cannot authorize or compel a use or disclosure that Part 2 prohibits. The answer therefore comes from a fact-specific comparison, not a general claim that one body of law always controls.

Concurrent rules require source mapping

Current 42 CFR 2.20 rejects total field preemption. For each workflow, record entity, program, person, record, patient, purpose, recipient, jurisdiction, date, federal provision, state provision, consent, order, exception, and decision owner.

Permission and requirement are different

Classify whether each source permits, requires, limits, or prohibits the use or disclosure. A general permission does not displace a narrower prohibition. A mandatory state instruction cannot supply federal authority when Part 2 blocks the action.

Operationalize the analysis

The 2024 final rule supplies the current regulatory text and compliance context. Maintain a jurisdiction matrix, source versions, product and role scope, counsel decisions, system rules, manual holds, exceptions, training, audit, and change triggers.

Start with the exact transaction

Define the Part 2 program, holder, records, patient, proposed action, purpose, recipient, location, governing entity, workforce role, date, and technology. Separate treatment, payment, operations, public health, emergency, research, audit, legal process, patient access, and reporting workflows. A state provision may attach to a profession, facility, payer, data category, recipient, or physical location that differs from the federal scope.

Record where the patient received care, where the holder and recipient operate, where the records sit, and where the action occurs. Telehealth, multistate organizations, remote staff, centralized billing, and cross-border vendors can produce more than one plausible jurisdiction. Counsel should resolve the choice-of-law question rather than letting a mailing address or system default decide it.

Compare both sources at provision level

Retrieve the current federal text and the actual state statute, regulation, binding order, or other controlling source. Capture version, effective date, applicability, defined terms, permission, requirement, prohibition, exception, consent standard, personal-representative rule, notice, minimum-necessary condition, redisclosure limit, retention duty, and remedy. Label summaries and agency guidance as interpretive material rather than substitutes for the source.

Ask what each source does to the same proposed act. If Part 2 permits disclosure but applicable state law prohibits it, hold the disclosure. If state law purports to permit or require an act that Part 2 prohibits, the state source does not create a Part 2 pathway. When both allow the act, every applicable condition still must be met.

Turn the conclusion into an operating control

Assign the row or rule an owner, reviewer, effective period, affected systems, release test, documentation requirement, escalation route, and change trigger. Configure queues and integrations to hold uncertain cases. Require attributable approval for overrides and preserve the sources, facts, reasoning, scope, decision, release evidence, and later correction.

Test workflows after new legislation, regulation, case law, guidance, service location, entity structure, payer arrangement, vendor, or product feature. The 2024 final rule establishes the federal rulemaking context, while state sources require their own current review.

Handle uncertainty and competing duties

Preserve records and deadlines while privacy and legal reviewers investigate. A preservation hold is different from an external disclosure. Send only a counsel-approved response to a requester, and avoid confirming that a person has SUD records when even that fact may be protected.

Document unresolved jurisdiction, source currency, applicability, and factual gaps. Use a conservative hold with a named decision date instead of leaving the request in an unowned queue.

Example

Sixteen disclosure routes reach review. Thirteen identify both federal and state sources, their effect, owner, evidence, effective date, conflict path, and release rule; three list Part 2 alone. Completeness is 13 of 16 routes.

Nonpreemption review checklist

• define the holder, record, action, purpose, recipient, jurisdictions, and date;
• retrieve current federal and state sources and map their exact scope and effect;
• apply the more restrictive result when federal permission meets a state prohibition;
• reject state permission or compulsion as a substitute for a required Part 2 route;
• record counsel conclusions, system controls, approvals, evidence, and effective periods; and
• monitor legal, operational, vendor, and multistate changes that can alter the result.

Field nonpreemption is a method for respecting concurrent law. It does not create a universal hierarchy or a shortcut around provision-specific analysis.