Part 2 treatment-purpose information test

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.12(a) connects covered SUD information to a specific purpose: treating an SUD, making a diagnosis for that treatment, or making a referral for that treatment. Paragraph (a)(1) addresses identifying records, while paragraph (a)(2) applies the criminal-charge and investigation restriction to qualifying information whether or not recorded. eCFR displays the section as current through August 20, 2026 and last amended August 13, 2026. The HHS fact sheet confirms the February 16, 2026 compliance date.

Purpose is one part of the coverage chain

The current applicability rule connects information to diagnosis, treatment, or referral purposes. Document the question being answered, service, workflow, requester, collector, patient, program, time, source, destination, and whether the information was recorded.

The two restrictions have related scopes

The record use-and-disclosure restriction focuses on identifying records. The criminal-charge and investigation restriction can reach covered information whether recorded or unrecorded. Classify the proposed action under the relevant paragraph.

Operational labels provide clues rather than conclusions

Intake, screening, scheduling, safety, utilization review, billing, quality, research, employment, forensic, emergency, and referral workflows can hold different information for different purposes. Review actual function and provenance with qualified privacy and legal owners.

Capture purpose when information enters the workflow

Record the person, question, collector, source, patient, program, federal assistance, service, intended decision, date, system, destination, and whether the information was recorded. Use contemporaneous referral, intake, assessment, treatment, order, or workflow evidence rather than a later generic label.

One system can collect similar fields for SUD treatment, general medical care, employment, research, forensic evidence, billing, safety, or quality. Classify the actual acquisition and purpose. Do not infer a treatment purpose solely from clinical content or a diagnosis code.

Apply the correct restriction

For the record use-and-disclosure analysis, document how the record could identify the patient as having or having had an SUD and the remaining section 2.12(a)(1) conditions. For criminal charges or investigation, include oral, observed, remembered, and live information under section 2.12(a)(2).

Record later purposes separately. A permitted acquisition does not automatically authorize a new payer, analytics, research, employment, law-enforcement, legal, or public communication. Identify consent or another current authority, recipient, minimum data, notice, and dates for every later action.

Govern ambiguous and changed workflows

Create purpose codes with plain definitions, accountable owners, permitted users, data fields, retention, and escalation. Review free-text “other” values, default purposes, copied records, automated routing, service accounts, derived output, and interfaces. Prevent users from selecting a broad treatment label merely to obtain access.

Reassess after referral disposition, treatment change, new service, research conversion, legal demand, system migration, model feature, or recipient change. Preserve original purpose and every approved transition.

Example

Fourteen data flows are assessed. Eleven document program status, federal assistance, identifying content, acquisition, purpose, creator, and destination; three use a generic clinical-data label. Completeness is 11 of 14 flows.

Record a purpose-specific classification

For each flow, assign the acquisition purpose, applicable Part 2 paragraph, program and assistance status, patient or cohort, data, source, date, users, systems, and reviewer. Mark the flow supported, narrowed, outside the tested condition, or unresolved. Keep unresolved data behind an interim control.

For approved transitions to another purpose, record the new authority, recipient, minimum data, consent or exception, notice, effective date, expiration, and owner. Do not overwrite the original acquisition purpose because later reviewers need the whole chain.

Verify the classification in a live record, access group, export, report, and legal-request path. Review automated labels and derived output for purpose drift. Record exceptions, corrective owner, completion evidence, and follow-up date.

Sample again after a service, system, model, research, payer, recipient, or legal-process change. A purpose register becomes stale when it is not tied to change management.

Treatment-purpose test checklist

• capture patient, program, assistance, collector, source, information, purpose, and date;
• distinguish treatment, diagnosis for treatment, and referral from other workflows;
• apply the identifying-record and unrecorded criminal-use analyses separately;
• require a new authority decision when purpose, recipient, or use changes;
• govern purpose codes, defaults, free text, automation, output, and access; and
• preserve original purpose and approved transitions through migration and correction.

Purpose is one part of the coverage chain and does not alone authorize use or disclosure. Current Part 2, program status, identifiability, source, recipient, state law, and the proposed action require qualified review.