Part 2 undercover-agent definition

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.11 defines an undercover agent as a federal, state, or local law-enforcement agency or official that enrolls in or becomes an employee of a Part 2 program to investigate a suspected violation of law, or pursues that purpose after enrolling or becoming employed for another purpose. Agency or official status, enrollment or employment, and investigative purpose are central.

Test role, placement, and purpose

Current 42 CFR 2.11 links law-enforcement status, patient enrollment or employment, and investigative purpose. Record the agency or official, jurisdiction, placement role, start date, original and later purpose, program knowledge, records accessed, actions, orders, and legal owner.

Recognize a later-arising purpose

The definition includes an agency or official who initially enrolled or worked for another reason and later pursues investigation. Escalate suspected investigative activity without confronting a person, exposing patients, destroying evidence, or delaying immediate safety obligations.

Definition provides no placement permission

The HHS Part 2 fact sheet does not authorize undercover activity. Sections 2.17 and 2.67 supply separate restrictions and court-order procedures. Counsel should assess law, orders, reporting, workforce, safety, and response duties.

Apply the definition to facts, not suspicion

Document the person or agency, law-enforcement status, enrollment or employment relationship, timing, conduct, stated or supported purpose, information sought, systems or records accessed, and evidence. Preserve sources and uncertainty. Do not accuse a patient, employee, or visitor based on demeanor, disagreement, background, or an unsupported report.

Route credible concerns promptly to Part 2 privacy, security, leadership, and experienced counsel through a restricted channel.

Distinguish legitimate roles and requests

Separate ordinary patient participation, employment duties, audits, inspections, service of legal process, records requests, safety response, fraud inquiries, and undercover investigative activity. A law-enforcement affiliation does not make every interaction undercover, while a person who began for another purpose may later pursue an investigation under the definition.

Identify the exact Part 2 rule for any law-enforcement request or access. General consent, workplace access, or a subpoena label may be insufficient.

Protect records and preserve care

Use least privilege, role-based access, logging, monitoring, identity verification, workforce screening within law and policy, supervised access, export controls, and prompt removal of unnecessary permissions. Restrict the internal investigation to people who need to know. Avoid alerting an alleged actor or disrupting patient care without a coordinated plan.

Clinical teams should continue appropriate care and safety procedures. Privacy and legal teams control record and process decisions within their roles.

Respond to a credible concern

Preserve logs, requests, messages, access history, devices, records, approvals, and witness information through lawful methods. Contain inappropriate access, rotate credentials, block exports, and protect evidence. Coordinate any contact with law enforcement, regulators, patients, employees, or courts through experienced counsel and the applicable Part 2 pathway.

Do not conduct retaliatory or overly broad surveillance. Respect employment, civil-rights, whistleblower, safety, and other law.

Audit and improve controls

Review role assignments, patient and employee access, unusual queries, bulk exports, legal requests, privileged accounts, vendor support, overrides, and investigation outcomes. Look for system design that gives patients or staff access beyond their legitimate function. Preserve false-alarm findings and correct bias or training issues.

The HHS Part 2 fact sheet supplies general context but does not replace qualified investigation or legal review.

Maintain a restricted response record with the initial concern, factual basis, access and evidence preservation, decision team, applicable orders or requests, containment, communications, patient-care safeguards, employment actions where lawful, and closure. Review access only to the extent necessary and protect the record from routine operational use. If the concern is unsupported, remove unnecessary restrictions, correct inaccurate records, address retaliation or bias risk, and document the result. If it is substantiated, trace every record and patient impact without expanding the investigation beyond its lawful scope.

Example

Nine suspected placements reach qualified review. Seven preserve agency identity, role, dates, purpose evidence, program knowledge, access, legal process, safety steps, and reviewer; two rely on rumor. Review completeness is 7 of 9 placements.

Undercover-agent review checklist

• preserve law-enforcement, enrollment or employment, timing, purpose, access, and evidence facts;
• avoid conclusions based on suspicion, stereotype, or affiliation alone;
• distinguish routine roles, legal requests, audits, safety response, and investigation;
• protect care while limiting access and preserving evidence lawfully;
• coordinate containment and external communication through qualified owners; and
• audit privileges, queries, exports, overrides, outcomes, false alarms, and bias.

The definition is narrow and fact-intensive. A controlled response protects both Part 2 records and people from unsupported accusation.