Part 2 Uniformed Services exception

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The live 42 CFR 2.12(c)(2) applies Part 2 to described information obtained by a Uniformed Services component while the patient was subject to the Uniform Code of Military Justice, except for the two specified categories of interchange among Uniformed Services and VA health-care components. eCFR displays the section as current through August 20, 2026 and last amended August 13, 2026. The HHS fact sheet confirms the February 16, 2026 compliance date for the 2024 amendments.

Status and acquisition timing matter

42 CFR 2.12 ties the provision to information obtained during UCMJ status. Record the patient status period, obtaining component, service, purpose, record, date, repository, and later recipient.

The exception concerns specified interchanges

Classify sender and recipient components, VA health-care function, route, purpose, data, date, and authority. Avoid converting the interchange exception into a general permission for outside disclosure or later use.

Other requirements still need review

Map military and VA privacy rules, HIPAA when applicable, state law, professional duties, security, access, legal demands, incident response, and record retention. Preserve data provenance across transfers.

Establish status, source, and time

Document the patient's UCMJ status period, the obtaining Uniformed Services component, the date and purpose of acquisition, the SUD information, the originating service or program, and the repository. Preserve authoritative status and source evidence rather than relying on a military identifier or current employment field.

Status can change during a treatment episode. Separate information obtained before, during, and after the supported UCMJ period, and keep the classification tied to each item or defensible record segment. A later transfer, scan, or consolidation does not replace the original acquisition facts.

Test the exact interchange

Record sender, recipient, component, VA health-care function if relevant, purpose, data, date, transmission route, and authority. The regulatory text addresses interchanges within the Uniformed Services, within VA components furnishing health care to veterans, and between those VA components and the Uniformed Services. Confirm that both ends fit the named relationship.

An outside provider, employer, benefits office, law-enforcement body, court, family member, researcher, contractor, or other recipient may require a different analysis. Do not extend the exception because a message passes through a military or VA system.

Apply controls after classification

Limit the exchange to information needed for the supported purpose. Authenticate recipients, use approved secure channels, control role access, retain logs, inspect attachments and metadata, and record the disclosed version. Map applicable military and VA rules, HIPAA, state law, professional duties, contracts, legal-process restrictions, and incident obligations.

Build review triggers for status change, component transfer, separation, retirement, VA transition, community referral, new recipient, system migration, purpose change, or legal demand. Preserve historical classifications and investigate mismatched or misdirected interchanges through privacy, security, and counsel.

Example

Nine proposed interchanges are reviewed. Seven fit the named component relationships and have supported purpose, data, and authority; two involve outside recipients. Readiness is 7 of 9.

Make a transaction-specific decision

Record one result for each proposed interchange: named exception supported, another Part 2 route required, request denied or narrowed, or legal review pending. Cite the status and component evidence, identify the exact records and period, and name the approving privacy or legal owner. A standing “military exchange” flag is too broad for changing status and recipients.

For approved exchanges, document the minimum data, transmission, recipient verification, restrictions, and receipt. For denied or narrowed requests, preserve the original request, decision, and safe response so later staff do not reopen the same path without new facts.

Audit a sample after implementation. Confirm that the actual sender, recipient, component, data, and purpose match the approved decision and that no outside address, forwarding rule, shared mailbox, or automated integration widened the exchange.

Record corrections and retraining with an owner, completion date, and follow-up sample rather than closing the review on a promised change.

Uniformed Services review checklist

• verify the UCMJ status period and obtaining Uniformed Services component;
• preserve acquisition date, purpose, source, data, and record provenance;
• identify both sides of the proposed interchange and the VA health-care function;
• limit purpose, information, access, recipients, and transmission route;
• apply military, VA, HIPAA, state-law, contract, and incident requirements; and
• reclassify after status, component, recipient, purpose, or system changes.

The exception does not create broad permission for military, veteran, employment, benefits, or law-enforcement exchange. Patient status, acquisition facts, component relationships, current law, and the proposed action need experienced privacy and legal review.