Part 2 use definition

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The HHS Part 2 final-rule fact sheet summarizes the current consent, redisclosure, proceeding, breach, and patient-right framework and confirms the February 16, 2026 compliance date. The Federal Register final rule contains the adopted changes. Existing internal operations, analytics, and automated tools should be assessed as actual uses under the live definition rather than grandfathered by an older general-purpose label.

Internal activity can be a use

42 CFR 2.11 reaches more than external transmission. Map viewing, searching, copying, summarizing, scoring, training, model input, quality review, billing work, supervision, investigation, testimony, and decision support.

Each use needs a supported purpose

Record the actor, role, data, system, purpose, authority, date, output, recipients, restrictions, and decision. Apply consent, exceptions, minimum scope, access, security, accounting, proceeding protections, and other law as relevant.

Automated processing remains activity

Background jobs, alerts, exports, indexes, logs, monitoring, AI features, and data warehouses can examine or apply record information. Inventory service accounts, vendors, prompts, outputs, retention, and human approval boundaries.

Inventory human and software activity

Use includes sharing, employment, application, utilization, examination, or analysis of record information within the maintaining entity and in specified proceedings. Inventory people and systems that view, query, transform, score, summarize, compare, route, or act on the data. Include service accounts, background jobs, search indexes, logs, analytics, model inputs, generated outputs, monitoring, support access, and temporary exports.

For each activity, record actor, role, system, data, source program, purpose, authority, frequency, output, recipients, retention, and decision affected. A feature that never displays raw records to a person can still examine or apply the information.

Build a purpose-and-authority gate

Name the actual purpose instead of using “operations,” “quality,” “care,” or “compliance” without detail. Identify the current consent or exception, covered records, actors, dates, restrictions, and required oversight. Check whether HIPAA, state law, contracts, professional scope, research, employment, payer, or proceeding rules add separate gates.

Configure access to the approved role, data, and purpose. Test whether users can search beyond their assignment, export excessive fields, reuse output, or infer patient status from alerts and work queues. Record approvals and denials with an owner and review date.

Treat derived output as part of the workflow

Summaries, risk scores, flags, reports, embeddings, prompts, model responses, and recommendations may reveal or apply Part 2 information. Map where outputs go, who reads them, whether they become records, how long they persist, and how errors are corrected. Validate that a downstream decision does not silently rely on a prohibited or unsupported use.

For AI or analytics, document vendor access, training or reuse terms, input minimization, isolation, logging, human review, accuracy limits, deletion, and incident handling. Do not place Part 2 records in a tool until privacy, security, legal, and operational owners approve the specific configuration.

Recheck proceedings and investigations

Use during civil, criminal, administrative, or legislative proceedings carries special Part 2 restrictions. Route subpoenas, warrants, testimony, discovery, government inquiries, and internal investigations to experienced counsel. Preserve the exact order, consent, target, scope, redactions, users, and outputs.

Pause a use when purpose changes, authority expires, an incident occurs, a new recipient is added, or output affects another decision. Preserve the prior state and document correction or rollback.

Example

Fifteen proposed internal uses enter review. Twelve have supported purpose, authority, access, data scope, and output controls; three use a general operations label. Readiness is 12 of 15.

Part 2 use checklist

• inventory every person, service account, tool, query, model, and output;
• state the precise purpose, authority, records, roles, and review date;
• limit access and processing to the approved data and function;
• trace derived scores, summaries, alerts, exports, and decisions;
• apply separate proceeding, research, payer, employment, and state-law gates; and
• stop and re-review after purpose, system, vendor, output, or authority changes.

The definition does not permit a use merely because it is internal or automated. Current Part 2 provisions, consent, exceptions, HIPAA, state law, contracts, and the specific facts need qualified review.

Use a governed activity register with one row per human or software function. Record source program, system, actor, role, purpose, authority, input fields, transformations, output, decision affected, recipients, retention, vendor access, approval, and review date. Reconcile the register with live permissions, service accounts, scheduled jobs, data warehouses, and model configurations. Suspend orphaned or undocumented activity and preserve evidence of the stop, correction, deletion, rollback, or reauthorization before marking the row closed.