Regulatory reference

42 CFR Part 2 Disclosure Decision Tool

Pick a disclosure scenario and review the likely Part 2 posture, consent requirements, documentation needs, and redisclosure notice.

Reference only — confirm with counsel before disclosing. Scenario list is non-exhaustive.

Choose a scenario

Result updates immediately on the right. Use the primary source links below for spot-checking.

Request does not match a listed permission

42 CFR Part 2 general rule

Part 2 posture

Do not disclose Part 2-protected, patient-identifying information unless you can identify written consent, a valid court order, or a specific Part 2 permission that fits the request.

Consent / documentation required

Obtain Part 2-compliant written consent or escalate to privacy/compliance counsel to identify the correct authority before disclosing.

Redisclosure notice

Do not send a redisclosure notice as a workaround. The question is whether the disclosure itself is permitted.

Document in the record

Document the request, why it was not fulfilled, and who reviewed the decision.

When to escalate

Call your privacy officer, compliance team, or legal counsel before disclosing if any of the following apply:

Court order tied to a criminal investigation or prosecution of the patient (§ 2.65 has a heightened standard).
Subpoena without an accompanying Part 2 court order.
Law-enforcement request that isn't a crime on premises or against staff.
Consent revocation mid-disclosure, or disputes over scope of a prior consent.
Suspected breach of Part 2-protected records (HITECH-aligned notification under the 2024 Rule).
State law that is stricter than Part 2 (minor consent rules, mandatory reporting expansions, state confidentiality statutes).
Requests involving deceased patients beyond cause-of-death reporting.
Anything that doesn't cleanly match one of the scenarios above.

Primary sources

Regulatory reference only — not legal or medical advice. Part 2 interacts with HIPAA, state law, and your program's policies in ways this tool cannot capture. Confirm with your program's privacy officer, compliance team, or legal counsel before making a disclosure. Reflects the 2024 Final Rule (compliance date February 16, 2026); spot-check citations against the current eCFR text. Runs entirely in your browser — nothing you click is saved or sent.