Quick answer
A SNF can have obligations as a recipient of Part 2 records even when it is not itself a Part 2 program. Establish the record’s source and applicable consent or other basis. Preserve that context through use and redisclosure, and route proposed legal-proceeding disclosures for specialized review instead of assuming ordinary HIPAA permissions resolve them.
Classify the received record, not the resident
A SNF receives a discharge packet containing substance use disorder treatment information. Intake staff need to preserve useful clinical information while the privacy team determines whether Part 2 applies and what context must travel with the record. A blanket flag on every resident with an SUD diagnosis is too crude; ignoring the source because the SNF is not an SUD program is also inadequate.
HHS's current Part 2 overview, reviewed September 29, 2026, explains that some duties apply to organizations receiving Part 2 records. It describes single consent for future treatment, payment and health care operations, and HIPAA redisclosure by covered recipients receiving records with that consent, subject to the legal-proceeding limits. Compliance with the 2024 final rule was required by February 16, 2026.
The procurement task is to preserve the facts needed for a correct decision. Do not ask software to infer legal status solely from a diagnosis code or document title.
Keep a source-and-permission map
Use a protected record-level or appropriately grouped map with originating program, received date, included documents, applicable consent or other disclosure basis, supporting evidence location, known restrictions and reviewer determination. Record uncertainty explicitly and seek missing context from the source through an approved channel.
This original decision exercise separates four situations:
| Received material and reviewed facts | Operational handling to test |
|---|---|
| Part 2 record received by a HIPAA covered SNF under a valid TPO consent | Preserve basis and permit only reviewed downstream workflows; retain proceeding restrictions |
| Part 2 record received under a narrower or different basis | Assess that basis rather than inheriting the TPO pathway |
| General clinical information with an SUD diagnosis, status unresolved | Review source and circumstances; do not automatically assign or dismiss Part 2 status |
| Demand seeking records for a proceeding against the patient | Route for specialized review of Part 2 conditions and legal process |
This table is a workflow specification, not authorization to release any record. Applicable state confidentiality law and the actual facts may add requirements.
Follow the information into derived outputs
Imported records may become a reconciled problem entry, a narrative summary, a referral packet or a data-warehouse row. Preserve enough provenance to identify when a later disclosure draws on the received information. A flag that stays only on the original PDF can disappear from the very output staff use most often.
Test a synthetic packet through intake, clinical review, an ordinary treatment disclosure and a separate litigation request. Inspect each resulting document and the decision history. Establish which record categories the implementation can identify, which transformations lose context and which requests need manual review. Do not promise that a generic segmentation label perfectly solves all mixed-record situations.
A change in consent or restriction needs an established route for assessing its effect on future use and disclosure. The platform should preserve prior versions and actions; it should not rewrite the historical basis of an earlier release merely because the current status changed.
Separate clinical availability from disclosure approval
The care team needs a usable record within its authorized scope. The disclosure team needs a controlled way to assess a proposed recipient and purpose. Designing a permanently hidden clinical document as the only privacy control can create care problems while still failing to control exports elsewhere.
Have qualified reviewers define appropriate access and disclosure behavior, then test that behavior in the proposed system. For legal proceedings against the patient, ordinary HIPAA permission alone is not enough to assume the Part 2 conditions are satisfied. Preserve the request, intended proceeding, applicable consent and legal process for the reviewer.
Close the operational gaps before purchase
Require a demonstration of source metadata, supporting consent evidence, derived-output review and changed-status handling. Connect the resulting workflow to privacy notices: HHS identifies notice obligations for HIPAA covered providers and plans that create or maintain Part 2 records. Test incident handling and record requests using the same source context.
If a product cannot carry the necessary information through a particular export, document the manual review gate and its staffing requirements. The buyer's deliverable is an implementable handling design for its actual received records, not a supplier's unqualified “Part 2 compliant” badge.
Questions & answers
Does every SUD diagnosis make the whole SNF chart a Part 2 record?
No. Applicability depends on the relevant program, records and legal circumstances. Diagnosis alone is not an adequate classification rule.
Does a TPO consent remove all redisclosure limits?
No. HHS describes HIPAA redisclosure permissions for covered recipients receiving records under TPO consent, while preserving restrictions on use in legal proceedings against the patient.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.