This federal regulation establishes requirements for intermediaries handling patient record disclosures under 42 CFR Part 2 (substance use disorder treatment records). When a patient has consented to disclosure via a general designation, the intermediary must, upon written request, provide a list of entities to whom records were disclosed within the past three years, responding within 30 days and including the recipient name(s), disclosure date, and a brief description of the patient identifying information shared.
View official source§ 2.24 Requirements for intermediaries. Upon request, an intermediary must provide to patients who have consented to the disclosure of their records using a general designation, pursuant to § 2.31(a)(4)(ii)(B), a list of persons to which their records have been disclosed pursuant to the general designation. (a) Under this section, patient requests: (1) Must be made in writing; and (2) Are limited to disclosures made within the past 3 years. (b) Under this section, the entity named on the consent form that discloses information pursuant to a patient's general designation (the entity that serves as an intermediary) must: (1) Respond in 30 or fewer days of receipt of the written request; and (2) Provide, for each disclosure, the name(s) of the entity(ies) to which the disclosure was made, the date of the disclosure, and a brief description of the patient identifying information disclosed. [89 FR 12625, Feb. 16, 2024]