# Part 2 AI disclosure branch map

General branch logic with a separate synthetic SUD programme case. No real consent, legal decision or provider approval is represented.

Follow each yes, no or unknown outcome before a protected record reaches an AI service. A separate fictional worked case is included in the download.

| Question | Finding | Stop or next outcome | Evidence to retain |
| --- | --- | --- | --- |
| Part 2 applies to this record and source? | Yes | Continue to record-type and permission checks. | Record the programme and record-origin evidence. |
| Part 2 applies to this record and source? | No | Leave this Part 2 branch; assess HIPAA and other applicable duties. | No Part 2 finding is not an approval of the AI disclosure. |
| Part 2 applies to this record and source? | Unknown | Stop the proposed patient-data upload and resolve origin/status. | Ask the source programme or accountable privacy owner. |
| Separately maintained SUD counselling note? | Yes | Assess specific consent; do not rely on broad TPO consent. | Identify the actual note and consent scope. |
| Separately maintained SUD counselling note? | No | Assess the permission applicable to the ordinary Part 2 record. | Review actual consent or an applicable exception for this use. |
| Record type or consent/exception established? | Unknown or unresolved | Stop the proposed upload until the applicable permission is established. | A BAA or tool label does not resolve this branch. |
| Applicable consent or exception established? | Yes | Continue to recipient, disclosure-scope and other safeguards review. | Include the consent copy or clear scope explanation where required. |
| Recipient and remaining conditions reviewed? | No or unknown | Stop the proposed disclosure on this route; resolve the missing conditions. | Map the AI service, connected recipients and applicable agreements. |
| Recipient and remaining conditions reviewed? | Yes | The accountable owner can record the scoped decision. | This table does not itself grant legal permission or product approval. |

## Review steps

- Confirm origin and record type: Ask the source programme whether Part 2 and the special SUD counselling-note provisions apply.
- Match consent to the use: Review the actual permission, scope explanation and any separate-consent requirement.
- Trace every recipient: Include AI services, connected features and processing intermediaries rather than assuming a BAA covers all of them.

## Separate fictional worked case

The following example is separate from the conditional branch map. It does not establish a real patient consent or legal decision.

| Decision | Invented case finding | Next action |
| --- | --- | --- |
| Does Part 2 apply? | The source owner identifies a fictional record as protected Part 2 material. | Use the Part 2 review path; document actual origin in a real case. |
| Is it a separately maintained SUD counselling note? | One attachment contains a clinician’s separately kept session analysis. | Do not rely on broad TPO consent for that attachment; assess specific consent. |
| What consent covers the ordinary record? | A TPO consent exists in the scenario, but the proposed recipient is not yet reviewed. | Check its scope and applicable disclosure/redisclosure conditions. |
| Who receives the AI input? | External AI service and its connected feature are proposed. | Map each recipient and its role, agreements and permitted use. |
| Could the task use no patient record? | Staff only need generic reception wording. | Use invented context and keep the protected records out of that task. |
| Can the real disclosure proceed? | Required consent and recipient questions remain open in the exercise. | Obtain the accountable review; the worksheet does not authorise disclosure. |

## Safe alternative prompt

Invented exercise: Write a general reception message about contacting a service team for administrative questions. Include no patient, SUD diagnosis, treatment history or counselling note.

HHS fact sheet updated 30 January 2026; applicable compliance date 16 February 2026.

## Source and scope

Guide: https://aona.ai/resources/guides/42-cfr-part-2-ai-records-consent/

Source check: 21 September 2026. General information, not professional approval or a completed control test.

- HHS: 42 CFR Part 2 final rule fact sheet: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
- HHS: Guidance on HIPAA and cloud computing: https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html