# Part 2 AI disclosure branch map

Follow each yes, no or unknown outcome before a protected record reaches an AI service. A separate fictional worked case is included in the download.

General branch logic with a separate synthetic SUD programme case. No real consent, legal decision or provider approval is represented.

Source: https://aona.ai/resources/guides/42-cfr-part-2-ai-records-consent/
Sources checked: 2026-09-21

## An unknown answer changes the route

### Scope

Yes: continue. No: review other duties. Unknown: stop and resolve.

### Record type

Separate counselling note: specific consent. Ordinary record: applicable permission.

### Permission

Established: review recipients. Unresolved: stop the upload.

### Recipient

Complete: accountable decision. Incomplete: resolve before disclosure.

| Question | Finding | Stop or next outcome | Evidence to retain |
| --- | --- | --- | --- |
| Part 2 applies to this record and source? | Yes | Continue to record-type and permission checks. | Record the programme and record-origin evidence. |
| Part 2 applies to this record and source? | No | Leave this Part 2 branch; assess HIPAA and other applicable duties. | No Part 2 finding is not an approval of the AI disclosure. |
| Part 2 applies to this record and source? | Unknown | Stop the proposed patient-data upload and resolve origin/status. | Ask the source programme or accountable privacy owner. |
| Separately maintained SUD counselling note? | Yes | Assess specific consent; do not rely on broad TPO consent. | Identify the actual note and consent scope. |
| Separately maintained SUD counselling note? | No | Assess the permission applicable to the ordinary Part 2 record. | Review actual consent or an applicable exception for this use. |
| Record type or consent/exception established? | Unknown or unresolved | Stop the proposed upload until the applicable permission is established. | A BAA or tool label does not resolve this branch. |
| Applicable consent or exception established? | Yes | Continue to recipient, disclosure-scope and other safeguards review. | Include the consent copy or clear scope explanation where required. |
| Recipient and remaining conditions reviewed? | No or unknown | Stop the proposed disclosure on this route; resolve the missing conditions. | Map the AI service, connected recipients and applicable agreements. |
| Recipient and remaining conditions reviewed? | Yes | The accountable owner can record the scoped decision. | This table does not itself grant legal permission or product approval. |

## Review checklist

- [ ] Confirm origin and record type
  Ask the source programme whether Part 2 and the special SUD counselling-note provisions apply.
- [ ] Match consent to the use
  Review the actual permission, scope explanation and any separate-consent requirement.
- [ ] Trace every recipient
  Include AI services, connected features and processing intermediaries rather than assuming a BAA covers all of them.

## Included example files

- part2-ai-records-consent.md
- part2-ai-records-consent.csv
- part2-fictional-worked-case.csv

## Source references

- HHS: 42 CFR Part 2 final rule fact sheet: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html (2026-09-21)
- HHS: Guidance on HIPAA and cloud computing: https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.