[NYAPRS Enews] Gopelrud: The Balancing Act of Protecting Substance Use Record Confidentiality

[Harvey Rosenthal]

NYAPRS Note: ACMHA: The College for Behavioral Health Leadership is a
"premier forum for the exchange of new policy ideas that contribute to
the improvement in the lives of people with mental health and substance
use conditions and the systems that provide treatment and prevention
services." ACMHA achieves this mission via an array of activities
including an annual Summit, reports and reflections, committees and
group events and via thoughtful pieces like the one below. 

You can join ACMHA at
http://www.acmha.org/join_now_application_process.shtml. 

 

ACMHA ARM CHAIR REFLECTIONS 

The Balancing Act of Protecting Substance Use Record Confidentiality 

Eric Goplerud, PhD, Director, Center for Integrated Behavioral Health
Policy, George Washington University Medical Center, Washington, DC 

 

In 1972, Congress adopted the federal Confidentiality of Alcohol and
Drug Abuse Patient Records law. This statute reflects Congress's
longstanding concern that individuals not be made more vulnerable as a
result of seeking treatment for a substance use disorder. The reality of
stigma and discrimination remains just as real today as it was in 1972.
It remains crucial to continue to protect the privacy of people who seek
treatment for addictions. 

An initiative to modernize the federal substance use record
confidentiality regulations has been undertaken by a coalition of
diverse stakeholders, the Patient Protection Coalition. The Coalition
and the debate that it has sparked throughout the substance use and
mental health fields have focused on rebalancing protections against
discrimination from disclosure of sensitive substance use treatment
information and the need for efficient sharing of health information for
safe and effective care. These very real and very urgent problems are in
need of resolution. 

What was a simple and correct solution to protect the privacy of
substance use treatment information 37 years ago needs to be
reformulated to be simple and correct in the current environment. Many
forces are disrupting the stability that the federal substance use
privacy regulations created in managing substance use treatment
information. Integrated health and behavioral health care, involvement
of primary care and medical specialists in treating and managing
substance use, growing use of electronic medical records and electronic
data exchanges, parity, and national health reform are generating
uncertainty and conflicts about managing substance use treatment
information. 

Under the existing federal law, except in cases of medical emergency, a
patient has a right to decide what, if any substance use disorder
treatment information is disclosed to his or her health care providers.
This current right requires the patient to specifically authorize the
disclosure in the form of a written consent (as specified by 42 CFR
2.31) except in cases of medical emergency (42 CFR 2.51). 

Some privacy advocates believe the patient's right to affirmatively
consent should be maintained, even for disclosures to other health care
providers providing treatment to the patient, even though this is not
required under the HIPAA privacy regulations. 

On the other side of the patient protections, debate health care
providers advocate for the need for relevant information, including
substance abuse disorder treatment information, to appropriately
diagnose and treat patients. Physicians have explained that a
non-medical professional might not understand or recognize how certain
information may impact a physician's course of testing, diagnosis,
treatment and plan of care. Without complete information, the course of
treatment could adversely interact with existing medications, exacerbate
other underlying health conditions or, worse yet, jeopardize the life
and safety of the patient. 

The Patient Protection Coalition and more than 40 substance use and
mental health organizations have called for SAMHSA to lead a
deliberative process to explore perceived problems in protecting
sensitive substance use treatment information and improving patient
safety and health; to determine the cause of the problems; and to create
practical, understandable solutions. The consensus process should
address what information can be shared, with whom, for what purposes,
with what permissions, and with what penalties for unauthorized
disclosures. Special privacy and permission issues of parents and
adolescents in substance use treatment must be considered. 

A wide philosophical and value spectrum exists about the ultimate
ownership and control of health information. At one pole are strong
privacy advocates, current federal substance use privacy regulations,
and many states' mental health and addiction privacy laws. From this
perspective, patients should own and control their health data (with a
few exceptions). 

At another pole are advocates of patient-centered medical homes and many
physicians and other health care providers who argue that immediate
access to health data is necessary for good, safe care. At this pole is
HIPAA, which gives the patient very limited control over their health
data if used for the purposes of treatment, payment, or health plan
operations. 

Diverse and inconsistent state privacy laws governing substance use and
mental health information further complicate the challenges of balancing
privacy and data sharing. 

A solutions-focused consensus process is needed that centers on
interactions between clinicians, specialty substance use treatment
providers and general medical programs, people in recovery, and families
impacted by substance use of a family member. Advocates, lawyers,
software vendors, academics and others have valuable expertise to
contribute to the consensus process, but solutions must work for health
care providers and consumers. Solutions may involve improved education
of patients and providers, better execution within existing regulations,
re-interpretation of the statute, or new legislation. 

The initial focus of the Patient Protection Coalition was on protecting
the privacy of sensitive substance use information and permitting
limited sharing of health data governed by 42 CFR Part 2. In the
February draft statute, the Patient Protection Coalition proposed
several specific solutions
(http://www.law.virginia.edu/pdf/faculty/bonnie_patientprotection.pdf): 

*         Permits very limited disclosures of information about
substance use disorder treatment to health care providers and health
plans for purposes of treatment, coordination of care, quality
improvement, disease management and payment. 

*         Reiterates the requirement in the HITECH Act that
HIPAA-covered entities and business associates must honor an
individual's request to restrict disclosure to a health plan if payment
for services is made out of pocket. 

*         Prohibits use of substance use information by a health plan
for discriminatory purposes. 

*         Permits disclosure to health providers or health plans without
patient authorization only demographic information, diagnosis,
medications, laboratory results, identification of past or current
treatment providers, and dates of services. 

*         Applies a "minimum necessary" standard to any disclosure of
alcohol/drug program patient records. Psychotherapy notes and progress
notes are specifically excluded. If more detailed information is needed,
written consent will be required. 

*         Recognizes that even these limited disclosures could create a
risk of improper use of the information and that the current federal
statute and regulations are silent on a number of necessary patient
protections. The draft proposal includes robust provisions to address
these fundamental vulnerabilities: (1) prohibits discrimination on the
basis of information in substance use disorder program records, (2)
limits use in criminal and civil investigations or proceedings, (3)
strengthens civil and criminal sanctions against unauthorized
disclosures, and (4) gives individuals the right to pursue civil
remedies against persons who violate this statute. 

*         Extends HITECH Act's significantly increased penalties to any
recipient of confidential substance use program information. Individuals
whose records are unlawfully used or disclosed the right to bring a
civil action in federal court to obtain an injunction and/or monetary
damages. It requires payment of costs, including attorney's fees to a
patient that prevails in such a case. If an unauthorized use or
disclosure was the result of willful, knowing or reckless actions,
exemplary damages are required. 

 

The current federal substance use privacy regulations only apply to
information collected by specialized substance use treatment programs as
defined by the regulations. But increasingly, substance use diagnostic
and treatment information is recorded in medical records by physicians
and other health care providers not covered by 42 CFR Part 2. For
example, primary care physicians, including physicians delivering
office-based opiate treatment; emergency medical personnel providing
substance use screening, brief intervention and treatment (SBIRT);
clinicians working in inpatient dual diagnosis programs; and residents
being trained to deliver integrated SBIRT medical services are recording
substance use diagnosis and treatment information in electronic medical
records protected only by HIPAA. Clear guidance is needed to protect
people seeking treatment for addictions from disclosure of sensitive
health information and to permit sharing of information between health
care providers needed to effectively and safely treat their addictions
and other illnesses. The absence of privacy protections for substance
use information in settings not covered by 42 CFR Part 2 is one of the
most pressing reasons for a thorough review of substance use privacy
regulations. 

The consensus process should fit within the broader health information
technology and electronic health record environment being led by the
Office of the National Coordinator. Protections of sensitive substance
use information should be consistent with protections for other
sensitive information, including conditions for sharing information
without patient consent, penalties for disclosure, and technological
solutions. 

We look to SAMHSA to provide leadership in facilitating an active
consensus process to develop practical solutions that work for people in
recovery, health care providers, and families. The consensus process
that SAMHSA convenes should involve medical professions, health care
organizations and health plans that are outside the substance use
treatment programs covered by 42 CFR Part 2.The input from legal,
software, privacy and policy experts will also be valuable in the
consensus process, but consumers and clinicians must be central. The
substance abuse record confidentiality is a problem that needs
resolution now, and the proposed consensus process would generate
effective and balanced solutions.

 



__________ Information from ESET NOD32 Antivirus, version of virus
signature database 5265 (20100709) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://kilakwa.net/pipermail/nyaprs_kilakwa.net/attachments/20100709/b8cf6375/attachment.html>