Center for Integrated Behavioral Health Policy

Department of Health Policy, The George Washington University Medical Center

Eric Goplerud, Ph.D.

AMERSANovember 5, 2010

Protecting Privacy, Protecting Health in an Era of EHRs and

HIEs:The Challenges of Federal

Substance Use Privacy Regulations

Need for Substance Use Treatment• 23.1 million adults and adolescents needed treatment for

an illicit drug or alcohol use problem

– (9.2 percent of US adults and teens).

• 4.0 million adults and teens received treatment for alcohol or illicit drugs

– (1.6 percent of the population)

• Of these, 2.3 million received treatment in a specialty SUD program

– (0.9 percent)

• Or 10% of those needing treatment, got it from a specialty SUD program.

• Source: Substance Abuse and Mental Health Services Administration. (2009). Results from the 2008 National Survey on Drug Use and Health: National Findings (Office of Applied Studies, NSDUH Series H-36, HHS Publication No. SMA 09-4434). Rockville, MD.

Insufficient specialty treatment capacity to treat those who need substance use treatment

Source: 2008 NSDUH

343

374

672

675

743

1,054

1,455

2,187

0 500 1,000 1,500 2,000 2,500

Prison or Jail

Emergency Room

Private Doctor's Office

Hospital Inpatient

Inpatient Rehabilitation

Outpatient Mental Health Center

Outpatient Rehabilitation

Self-Help Group

Numbers in Thousands

Number of Patients Per Facility Type

4

Unmet BH Needs in Primary Care• 67% with a behavioral health disorder do not get behavioral

health treatment1

• 30-50% of referrals from primary care to an outpatient behavioral health clinic don’t make first appt2,3

• Two-thirds of primary care physicians (N=6,660) reported not being able to access outpatient behavioral health for their patients. Shortages of mental health care providers, health plan barriers, and lack of coverage or inadequate coverage were all cited by PCPs as important barriers to mental health care access4

1. Kessler et al., NEJM. 2005;352:515-23. 2. Fisher & Ransom, Arch Intern Med. 1997;6:324-333.3. Hoge et al., JAMA. 2006;95:1023-1032.4. Cunningham, Health Affairs. 2009; 3:w490-w501.

More than One-Third SUD Treatment Admissions from Criminal Justice

(680,000 of 1.8 million admissions)

Co-morbidity is to be expected:Washington State GA-U Project

(General Assistance Unemployable)

DSHS | GA-U Clients: Challenges and Opportunities August 2006

Co-occurring MH and SUD: Number and Source of Treatment

How Many? About 4 million Treated Where?

SA & MH

Challenge unique to SUD: The intersection of health care quality and patient safety with protection of sensitive SUD diagnosis and treatment information

• HIPAA, 42 CFR Part 2

• Risks of potential misuse, and inappropriate disclosure

– Job loss, – criminal prosecution, – health and life insurance coverage barriers

Physical IllnessMental Health

& Substance

Use Disorders

Physical IllnessPhysical Illness

Mental Health

& Substance

Use Disorders

Mental Health

& Substance

Use Disorders

Patient treated in a substance use treatment program

42 CFR Part 2 and HIPAA

Patient treated in a primary health clinic, mental health clinic, PCP office, FQHC

HIPAA Only

Depends on location of treatment, not what kind of treatment

HIPAA: The Very Brief Version

• Establishes a federal “floor” of privacy protections while preserving “more stringent” state laws

• Privacy rule applies to “covered health care entities”

• Individually identifiable health information “protected health information”

• Permitted use: treatment, payment and health care operations without written permission.

• Does not distinguish between types of PHI data other than psychotherapy notes

HIPAA regulatory framework

– HHS Office of Civil Rights has power to ensure compliance, investigate violations, impose civil monetary penalties

– Since 2003, total of 28,000 complaints, 7,000 investigated, 4,700 achieved corrected actions, NO FINES ASSESSED TO DATE

– No federal right of action for private individuals to sue covered entities to halt disclosure or recover damage

42 C.F.R. Part 2 – Confidentiality of Alcohol and Drug Abuse Patient Records

• Meant to encourage people to seek out and remain in SA treatment without fear of prosecution by law enforcement and the government

• Promulgated 1975, updated 1980, 1983, 1987

• Creates a virtual shield against disclosure of PHI related to SA-related conditions and treatment, especially shield against law enforcement and court ordered disclosures

• Strictly prohibits disclosure and use of SA records of any federally assisted alcohol and drug use program (federally assisted very broadly defined)

42 CFR Part 2: Definitions

• Disclosure: – “a communication of patient identifying information,

the affirmative verification of another person’s communication of patient identifying information, or the communication of any information from the record of a patient who has been identified.”

• Patient Identifying Information: – includes name, address, social security, finger prints,

photographs, or “similar information by which the identity of a patient can be determined with reasonable accuracy or speed either directly or by reference to other publicly available information.”

• Criminal penalties and fines for violations

42 CFR Part 2 Exceptions to Authorization

HIPAA Exceptions

To Authorization

Internal Communications Treatment, Payment, Health Care Operations

No Patient identifying information

All other HIPAA exceptions

Medical emergency Treatment

Court order Court Order

Crime on premises Law Enforcement

Child Abuse and neglect reporting

Required by law

Research/audit, evaluation Health Care Operations, Health Oversight, and Research

Qualified Service Organization (QSO)

Health Care Operations with Business Associate Agreement

Issues with current interpretation of 42 CFR Part 2

• FACT # 1: Addiction treatment information is not itself protected under the confidentiality law only records held by federally assisted “programs”. Thus, the content of information is not protected if it is not in a “program”.

• FACT # 2: Discrimination concerns are the primary impetus behind the confidentiality statute, yet the statute is silent on any provisions relating to discrimination.

… ignorance of and hostility towards the disease of drug dependence, those who suffer from it, and the treatments provided are at least as prevalent among healthcare providers as among the general population.  Based on long and distressingly consistent experience, I am convinced that patients have much more to fear from ill-informed and biased physicians, nurses, social workers, etc. than they might possibly hope to gain from enhanced coordination through record sharing.

 For example, patients who acknowledge upon hospitalization or referral to a new care-

giver that they receive methadone maintenance are often told, “We don't believe in substituting one drug for another," and find their usual methadone dosage reduced or discontinued altogether. Post-operative patients are often labeled "drug-seeking" manipulators when they complain of pain, and doctors commonly refuse to order – and/or  nurses to administer – adequate analgesic medication.

FACT # 3: Stigma and discrimination exist today notwithstanding the federal confidentiality laws and regulations.

• FACT # 4: Qualified service organization (“QSO”) agreements permit information sharing with medical providers that “provide services to a program”. May not be practically useful for .

FACT # 5: The remedies under the confidentiality statute for violation are limited to a $500 criminal penalty and can be increased to $5,000 for additional violations.

FACT # 6: Unlike other diseases, the very real fears about law enforcement accessing the information emphasize the need to maintain, even strengthen the confidentiality protections in the statute and regulations.

FACT # 7: Addiction is a disease and should be treated as such.

Important Clinical Issues: Screening in Primary Care

• From SAMHSA*

– Information gathered by a program for purposes other than a diagnosis, treatment, or referral for treatment is not subject to the 42 C.F.R. Part 2 restrictions covered

– Screen or pre-screen procedures: Identifying an Individual as possibly having a substance abuse problem by use of a screening or prescreening procedure that is not conducted as part of diagnosis or treatment is not subject to the 42 CFR Part 2 restrictions

*SAMSHA Technical Assistance Publication Series 24, “Welfare Reform and Abuse Treatment Confidentiality: General Guidance for Reconciling Need to Know and Privacy”

Primary Function is not SUD Treatment

• Guidance from SAMHSA– If a program can disclose a patient’s identifying

information without indicating “patient” status, 42 CFR Part 2 is not violated

• Disclosures possible primarily when a program is part of a larger entity(FQHC, primary care practice, hospital emergency department, general hospital, community mental health center) and can use the larger entity’s name when making the disclosure

• Physician prescribing SUD medications within a general medical practice or psychiatric practice

• Anonymous disclosures (e.g. vulnerable adult abuse reporting, duty to warn)

Technical Assistance Publication Series 18, “Checklist for Monitoring Alcohol and Other Drug Confidentiality Compliance”

Qualified Service Organization Arrangements (QSOAs)

– Person or program that provides services to a SUD program that has entered into a written agreement acknowledging it is bound by 42 CFR Part 2 and will resist judicial disclosure (other than as permitted)

– Examples (operational services to organization, not program to program for substance abuse treatment)

• Data processing• Bill collecting• Dosage preparation• Laboratory Analysis• Professional services (legal, medical, accounting)• Services to prevent, treat child abuse, including training on

nutrition and child care or individual and group counseling