Center for Integrated Behavioral Health Policy

1. Center for Integrated Behavioral Health Policy Department of Health Policy, The George Washington University Medical Center Protecting Privacy, Protecting Health in an Era of EHRs and HIEs: The Challenges of Federal Substance Use Privacy Regulations Eric Goplerud, Ph.D. AMERSA November 5, 2010

2. Need for Substance Use Treatment 23.1 million adults and adolescents needed treatment for an illicit drug or alcohol use problem (9.2 percent of US adults and teens). 4.0 million adults and teens received treatment for alcohol or illicit drugs (1.6 percent of the population) Of these, 2.3 million received treatment in a specialty SUD program (0.9 percent) Or 10% of those needing treatment, got it from a specialty SUD program. Source: Substance Abuse and Mental Health Services Administration. (2009). Results from the 2008 National Survey on Drug Use and Health: National Findings (Office of Applied Studies, NSDUH Series H-36, HHS Publication No. SMA 09-4434). Rockville, MD.

3. Insufficient specialty treatment capacity to treat those who need substance use treatment Source: 2008 NSDUH Number of Patients Per Facility Type

4. Unmet BH Needs in Primary Care • 67% with a behavioral health disorder do not get behavioral health treatment1 • 30-50% of referrals from primary care to an outpatient behavioral health clinic don’t make first appt2,3 • Two-thirds of primary care physicians (N=6,660) reported not being able to access outpatient behavioral health for their patients. Shortages of mental healthcare providers, health plan barriers, and lack of coverage orinadequate coverage were all cited by PCPs as important barriersto mental health care access4 • Kessler et al., NEJM. 2005;352:515-23. • 2. Fisher & Ransom, Arch Intern Med. 1997;6:324-333. • 3. Hoge et al., JAMA. 2006;95:1023-1032. • 4. Cunningham, Health Affairs. 2009; 3:w490-w501. 4

5. More than One-Third SUD Treatment Admissions from Criminal Justice (680,000 of 1.8 million admissions)

6. Co-morbidity is to be expected:Washington State GA-U Project(General Assistance Unemployable) DSHS | GA-U Clients: Challenges and OpportunitiesAugust 2006

7. Co-occurring MH and SUD: Number and Source of Treatment SA & MH Treated Where? How Many? About 4 million

8. Challenge unique to SUD: The intersection of health care quality and patient safety with protection of sensitive SUD diagnosis and treatment information • HIPAA, 42 CFR Part 2 • Risks of potential misuse, and inappropriate disclosure • Job loss, • criminal prosecution, • health and life insurance coverage barriers Physical Illness Mental Health & Substance Use Disorders

9. Depends on location of treatment, not what kind of treatment Patient treated in a substance use treatment program 42 CFR Part 2 and HIPAA Patient treated in a primary health clinic, mental health clinic, PCP office, FQHC HIPAA Only Physical Illness Physical Illness Mental Health & Substance Use Disorders Mental Health & Substance Use Disorders

10. HIPAA: The Very Brief Version • Establishes a federal “floor” of privacy protections while preserving “more stringent” state laws • Privacy rule applies to “covered health care entities” • Individually identifiable health information “protected health information” • Permitted use: treatment, payment and health care operations without written permission. • Does not distinguish between types of PHI data other than psychotherapy notes

11. HIPAA regulatory framework • HHS Office of Civil Rights has power to ensure compliance, investigate violations, impose civil monetary penalties • Since 2003, total of 28,000 complaints, 7,000 investigated, 4,700 achieved corrected actions, NO FINES ASSESSED TO DATE • No federal right of action for private individuals to sue covered entities to halt disclosure or recover damage

12. 42 C.F.R. Part 2 – Confidentiality of Alcohol and Drug Abuse Patient Records • Meant to encourage people to seek out and remain in SA treatment without fear of prosecution by law enforcement and the government • Promulgated 1975, updated 1980, 1983, 1987 • Creates a virtual shield against disclosure of PHI related to SA-related conditions and treatment, especially shield against law enforcement and court ordered disclosures • Strictly prohibits disclosure and use of SA records of any federally assisted alcohol and drug use program (federally assisted very broadly defined)

13. 42 CFR Part 2: Definitions • Disclosure: • “a communication of patient identifying information, the affirmative verification of another person’s communication of patient identifying information, or the communication of any information from the record of a patient who has been identified.” • Patient Identifying Information: • includes name, address, social security, finger prints, photographs, or “similar information by which the identity of a patient can be determined with reasonable accuracy or speed either directly or by reference to other publicly available information.” • Criminal penalties and fines for violations

15. Issues with current interpretation of 42 CFR Part 2 • FACT # 1: Addiction treatment information is not itself protected under the confidentiality law only records held by federally assisted “programs”. Thus, the content of information is not protected if it is not in a “program”.

16. FACT # 2: Discrimination concerns are the primary impetus behind the confidentiality statute, yet the statute is silent on any provisions relating to discrimination. … ignorance of and hostility towards the disease of drug dependence, those who suffer from it, and the treatments provided are at least as prevalent among healthcare providers as among the general population.  Based on long and distressingly consistent experience, I am convinced that patients have much more to fear from ill-informed and biased physicians, nurses, social workers, etc. than they might possibly hope to gain from enhanced coordination through record sharing. For example, patients who acknowledge upon hospitalization or referral to a new care-giver that they receive methadone maintenance are often told, “We don't believe in substituting one drug for another," and find their usual methadone dosage reduced or discontinued altogether. Post-operative patients are often labeled "drug-seeking" manipulators when they complain of pain, and doctors commonly refuse to order – and/or  nurses to administer – adequate analgesic medication.

17. FACT # 3: Stigma and discrimination exist today notwithstanding the federal confidentiality laws and regulations.

18. FACT # 4: Qualified service organization (“QSO”) agreements permit information sharing with medical providers that “provide services to a program”. May not be practically useful for .

19. FACT # 5: The remedies under the confidentiality statute for violation are limited to a $500 criminal penalty and can be increased to $5,000 for additional violations.

20. FACT # 6: Unlike other diseases, the very real fears about law enforcement accessing the information emphasize the need to maintain, even strengthen the confidentiality protections in the statute and regulations.

21. FACT # 7: Addiction is a disease and should be treated as such.

22. From SAMHSA* Information gathered by a program for purposes other than a diagnosis, treatment, or referral for treatment is not subject to the 42 C.F.R. Part 2 restrictions covered Screen or pre-screen procedures: Identifying an Individual as possibly having a substance abuse problem by use of a screening or prescreening procedure that is not conducted as part of diagnosis or treatment is not subject to the 42 CFR Part 2 restrictions *SAMSHA Technical Assistance Publication Series 24, “Welfare Reform and Abuse Treatment Confidentiality: General Guidance for Reconciling Need to Know and Privacy” Important Clinical Issues: Screening in Primary Care

23. Primary Function is not SUD Treatment • Guidance from SAMHSA • If a program can disclose a patient’s identifying information without indicating “patient” status, 42 CFR Part 2 is not violated • Disclosures possible primarily when a program is part of a larger entity(FQHC, primary care practice, hospital emergency department, general hospital, community mental health center) and can use the larger entity’s name when making the disclosure • Physician prescribing SUD medications within a general medical practice or psychiatric practice • Anonymous disclosures (e.g. vulnerable adult abuse reporting, duty to warn) Technical Assistance Publication Series 18, “Checklist for Monitoring Alcohol and Other Drug Confidentiality Compliance”

24. Qualified Service Organization Arrangements (QSOAs) • Person or program that provides services to a SUD program that has entered into a written agreement acknowledging it is bound by 42 CFR Part 2 and will resist judicial disclosure (other than as permitted) • Examples (operational services to organization, not program to program for substance abuse treatment) • Data processing • Bill collecting • Dosage preparation • Laboratory Analysis • Professional services (legal, medical, accounting) • Services to prevent, treat child abuse, including training on nutrition and child care or individual and group counseling