What’s more harmful to patients being treated for drug or alcohol abuse: Risking their health by keeping other medical providers in the dark about their substance abuse treatment? Or risking their jobs, homes and child-custody arrangements by allowing potentially damaging treatment details to be electronically shared with an array of medical providers?
Advocates on each side have painted the possible outcomes in starkly different terms as they consider the federal government’s recently proposed update to rules governing the release of patient records for substance abuse treatment.
Everyone agrees that protecting the privacy of people who are being treated for substance abuse is critical. The failure to keep such information confidential can have a devastating effect on the patients’ work and family lives. In some cases, it also may set off a cascade of legal repercussions, including arrest, prosecution and jail for illegal drug use. The mere threat that treatment details might be disclosed can be enough to deter people from seeking help.
The current privacy guidelines – often referred to as “Part 2,” an abbreviation for “42 CFR Part 2,” a section of the Code of Federal Regulations – last got a meaningful update in 1987. Since then, electronic medical records have proliferated, and integrated patient-centered care has become the organizing principle for doctors, hospitals and health systems.
The old rules are too cumbersome for today’s integrated world, say proponents who favor loosening the rules. At present, providers can disclose treatment information only when a patient consents to have it shared with a specific health care provider.
Part 2 “is well-intentioned, but it’s just not working,” said Matt Salo, executive director of the National Association of Medicaid Directors. “These special (treatment) silos are actually hurting people.” The federal/state Medicaid program for lower-income people is responsible for a significant and growing share of the money spent on substance-abuse treatment, Salo said.
In family medicine, it’s not unusual for patients to have five to 10 different diagnoses, one of them being substance abuse, said Wanda Filer, president of the American Academy of Family Physicians. Not having access to all the relevant medical information can be difficult or even dangerous. If someone is taking methadone to treat a heroin addiction, for example, she may need to adjust his antidepressant or anti-anxiety medications.
“Finding the right balance between getting access to information and protecting their privacy” is challenging, said Filer, who practices at a health center that treats low-income patients in York, Pennsylvania. The AAFP is reviewing the proposed changes.
The proposal from the Department of Health and Human Services would allow patients to give their consent to disclose their records not to a specific provider alone but to the health care system with which the provider is affiliated, for example.
While the HHS proposal is an improvement over existing rules, it doesn’t go far enough, Salo said. His organization, along with others, would prefer that HHS align substance-abuse-treatment disclosure rules with the federal Health Insurance Portability and Accountability Act of 1996, which governs the privacy of other types of health care records.
Under HIPAA, health plans, providers and health care information clearinghouses don’t always have to get patients’ consent before disclosing their records to similar groups and “business associates,” such as claims-processing operations, if the disclosure is related to a patient’s health care treatment, payment or health care operations.
Strong protections must remain in place to prevent information from being used to bring criminal charges or to conduct criminal investigations, said Lindsey Browning, senior policy analyst at the National Association of Medicaid Directors.
That’s not good enough, some patient advocates say. They argue that the rule changes are too broad.
Under the HHS proposal, “anybody throughout the system can get access” to patient substance-abuse-treatment records, said lawyer Jim Pyles, an expert on patient privacy who has represented the American Psychoanalytic Association on this issue.
“When the patient is at their most vulnerable time, it gets them to sign ... this very general consent form.”
Patients can’t rely on health care systems to keep their information private, Pyles said, noting that in the past six years, more than 150 million Americans have been involved in health-data breaches, according to an analysis of HHS data released by Melamedia, a health care research company.
In the midst of a privacy-breach epidemic, “we’re substituting the interests of integrated delivery systems ... for patients’ interests, when what we should be doing is asking patients what they want,” Pyle said.
