The attack on patient confidentiality—by the very agency that is supposed to protect it—has begun.
On August 22 the Substance Abuse and Mental Health Services Administration (SAMHSA), in one of the biggest rulemakings undertaken in recent history, announced proposed changes to 42 CFR Part 2, the regulation which protects confidentiality for patients treatment in substance use disorder (SUD) treatment programs, including methadone.
As Filter has reported, this has been coming for some time, and patients have not been looking forward to it; many say they may leave treatment as a result.
The proposed changes are sweeping. They will soon be opened to comment periods of 60 days regarding the general changes to patient privacy, and 30 days regarding law enforcement’s increased powers to seize patients’ records under the proposal.
SAMHSA first recapped:
In our 2011 guidance letter, SAMHSA encouraged OTP [opioid treatment programs, the clinics licensed to dispense methadone] staff to access PDMPs [prescription drug monitoring programs], but stated that OTPs could not disclose patient identifying information to a PDMP unless an exception applies, consistent with the federal confidentiality requirements.
The agency continued:
SAMHSA no longer believes this policy is advisable in light of the current public health crisis arising from opioid use, misuse, and abuse. In the past 10 years, there has been a substantial increase in prescription drug misuse, admissions to substance use facilities, emergency department visits and opioid-related deaths. The omission of OTP data from a PDMP can lead to potentially dangerous adverse events for patients who may receive duplicate or potentially contraindicated prescriptions as part of medical care outside of an OTP, thereby placing them at risk for adverse events, including possible overdose or even fatal drug interactions.
In other words, under SAMHSA’s new guidance, the methadone treatment patients receive from clinics, formerly kept private, will now appear on controversial drug databases made available to all medical practitioners.
This change in the name of patient health is the big prize for physicians, who have claimed that without this information, they can’t treat patients safely. They can trust a database, they say, more than patient disclosures. What’s unexplained is why—until about 2010, when electronic health records started replacing paper ones—physicians made no complaints about 42 CFR Part 2 and its role in keeping methadone private.
The change is also a victory for everyone who wants to sell or buy patient information—as well as for law enforcement, which governs PDMPs.
You can be sure that PDMPs, big-money juggernauts increasingly interwoven with electronic health records, are already urging the states not only to allow OTPs to input data into the PDMP, but to require it.
The battle now goes to the states. Under the proposal, if states allow OTPs to put this information into PDMPs, SAMHSA will allow it. Federal law and regulations supersede states, so until now, that 2011 “Dear Colleague” guidance letter—written by privacy champion H. Westley Clark MD, JD, then director of SAMHSA’s Center for Substance Abuse Treatment—has been the law of the land.
You can be sure that those who run PDMPs, which are big-money juggernauts increasingly interwoven with electronic health records, are already going to the states, urging them not only to allow OTPs to input data into the PDMP, but to require it.
You will see many news articles elsewhere peddling the SAMHSA line on this issue. Journalists are usually good at smelling out coverups, dog and pony shows, and the typical “spin” from regulators. But in the case of 42 CFR Part 2, it’s just been too complicated for them. Before they know it, however, they or their loved ones will wonder whether the alcohol use disorder treatment they received years ago will remain confidential, or whether their ex’s divorce lawyer will find out about any past or present treatment—and indeed, whether, in light of this, they should even go to treatment in the future if they need it.
The word “confidentiality” is easy to use. If you ask a doctor or clinic if your treatment will be confidential, they will probably say yes. But you have to find out what that means. Will it go into the electronic health record? Who will have access?
If you’re on methadone, a proven treatment for opioid use disorder, you can fully expect that if this proposed rule passes, your name and the methadone will be in the PDMP, which all of your doctors—and perhaps others—will see.
.
“Times change”
On SAMHSA’s public call about the proposed rule changes on August 22, I asked SAMHSA director, Health and Human Services Assistant Secretary Elinore McCance-Katz, MD, JD on behalf of Alcoholism & Drug Abuse Weekly whether that 2011 Dear Colleague letter would be rescinded.
“Times change, Alison,” the psychiatrist responded. That’s not an adequate answer. Some things never change—like the need to treat patients with dignity and respect.
Political times do change. The proposed revisions to 42 CFR Part 2 have all the hallmarks of the Trump Administration’s move toward deregulation, and are even painted in this way in the preamble to SAMHSA’s proposal—as they were by HHS deputy secretary Eric D. Hargan when he introduced Dr. McCance-Katz in the call.
Hargan, a lawyer, also said in the call that patients were among those wanting these revisions. Asked for documentation of these patient requests, he did not respond.
The patient’s entire SUD treatment record could be transcribed into the primary care or hospital record.
But patients are still in need of treatment. Most treatment providers—with the exception of OTPs—have already called for the elimination of 42 CFR Part 2, asking to make it like HIPAA, which has no requirements for patients to consent to release of their information.
Under SAMHSA’s proposed changes, the patient’s entire SUD treatment record could be transcribed into the primary care or hospital record. How much of that record is actually transcribed is up to the discretion of the requester.
Dr. McCance-Katz said only basic information—such as medication and dose—should be there. “We don’t believe health care providers are going to transcribe entire SUD treatment records,” she said on the call. “The information that is needed are medications, dosage, and success in treatment or not.”
SAMHSA’s proposal states:
Briefly, the intent is to allow a non-part 2 provider to receive SUD information about a patient from a part 2 program, and then to engage in a treatment discussion with that patient, informed by that information, and then be able to create her own treatment records including SUD content, without the latter becoming covered by part 2. This level of flexibility is needed in order to improve coordination of care efforts, and to save lives. It is not SAMHSA’s intent to encourage a non-part 2 provider to abuse the rules, by transcribing extensively from a conversation with a part 2 program or from a received part 2 record when creating her own records, without having a clinical purpose for doing so. [My emphasis.]
What is it they say about where good intentions can lead?
Electronic Vulnerability and Consent
The proposal would require some kind of “segmentation” of the SUD treatment record. This would be easily done in a paper record or an email, the proposal states.
It would not be so easily done electronically, except by “use of a Data Segmentation for Privacy (DS4P) compliant EHR platform, in which segmentation is carried out electronically based on the standards of DS4P architecture,” according to the proposal.
However, the proposed rule doesn’t require that any such electronic segmentation solutions be used. Since these were developed years ago, and rejected by the industry, it’s unlikely that they will be used.
Under the proposal, patients could consent to widespread release of their information without their being named. The proposal states that this would be:
… to allow patients to consent to the disclosure of their information to a wide range of entities, without naming the specific individual receiving this information on behalf of a given entity; special instructions would apply with respect to consents for disclosure of information to information exchanges and research institutions. We believe this proposal would give patients the ability to apply for and access federal, state, and local resources and benefits more easily, (e.g., social security benefits; local sober living or halfway house programs).
Because of “confusion about permitted types of disclosures to and from federal, state and local governmental agencies and to and from third-party payers, for the purpose of audit and evaluation,” SAMHSA is proposing to “allow patient identifying information to be disclosed to federal, state, and local agencies, and the contractors, subcontractors, and legal representatives of such agencies in the course of conducting audits or evaluations mandated by statute or regulation, if those audits or evaluations cannot be carried out using de-identified information.”
There are already companies focusing on selling such systems. And let’s not forget that the PDMP is a law enforcement tool.
In other words, just say you want to have all of the health care information on a patient in order to do an audit and you have no way to (or interest in) de-identifying the information, and voila! You’ve got the patient’s entire record at your fingertips, including substance use disorder information.
There are already companies focusing on selling such systems to states, by offering ways to merge the PDMP and EHR. And let’s not forget that the PDMP is a law enforcement tool.
Interestingly, the treatment providers who have championed these changes may find themselves searching for patients soon, under SAMHSA’s plan. More and more patients are being treated for SUD by primary care providers (PCPs), and this is the way things should be, according to Dr. McCance-Katz. If SUD treatment providers disclose to patients that their information will not be confidential, they may well see a drop-off.
PCPs are not bound by 42 CFR Part 2, as they are not SUD treatment providers.
Law Enforcement and Informants
Under current regulations, an exception to 42 CFR Part 2 can be made when law enforcement is seeking information about a serious crime allegedly committed by a patient—the records of that patient could be seized.
Treatment providers know this. But under the proposal, law enforcement isn’t limited to those patient’s records; all patients’ records could be seized.
And did you know about undercover informants in SUD treatment programs? They have always been allowed, placed there by court order. But this proposal would extend the length of time an undercover agent or informant could be in a treatment program to 12 months (up from six), or even longer if a court orders it.
Most people in treatment are not there for opioid use disorder, and most aren’t even treated with medications. Can patients who were treated in the past be sure their records won’t be released?
In coming weeks, as this rulemaking progresses, it will be vitally important that patient voices are heard. And if patients are against something, just maybe their treatment providers should be, too.
Photo by Alex Knight on Unsplash
Show Comments