The 42 CFR Part 2 and NHIN conundrum | Behavioral Healthcare Executive Skip to content Skip to navigation

The 42 CFR Part 2 and NHIN conundrum

July 1, 2009
by Bill Connors, MSW and John Leipold, DBA, MBA
| Reprints
As the Nationwide Health Information Network evolves, addiction treatment providers still must comply with confidentiality regulations

Former President George W. Bush enacted Executive Order 13335 calling for the creation of a Nationwide Health Information Network (NHIN), which will provide electronic information sharing among healthcare providers. The goal is seamless and secure information movement between networks, resulting in a single infrastructure for sharing electronic health information. All of this was once considered far reaching and somewhat unattainable, especially for addiction treatment providers.

Health information exchanges (HIEs) and regional health information organizations (RHIOs) are forming NHIN's backbone. Interoperability standards for electronic information exchange are under development. Yet the addiction treatment and behavioral healthcare fields are just beginning to review, discuss, and debate the effect of interoperable systems for electronic health record (EHR) exchange.

Evolving health information technology (HIT) is dragging healthcare providers into a world in which confidentiality rules, designed when patient records were maintained almost universally in paper charts, either do not apply or are in serious practical conflict with electronic information exchange. Thus, the free movement of electronic health information collides with privacy and security rules when interoperable electronic information exchange systems are required to comply with patient confidentiality standards. This collision profoundly impacts addiction treatment providers, who function under the most restrictive confidentiality constraints.

The HIPAA regulations protecting medical records, even psychiatric records, are not as restrictive as the regulations under laws that protect addiction treatment records. The need for special addiction treatment confidentiality rules is rooted in the stigma associated with alcohol/drug dependence and treatment. Addiction is chronic and progressive, often ending in death if untreated. Addiction often is viewed as a mark of shame or discredit. Such stigma interferes with alcohol/drug-dependent persons' willingness to seek treatment. Addicted persons, even in recovery, often are denied jobs or insurance coverage.

The need to address this stigma is so powerful that Congress extended legal protection to addiction treatment records through confidentiality laws enacted in the 1970s. These laws and the resulting regulations, now referred to as 42 CFR Part 2, protect the confidentiality of information about persons receiving alcohol/drug prevention and treatment services. Violating these federal confidentiality laws may lead to administrative, civil, or criminal sanctions.

These laws make sure that an alcohol/drug abuse patient is not made more vulnerable through the availability of his/her patient record than an individual who has an alcohol/drug problem and does not seek treatment. This is a critical concept. If seeking treatment makes an individual increasingly vulnerable to discrimination, then it is logical to conclude that fewer people suffering from addiction will seek treatment.

Regulations under 42 CFR Part 2 prohibit unauthorized disclosure of addiction patients' health records. These regulations apply to law enforcement or other officials, even with a subpoena. Indeed, covered programs are compelled to resist information disclosure even when presented with a subpoena. Disclosing even the presence of a patient at a facility or unit identified as a place where only alcohol/drug services are provided requires the patient's written authorization. A payer or funding source that maintains records of recipients of alcohol/drug treatment is subject to 42 CFR Part 2, as well.

When records are released, the regulations require a statement prohibiting redisclosure. If the entity receiving the disclosure wishes to redisclose the information, the entity also must comply with the regulatory requirements. Generally this would result in the receiving entity obtaining another properly executed release of information from the patient. Additionally, the regulations further limit permitted disclosures to the minimum information necessary to carry out the purpose of the disclosure.

Yet the evolving NHIN requires the exchange of electronic health information, and for all practical purposes 42 CFR Part 2 severely prohibits releasing such information. These are the colliding interests. Under 42 CFR Part 2 a covered program is required to obtain a properly executed release of information before disclosing addiction treatment records. There is no language in the regulations that permits an exception to this requirement for an HIE or RHIO. When an HIE or RHIO receives disclosed information about an addictions treatment patient, the HIE or RHIO would assume the disclosing covered program did so legally under the auspices of a properly executed release of information. The release of information used by the covered program does not permit the HIE or RHIO to further disclose the information. To function legally under 42 CFR Part 2, the HIE or RHIO must obtain its own properly executed release of information from the patient and must obtain a new release from the patient each and every time information is disclosed to a different party. It seems clear there is no practical way to facilitate the purpose of an HIE or RHIO under this requirement.

Even if some clever electronic security method restricted the identity of a patient's addiction treatment provider, the treatment provided (e.g., withdrawal protocols and certain medications) is still a likely giveaway that the patient received addiction treatment. 42 CFR Part 2 prohibits disclosing information that could lead to the identity of an addiction treatment patient even if his/her identity is not directly disclosed.