Time to advance the confidentiality conversation | Behavioral Healthcare Executive Skip to content Skip to navigation

Time to advance the confidentiality conversation

March 14, 2013
by Renée M. Popovits, J.D.
| Reprints
Before we talk about sharing data and integrating care, we've got to talk about conflicting federal privacy laws

Part 2 of discussion.   Go to Part 1.

The Affordable Care Act (ACA) is premised on the notion that health care providers, insurance companies, and other health agencies share patient health information in ways that foster improved and integrated care for patients.  The ACA emphasizes preventive holistic care and wellness, such that individuals are being treated by their primary and specialty care providers in a coordinated way.  However, these specific aims of the ACA appear to directly conflict with the restrictions of 42 CFR Part 2, the federal law that protects the confidentiality of personal health information generated during the course of alcohol or drug treatment. 

The aims of the ACA also conflict with the historic structure and separation of our addiction treatment and mental health systems, which now face the need to integrate with physical medicine and primary health care despite basic conflicts in the ways that each handles confidential patient information.  The latter, of course, have relied on HIPAA while behavioral health providers have had to comply with HIPAA, Part 2, and a mix of state regulations.

While it is sometimes possible for attorneys to sort out the conflicts that can arise for behavioral health providers between the HIPAA and Part 2 regulations (attorneys call these conflicts "pre-emption issues"), it is not easy to do so. And, in many cases, such “pre-emption analysis” would actually complicate, rather than simplify, the decision of an addiction treatment provider to make the kind of "duty to warn" disclosure that the HHS letter of January 15 was intended to encourage. 

If unresolved through detailed dialogue, the conflict between HIPAA and Part 2 could cause deeper problems that will affect the course of health reform, the adoption of EHRs and health information exchanges (HIEs), and the hoped-for integration of specialty behavioral healthcare with physical and primary care medicine. 

It's certainly time to advance a national conversation about conflicting health information privacy requirements. While one cannot predict the course of such a conversation, it is clear that such a conversation would need to: 

1.  Accommodate patient options.  Patient choice for sharing of information is critical.  Those patients who wish to receive the full benefits of participating in health information exchanges and sharing all information should not be excluded due to legal restrictions imposed on the behavioral health field.  Similarly, those who wish to restrict data sharing and perhaps opt out altogether should be able to make those choices.

2.  Strike a balance (in law and in practice—processes, forms, data handling) that works for SUD treatment and traditional medical providers. Minus this balance, both might well decide that the status quo is complicated enough. This could result in a digital divide that would wrongfully exclude addiction treatment providers from integration with primary care and from inclusion in HIEs.

3.  Evaluate whether current conflicts could be resolved through an opening, relaxation, or harmonization of some sections of HIPAA and Part 2.  Opponents of relaxed Part 2 regulations argue that due to the sensitive nature of substance abuse treatment information, it warrants heightened protections so as to prevent stigma and discrimination by the public.  However, proponents of relaxed Part 2 regulations argue that keeping substance abuse treatment records separate from other medical information results in further stigmatization of the disease of addiction and more importantly, less competent care for the patient. 

4.  Consider the impact of new technology initiatives, such as the Data Segmentation for Privacy (DS4Pinitiative. DS4P, if proven, could allow for the restriction of specific elements in a patient’s EHR according to a patient’s consent. Realistically, for nationwide implementation, federal resources and financial incentives must be explored and allocated to the behavioral health field to pay for this technology. 

5.  Determine whether SUD treatment information is so unique that protecting it requires its own law.  Or, can it be seen as one of a number of categories of “sensitive” health information (such as HIV, mental health, reproductive health, genetic issues) that would be better served by having one uniform standard?

6.  Discuss the value of increasing federal prohibitions on discrimination. Penalties for discrimination and improper use and disclosure of sensitive addiction treatment information could be added to federal substance abuse confidentiality laws to enhance patient protections.  Similarly, patient advocates have argued that current legal remedies for violations of Part 2 — which are limited to a $500 criminal penalty with additional violations allowing for increases of up to $5,000 — do not serve as deterrents and could be strengthened.