Confidentiality of substance use disorder (SUD) patient records is under attack again, less than a year after the Substance Abuse and Mental Health Services Administration (SAMHSA) finalized a rule to make it easier to share this information within health systems. This time, the opposition to consent provisions, which give the patient the right to say who gets his or her SUD information, comes not only from some in the insurance and mental health treatment community, but from some treatment providers themselves.

The main objection is to the consent provisions of 42 CFR Part 2, the SAMHSA regulation almost four decades old, which was recently changed to make it easier to exchange information within a health system.

But none of the opponents of consent is able to answer the two-part question: If a patient wants to give consent, why do you object to obtaining it? And if they don’t want to give consent, why are you taking that choice away from them?

The attack comes from two places: the Partnership to Amend 42 CFR Part 2, which includes the Hazelden-Betty Ford Foundation and the American Society of Addiction Medicine and is spearheaded by the Association for Behavioral Health and Wellness (ABHW), and a bill proposed by Rep. Tim Murphy (R-Pennsylvania) that would gut the law implementing 42 CFR Part 2 and is supported by that partnership. The ABHW is a membership organization of managed behavioral health care organizations and counts among its partners Alkermes (which makes Vivitrol), Indivior (which makes Suboxone) and Braeburn (which makes Probuphine, the buprenorphine implant). But Indivior and Braeburn are working on buprenorphine injectables as well.

The partnership and the bill want to align 42 CFR Part 2 with the Health Insurance Portability and Accountability Act (HIPAA), which does not require that a patient consent to release of his or her patient information, and allows for easy sharing within health care providers.

According to the partnership’s July 28 statement, 42 CFR Part 2 is “not compatible with the way health care is delivered”; it does not allow for integration of care, which can lead to risks to patients, “such as contraindicated prescription medicines and problems related to medication adherence”; and “obtaining multiple consents from a patient is challenging.”

Rep. Murphy’s bill, The Overdose Prevention and Patient Safety Act (H.R. 3545), would also place all SUD patient records under the much looser protections of HIPAA.

Both the proposed legislation and the coalition got support from the White House Commission on Combating Drug Addiction and the Opioid Crisis (see p. tk), released July 31, which also calls for 42 CFR Part 2 to be changed to HIPAA.

ASAM stance

“I used to work in an emergency department, and I was unable to get records from a methadone clinic,” said Corey Waller, M.D., chair of ASAM’s legislative advocacy committee. “Let’s say a patient is not doing well and asks for medications for pain — we’re putting them at risk for mortality,” Waller told ADAW, citing one of the most common reasons ASAM members cite for wanting to abolish consent provisions of 42 CFR Part 2.

Many of Waller’s patients are pregnant people with SUDs, so he understands the need for confidentiality. “There is no way that we want this entire thing to slip into HIPAA without some specific conditions,” he said. These conditions include “the capability to exempt these records from criminal proceedings except for a direct court order,” he said.

The main point of the 42 CFR Part 2 consent form is that it allows the patient to dictate who gets the information. This “to whom” part of the consent form is considered particularly onerous because it means a new form for every new person or organization.

And, said Waller, the problem is that the information should be as readily available as other health information. “I will find information about cancer, about diabetes, because it will be part of the normal record,” said Waller.

Finally, Waller doesn’t trust patients to disclose information on their own about their SUDs. “If a patient is diagnosed with a severe opioid use disorder, they’re not going to walk into an emergency room and tell them that,” he said. “Without the knowledge of what the patient has, they’re going to get bad treatment that puts them at risk.”

ASAM is in the process of writing a “global consent form,” said Waller. “With the release of Murphy’s bill, we’re starting to gear up for what it would look like,” he said.

Hazelden Betty Ford

Jennifer Lohse, vice president and general counsel for Hazelden Betty Ford, said that patients want to coordinate care with their primary physician. Under 42 CFR Part 2, the program “has to do a lot of paperwork” to give consents to coordinate care, said Lohse. Under HIPAA, “if a patient says I want you to coordinate care with my GP at home, we wouldn’t have to do paperwork,” she said.

Pressed for why it is so hard to obtain the consent, if the patients want to give it, Lohse did not have a good answer, beyond the paperwork.

Lohse did give two other examples of problems with 42 CFR Part 2. First, when people contact the program to find out if their insurance would cover treatment, the program would have to obtain consent before investigating this with the insurance company, she said. Second, in e-prescribing, the provisions banning redisclosure of the information take up too much space, she said. The electronic health record (EHR) won’t accept the redisclosure notice “because there are too many characters,” she said.

Legal Action Center

The Legal Action Center, which has been working on confidentiality regulations since the beginning, noted that if the health care field wants to share SUD patient information within a system without consent, SAMHSA provided for that in the final rule.

“There is a statute, and we are strongly opposed to eliminating Part 2 or folding it into HIPAA or anything else that would eviscerate the confidentiality regulations,” said Paul Samuels, director and president of the Legal Action Center. “We do not understand where this is coming from, given the fact that SAMHSA has recently amended the regulation to make it easier for substance use providers to share information with the rest of health care.”

The Legal Action Center has long held that it is important to facilitate effective communication between SUD providers and the health care system, but confidentiality is necessary “so that treatment records cannot be used to include great damage to the lives” of patients, he said. In addition, dismantling consent “would discourage those in need for care from coming forward to seek it.”

Samuels dismissed the concerns about checking patient benefits. “For decades now, SUD providers have been able to navigate issues involving patient applicants by either arranging to have a written consent, which has become even easier with digital technology, or by touching base with the insurer and asking what the coverage is under a certain plan.”

And SAMHSA has been issuing and will continue to issue subregulatory guidance on 42 CFR Part 2, as it stated in the final rule. “There are issues that still need to be worked out,” said Deborah Reid, senior health policy attorney with the Legal Action Center. If something needs to be changed to make e-prescribing easier, SAMHSA can provide guidance on that, she said. “It’s not as if the doors are shut,” she said. “It would be more helpful to ask SAMHSA to do some subregulatory guidance.”

AATOD, other providers

Neither the National Association of State Alcohol and Drug Abuse Directors (NASADAD) nor the National Association of Addiction Treatment Providers (of which Hazelden Betty Ford is a member) signed on to the partnership. Neither had a comment, either.

Mark Parrino, president and executive director of the Association for the Treatment of Opioid Dependence (AATOD), said that much of the support for revising 42 CFR Part 2 comes from software vendors (indeed, Netsmart is in the partnership) and insurance companies.

“But there is also a great deal of talk about integrating and normalizing patient care, regardless of what illness the patient is treated for,” said Parrino. “Then we come down to the reality of stigma and how much that affects patient care.” In his discussions with methadone patient advocates, he has heard many stories about patients who have “lost something when an individual or an organization finds out that they are a patient in treatment,” said Parrino. This even applies to patients in office-based opioid treatment with methadone, he said. “There are individuals who cannot get either life or disability insurance once it has been discovered that they are using buprenorphine in a DATA 2000 practice,” he said.

There are also many stories of women who have lost custody of their children simply because they were on methadone maintenance, said Parrino. “In such cases, Child Protective Service workers, who think they are doing well by the newborn, compel the mother to withdraw from methadone with universally negative results,” he said. “There are also many reports where judges are compelling the patient to end their treatment once they find out that the patient is using either methadone or buprenorphine.”

The possibility that their patient information will be disclosed may discourage patients from even seeking treatment, added Parrino. “They cross the threshold into treatment programs with some trepidation,” he said. “They hope that they will encounter a welcoming and therapeutic environment, with trained and compassionate personnel,” he added. “They also hope that they are not taking other risks, which may not be obvious at the time of patient admission. In order to keep the patients in treatment, it is important to ensure that their treatment remain confidential and they do not risk any potential exposure.”

Naïveté and inconvenience

H. Westley Clark, M.D., executive professor of public health at Santa Clara University, blames Hazelden Betty Ford for taking the “convenient” route. “It appears that when a premier substance use disorder treatment program is willing to ignore potential harms that could result from inappropriate disclosure simply because it is inconvenient to press EHR vendors and others to modernize their information sharing, a sad state of affairs exists,” he said. “The issue isn’t patient unwillingness to share; it is that Hazelden doesn’t want to be inconvenienced.”

It is “strange that patient consent is viewed as a barrier to integrated care,” he added. “This suggests that whole-person care is not patient-centered care, but provider convenience.” Clark also criticized ASAM, Hazelden and the American Psychiatric Association for their decision to “engage in advocacy that would undermine patient autonomy and share decision-making.”

Without patient participation, there can be no whole-person care, said Clark, who was director of SAMHSA’s Center for Substance Abuse Treatment for most of the rulemaking. “There can be discrimination and harm, but no whole-person care,” he said.

“I am shocked at their naïveté,” said Clark of ASAM. “The notion that they can eviscerate 42 CFR Part 2 so that they can join the rest of medicine is an exercise in self-deception. Somehow they believe that they can minimize harm while disclosing personal information so that the rest of medicine is not inconvenienced ignores that their bread and butter turns on the trust that patients have in them.”

Once harm occurs, providers will bear the brunt of malpractice claims, and, ultimately, patients will be reluctant to enter treatment, said Clark. “If ASAM wants to abandon the object of its profits, then the members of ASAM will have to figure out how to interact with patients in a manner that does not result in patients being compromised,” he said.

Clark noted that 89 percent of people who meet criteria for needing treatment are not in treatment and do not seek treatment. “Once it becomes clear to all that substance use disorder treatment records could under HIPAA’s health care operations exemption be disclosed for administrative things like business planning, customer service, and training of non-health care professionals, there will be even less enthusiasm for medically oriented treatment,” he said. “In small to middle sized communities where privacy can easily be compromised, the current revised 42 CFR Part 2 protections are essential.” What is worse, Clark observed, is that the Murphy bill and the Partnership’s actions will decrease the perceived treatment choices for those with opioid use disorders, making social model treatment options the preferred choice, even when medication assisted treatments are indicated. “If we are in the midst of an opioid crisis, we should be reducing barriers to care, not constructing them.”

Criminal justice system

AATOD’s Parrino, who frequently cites patient interactions with treatment and the need for treatment to be welcoming, agrees. “Insurance companies and other groups that are beating the bushes to end the patient confidentiality protection offered to patients through 42 CFR Part 2, thinking that the protections will remain in effect with HIPAA, simply do not understand the differences between the two approaches,” he said. “Other than that, they are looking out for the interests of their members and companies but not the long-term interests of the patients.”

Finally, Samuels noted that by focusing only on disclosures within health care, ASAM and others are losing sight of all the other harm that could come to a patient without the protections of 42 CFR Part 2.

If law enforcement seeks patient records, HIPAA provides very little protection, Samuels added. There doesn’t need to be a court order specific to SUD records — it could be just a subpoena, search warrant or other power under law, he said.

The timing also seems to ignore the fact that Attorney General Jeff Sessions is promoting policies aimed at arresting and prosecuting drug users and purchasers. Unlike cancer and diabetes — or any other health care condition — only SUDs can lead people directly to prison. Do treatment providers want to deliver them there?

“SAMHSA has addressed health care,” said Samuels. “Let’s allow those recommendations to move forward. But to eliminate 42 CFR Part 2 would be opening access to records to arrest and prosecute patients.”

For the Murphy bill, go to

Bottom Line…

A coalition of organizations opposed to 42 CFR Part 2, including ASAM and Hazelden Betty Ford, joins forces with Rep. Tim Murphy in proposing folding it into HIPAA.