With information technology vendors and office-based addiction physicians on one side and patient advocates and methadone clinics on the other, anxiety over changes to the federal confidentiality law is mounting. Changes could take place in the form of a regulatory revision that may turn out to be more palatable than some of the legislative proposals, which call for drastic changes in privacy of treatment for substance use disorders (SUDs).

The long process of revising 42 CFR Part 2, the 41-year-old regulation protecting the confidentiality of SUD treatment records in most programs, began more than five years ago (see ADAW, Jan. 25, 2010) and is now nearing its endstage. The Substance Abuse and Mental Health Services Administration (SAMHSA), which promulgates the regulation, has drafted the Notice of Proposed Rulemaking and sent it to the Office of Management and Budget (OMB) for review, ADAW has learned. How long it will be held by the OMB is not known, but when it is released, stakeholders will comment.

Some are already commenting, however. On October 6, Mental Health America (MHA) and Netsmart, a vendor of electronic health records (EHRs), jointly released a statement calling for changes. Netsmart, in the release, supported proposed legislation by Sen. Chris Murphy (D-Connecticut) and Rep. Tim Murphy (R-Pennsylvania) that would drastically revise the current regulation. Under the proposed legislation, which MHA has not endorsed because of other provisions, consent would be “streamlined,” according to the press release.

“You can’t treat the ‘whole person’ with half the data,” said Paul Gionfriddo, president and CEO of MHA, in the press release. “It’s critical that these regulations be updated to permit the sharing of addiction treatment medical records, with patient consent, in new integrated care settings like Health Information Exchanges (HIEs), Accountable Care Organizations (ACOs), and Medicaid Health Homes.”

Individualized consent

The key sticking point is the individualized consent provision of the regulation, which requires SUD treatment programs that do any business with the government — including accepting federal funds or taking Medicaid or Medicare — to obtain written consent from the patient to disclose any identifying information about that patient. That consent must also indicate the individual who will be receiving the information. For more than 35 years, this simple paper form was used. The statute authorizing 42 CFR Part 2, as well as the regulation itself, calls for written consent, Kate Tipping, a SAMHSA public health advisor, told ADAW this spring (see ADAW, May 25).

Then came EHRs and the HIE, in which patient records are freely available to any provider treating a patient. The main point of such sharing is to facilitate quality care, and according to proponents of revising 42 CFR Part 2, this information sharing is necessary in the event of SUD treatment as well.


But mainly, it’s a technical problem. It’s “burdensome” to segment out SUD data, said Kevin Scalia, Netsmart executive vice president of corporate development. The proposed legislation would “modernize 42 CFR Part 2 to say a consumer consent for one year, and it allows their consent to work in an ACO health home, or other care-coordination-type bodies,” he told ADAW. “We have tons of opioid treatment providers who are for changing these rules,” he said. “If you have an opioid addiction and you want to get the same quality of care, then you want doctors should share your medical records.”

Scalia insists that providers, including OTPs, want to be able to share information. “I’ve had multiple meetings with SAMHSA, and with ONC [the Office of the National Coordinator for Health Information Technology], and I think there’s universal demand from the provider side” to change 42 CFR Part 2.

“Think of the administrative burden of data segmentation on a provider,” said Scalia. “I’m going to share these three fields with this doctor, and this with that doctor. How many different fields will you share with whom?”


But H. Westley Clark, M.D., former director of SAMHSA’s Center for Substance Abuse Treatment (CSAT), who presided over much of the 42 CFR Part 2 discussion in the federal government before abruptly resigning a year ago, says that SUDs and treatment are still too stigmatized to make patient information a part of the EHR and HIE.

“I suppose in a world where there are no criminal sanctions, no civil penalties and no discrimination, the privacy issue would not matter,” Clark told ADAW last week. “However, we have to keep in mind that we are not in that world.”

In addition, SUD treatment is already difficult to access, said Clark, noting that 17 states have not even expanded Medicaid, so that “poor people, especially people of color, cannot get basic SUD, health or mental health services.” There is also data from the National Survey on Drug Use and Health showing that almost everyone who meets the criteria for SUD treatment isn’t in treatment; only 2 million people go to specialty treatment who need it — 19 million do not.

“If you were one of those 19 million people with an SUD that you recognized, and you knew that your employer, your ex-spouse or law enforcement could have access to your records, would you even acknowledge your substance use?” asked Clark. “I think not.”

Even Scalia agrees that there is discrimination against people with SUDs. “I’m not minimizing the problems with stigma in the U.S.,” he said. “But my frustration is of trying to get equal rights for people with SUDs. If you don’t want to share data, then opt out of the HIE.”


Becky Vaughn, vice president for addictions at the National Council for Behavioral Health, said that there is still a need for 42 CFR Part 2. “We know after this much time there will probably be some tweaks, trying to address things with EHRs,” Vaughn told ADAW. “And we feel we are moving away from stigma and discrimination, but we’re not there yet.” For providers who are “whining that they can’t communicate, that it’s too hard to communicate with addiction providers,” Vaughn said they should just obtain the individualized consent from the patient. “It’s not that hard,” she said.

“I understand that it would be easier if all they had to do was follow the HIPAA regulations, but there are reasons why the regulations are stronger” for SUDs, she said.

There are strategies that could facilitate both treatment and privacy, such as the data segmentation for privacy initiative (DS4P) (see ADAW, May 25), which was initiated by Clark when he was at CSAT (see ADAW, Sept. 24, 2012). Under DS4P, patients could separate their SUD records and have individualized consent for release.

Netsmart’s Scalia, who said he has been part of the DS4P experiments, would not be opposed to such a rule, but would want all other EHR vendors to be subject to the same rules.

As he has been saying for years, Clark told ADAW that it comes down to what is convenient for the big providers — of treatment and of EHRs — versus what protects the patients. “It seems that it is comfortable to sacrifice the most vulnerable,” he said.

AATOD and Legal Action Center

The positions of the American Association for the Treatment of Opioid Dependence (AATOD), a membership organization of opioid treatment programs (OTPs), and the Legal Action Center, which more than 40 years ago helped draft the 42 CFR Part 2 regulations, and has worked on them ever since, have not changed. Both organizations oppose changing the regulation.

“We don’t want to get out ahead of SAMHSA,” said Anita Marton, deputy director and vice president of the Legal Action Center. “We know that SAMHSA is looking at how to modify the regulation, allowing for information flow yet protecting patients’ rights,” she said. “But our position has not changed. We still think it’s premature for any legislation to be enacted.”

“I suspect that there is a potential so-called negotiated approach, which is that if OTPs have to share information, it has to be sealed in such a way that only certain entities can get access to it, and that law enforcement can’t,” AATOD President Mark Parrino told ADAW. “I’m not comfortable with that. Once the safeguards end, there is a different problem, like patients not wanting to come into treatment, or stable patients leaving treatment for fear of being found out.”

Patients are capable of telling their physicians about their SUD status. Consider the statement of Walter Ginter, project director at Medication-Assisted Recovery Services and a methadone patient, made at a public meeting on 42 CFR Part 2 five years ago at which physicians, particularly those prescribing buprenorphine, wanted to have access to OTP patient records (see ADAW, Aug. 9, 2010): “Is there a sudden epidemic of patients being given medications around the country because we don’t have access to those records now? Like most patients, I carry a little card. I’m someone who takes a medication that might be contraindicated if I were in an emergency environment, and I carry a little card in my wallet that says do not give Walter certain medications because of that reason. I think medical people making the assumption that we’re all too stupid to take care of our own medical conditions is insulting, to say the least.”

The Americans with Disabilities Act (ADA) does not protect current illicit drug users, Clark noted. “If they can’t change the ADA, if they can’t change the criminal justice system in states, if they can’t change the child welfare system in many states, if they can’t change employers’ attitudes, if they can’t keep sensitive information protected, then recognize the unique role that SUD has in the mindset of America and behave accordingly,” said Clark. “A computer fix and patient consent would solve the information problem. However, it seems that the system believes that it is cheaper to shift the risk and the harm to the poor.”

Bottom Line…

A divided field, with patients on one side and providers and vendors on the other, looks forward to forthcoming rulemaking on 42 CFR Part 2.