What’s next for CFR 42 Part 2?
Privacy laws regarding Behavioral Health medical records fall under the same HIPAA laws covering all medical illnesses in most States (including what we commonly publish as psychotherapy notes but that’s a topic for another day). The exception is that professionals providing chemical dependency treatment in specifically defined chemical dependency programs have to gain explicit permission to release records of that treatment to anyone who is not part of that program. The rule that governs that is under the Electronic Code of Federal Regulations enacted in 1975, i.e. CFR 42 Part 2, which is finally re-evaluated for the first time in almost 30 years, and a proposed revision has been written by Substance Abuse and Mental Health Services Administration (SAMHSA). Much of the proposal involves updating terminology that does not substantially change the regulation.
I recommend reading an often re-published article which gives a broad overview of the issue, but which is too short to explore all the nuances. I feel some of the high points people have misconceptions about, or haven’t thought through are:
If a treating physician of a chemically dependent patient is not part of a chemical dependency treatment program and they write detailed notes about their addiction and illegal behaviors and make diagnoses, those records follow the HIPAA laws of disclosure. Diagnoses are sent to the patient’s insurance company and colleagues can see the records.
Surely, “What everyone can agree on is that protecting the privacy of people who are being treated for substance abuse is critical”, but I would argue that protecting the privacy of patients being treated for any medical issue is critical. Being treated for HIV or another sexually transmitted disease, having an abortion, or anything else a patient feels is especially sensitive is just as important. Data privacy breaches affect everyone and should never happen, but nor should they be used as a reason to hold on to outdated laws about a specific type of treatment.
Chemical dependency treatment records are subject to subpoenas in custody cases per CFR 42 Part 2 Subpart E, albeit in limited circumstances of preventing child abuse or neglect, or threats against someone. The only protection is if a patient never informs anyone they are getting treatment at all, even their physician. In my experience it’s more likely a divorcing spouse will use the chemical addiction itself as a reason to deny custody than anything in treatment records if released.
This rule not only prevents records from being sent on to physicians and others outside of the patient’s treatment community, but also within their medical group. Therefore typically their primary care won’t even be able to see if their patient is being treated for chemical dependency at a program run by their own medical group, and the emergency room staff won’t see any records even if the hospital runs the program and the patient has an a drug overdose. While there is some fantastic work with exchanging chemical health records via Health Information Exchanges between health systems, the fact is that with the way most electronic medical record systems are set up, even with a patient’s permission providers in their treatment program’s medical system cannot view the records. They would need to be printed out and mailed or faxed.
There is still some room for legal interpretation when it comes to revealing medication prescriptions such as methadone or Antabuse as part of the electronic medical record and some institutions have chosen to hide this information in the electronic medical record. Because it is crucial information to know what medications a patient is taking due to interactions, this is potentially medically dangerous.
Not everyone sees this the same way as I do. Until April 11, 2016 everyone has the opportunity to publicly comment on the proposed changes at Confidentiality of Substance Use Disorder Patient Records. After that period, a more formal decision will be made–hopefully without a long delay–one which I will be keeping an eye out for.
The comments so far are varied; many address the ability to access CD treatment records for research, some are quite reactionary, and a few are off-the-wall. Not surprisingly, physicians generally advocate to treating addiction treatment records the same as other records under HIPAA, pleading their case for the need to effectively treat their chemically addicted patients. One interesting comment is from a CD treatment provider: “I have been working in this field for 27 years. I believe that CFR-42 Part 2 should be changed to mirror the guidelines of HIPAA. A number of people use alcohol and drug facilities to hide from consequences of their criminal behaviors.”
“So long as substance abuse information is treated differently from other health information, individuals with substance use disorders will never have the same access, quality, and safety of care as persons with other diseases.”
When it gets right down to it, that pretty much sums it up.
Carol Novak, MD