By David Fegley *
More than 800 Americans die from opioid overdoses every week.[i] A statute passed nearly a half-century ago, inspired by noble intentions, is making the epidemic harder to combat.
In March 1972, President Nixon signed the Drug Abuse Office and Treatment Act into law, creating the National Institute on Drug Abuse within NIH. The law authorized hundreds of millions of dollars towards further education, treatment, and research efforts in an attempt to encourage Americans to seek treatment for drug abuse.[ii] Given the stigma surrounding substance use disorder (SUD), Section 408 of the law established privacy protections, requiring the patient’s consent to disclose any identifiable medical record information about their SUD diagnosis or treatment, except in cases of “bona fide medical emergenc[ies].”[iii]
The problem, critics allege, is that once the regulations pursuant to the statute were added to the code of federal regulations under 42 CFR Part 2, they enshrined confidentiality requirements far more restrictive than those required by the federal statute.[iv]
Under 42 CFR § 2.31, for instance, a patient’s written consent form must include nine distinct elements, including the purpose of the disclosure, the name of the recipient of the medical information, and the expiration date of the consent.[v] These stringent requirements predate the more broad-based privacy protections established in the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
In some ways, it makes sense to have added layers of privacy protection for substance use disorder, given the persistent stigma that surrounds treatment of the disease.[vi] But as medical practices have shifted in recent years towards more integrated delivery care systems with interdisciplinary care teams working collaboratively to help patients with complex needs, the high barriers 42 CFR Part 2 places on information sharing are negatively impacting SUD patients. What that means in practice is that individuals suffering from SUD are often treated in care silos, in which their primary care specialist may be unaware of their condition and unable to access part of an electronic health record from their addiction medicine physician. As two hospital system physicians put it in a recent Health Affairs blog, “[i]magine the harm that occurs when a patient with opioid use disorder goes to see a physician who is not able to see that patient’s diagnosis due to 42 CFR part 2, and unknowingly prescribes opioids.”[vii]
With a growing chorus urging reform to 42 CFR Part 2, the Substance Abuse and Mental Health Services Administration (SAMHSA) has begun to take action to adjust 42 CFR Part 2’s stringent requirements.[viii] The largest changes came in 2017, when the agency tweaked implementation of confidentiality safeguards. Rather than requiring patients to list out individual providers in their consent forms, the 2017 final rule now allows patients to make a “general disclosure” by writing that medical information may be disclosed to “my treating providers.” A patient who completes a general disclosure may also request disclosure tracking under §2.13(d) to access a list of all providers with whom their information has been disclosed.[ix]
The agency’s regulatory efforts, which represent the first substantive changes to 42 CFR Part 2 in decades, are important first steps. But SAMHSA, on its own, will be unable to align 42 CFR Part 2 with HIPAA requirements, as many advocates urge. That’s because the agency would exceed its statutory authority if it were to unilaterally alter 42 CFR Part 2 that dramatically. Instead, an act of Congress explicitly directing SAMHSA to modernize privacy protections for SUD patients is necessary.
A bipartisan bill co-sponsored by two Senators from West Virginia — a state hit especially hard by the opioid epidemic — would do just that. The Protecting Jessica Grubb’s Legacy Act amends the federal code so that
“[w]hether or not the patient with respect to whom any substance use disorder patient record referred is maintained gives written consent, the content of such record may be used or disclosed . . . [i]n connection with the provision of medical services or health care to substance use disorder patients consistent with the allowable uses and disclosures to carry out treatment, payment, or health care operations as described in section 164.506 of title 45, Code of Federal Regulations, or any successor regulation.”[x]
In plain English, the statute would align privacy protections for SUD patients with those laid out in HIPAA’s privacy rule found in 45 CFR 164.506. The HIPAA privacy rule permits health providers to use and disclose protected health information for treatment, payment and health care operations activities.[xi] “Treatment” includes the “provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.”[xii] That free flow of patient medical records is important because it gets at the heart of 42 CFR Part 2’s glaring failure.
The proposed legislation’s title refers to Jessica Grubb, a West Virginia native who was a recovering heroin addict when she had to have hip surgery at St. Joseph Mercy Hospital in Ann Arbor, Michigan. Despite her extensive history of drug abuse, the hospital prescribed her oxycodone to help with her recovery. She overdosed and died a day after returning to her apartment after the surgery.[xiii]
An outdated quirk in the code of federal regulations helps explain why. The time for its modernization is long overdue.
*David Fegley is a Junior Editor on MJEAL. He can be reached at firstname.lastname@example.org. He previously worked at the Association for Community Affiliated Plans, an organization that advocated changes to 42 CFR Part 2.
The views and opinions expressed in this blog are those of the authors only and do not reflect the official policy or position of the Michigan Journal of Environmental and Administrative Law or the University of Michigan.
[i] National Institute on Drug Abuse, Opioid Overdose Crisis (2018). https://www.drugabuse.gov/drugs-abuse/opioids/opioid-overdose-crisis.
[iii] Drug Abuse Office and Treatment Act, 21 U.S.C § 1101-1194 (1972) https://www.gpo.gov/fdsys/pkg/STATUTE-86/pdf/STATUTE-86-Pg65.pdf.
[iv] Joe Parks, Time to Change 42 CFR Part 2: Separate is Never Equal. Am. Ass’n on Health and Disability (Mar. 22, 2016), https://www.aahd.us/wp-content/uploads/2016/03/TimetoChange42CFRPart2slides.pdf. (abbrev. Per T13 for publication name)
[v] 42 C.F.R. § 2.31 (2017).
[vi] Karla Lopez & Deborah Reid, Discrimination Against Patients With Substance Use Disorders Remains Prevalent And Harmful: The Case For 42 CFR Part 2, Health Aff. (Apr. 13, 2017), https://www.healthaffairs.org/do/10.1377/hblog20170413.059618/full/.
[vii] Sarah Wakeman Peter Friedmann, Outdated Privacy Law Limits Effective Substance Use Disorder Treatment: The Case Against 42 CFR Part 2, Health Aff. (Mar. 1, 2017), https://www.healthaffairs.org/do/10.1377/hblog20170301.058969/full/.
[viii]SAMHSA Finalizes Changes to Clarify Health Privacy Rules for People who Seek Substance Use Disorder Treatment, Substance Abuse and Mental Health Servs. Admin.: 2018 News Releases, https://www.samhsa.gov/newsroom/press-announcements/201801021100.
[xi] 45 CFR 164.506 (2002).
[xii] 45 CFR § 164.501 (2000).
[xiii] Lindsay Kane, Heroin Addict’s Fatal Oxycodone Overdose Prompts Hospital Investigation, MLive (Apr. 20, 2016), http://www.mlive.com/news/ann-arbor/index.ssf/2016/04/how_did_a_heroin_addict_get_ox.html.