Meg Brunner, MLIS
CTN Dissemination Library
Summary: Federal protections enacted to protect patient privacy for those seeking treatment for substance use disorder (SUD) are causing challenges for medical setting staff trying to provide integrated care. These regulations need to be updated to reflect changes to health care systems.
As the opioid epidemic has continued to be a focus of media attention and public policy in the United States, awareness of substance use disorders (SUDs) in general has also increased. Multiple government agencies have called for improved access to treatment, with these efforts coinciding with increased recognition that SUDs are medical conditions whose identification and treatment must be integrated into general medical practice.
Federal regulations, however, have complicated efforts to integrate treatment for SUD into general medical settings. In 1972, Section 42 Part 2 was adopted in the Code of Federal Regulations (42 CFR Part 2) to protect the privacy of persons seeking and obtaining treatment for SUD and to prevent the unauthorized disclosure of personal information to police and other authorities. Primary care providers, hospitals, and health care organizations have struggled to balance best practices for medical care with adherence to 42 CFR Part 2, but little formal research has examined this issue.
The aim of this study was to explore differences in the interpretation and implementation of 42 CFR Part 2 regulations related to health systems data privacy practices, policies, and information technology architecture.
Researchers interviewed privacy/legal officers (n=17) and information technology specialists (n=10) from 15 integrated healthcare organizations affiliated with 3 research nodes of the NIDA Clinical Trials Network (CTN).
Trained staff completed a short survey and a qualitative interview. Interviews were transcribed and coded, and key themes were identified and organized across selected codes.
Participants voiced concern over balancing patient safety with 42 CFR Part 2 privacy protections. Although similar standards of protection regarding release of information outside of the health system were described, numerous workarounds were used to manage intra-institutional communication and care coordination.
To align 42 CFR Part 2 restrictions with electronic health records, health systems used sensitive note designation, “break the glass” technology (a privacy tool allowing for access to information with mandated tracking of who has accessed it and why), limited role-based access for providers, and ad hoc solutions (e.g., provider messaging).
Conclusions: In contemporary integrated care systems, substance-related EHR records (e.g., patient visit history, medication logs) are often accessible internally without specific consent for sharing despite the intent of 42 CFR Part 2. Recent amendments to 42 CFR Part 2 have not addressed information sharing needs within integrated care settings. As Congress and SAMHSA continue to evaluate 42 CFR Part 2 in the context of needed integration of addiction services into general medical settings, these results provide data that can supplement what mostly has been an expert opinion and advocacy group testimonial approach to informing policy decisions.
Citation: Campbell ANC, et al. Interpretation and Integration of the Federal Substance Use Privacy Protection Rule in Integrated Health Systems: A Qualitative Analysis. Journal of Substance Abuse Treatment2019;97:41-46.