Privacy Regulations and Addiction Treatment

The idea that addiction is a treatable medical illness is a rather new one.

For centuries, addiction was considered to be the result of bad character, poor impulse control, bad parenting, or some other moral failing. In turn, public policy regarding addiction was governed almost exclusively (and continues to be governed quite substantially) by the Department of Justice. Emphasis was always on addiction as a crime, and protecting the public from addiction and addicted individuals.

This began to change in the late 1960s, with America’s second major opioid epidemic. (The first, following the Civil War, was our deadliest.) With so many Vietnam veterans returning addicted, arrests and incarcerations were not politically attractive as the sole policy. Methadone had shown promise as a solution to the opioid problem. Therapeutic communities were considered potentially helpful, too. So in the early 1970s, our country’s first “drug czar”, Dr. Jerome Jaffe, was appointed. He set up what survives to this day as the national network of addiction treatment programs.

Dr. Jaffe purposely set up this national addiction treatment system to be culturally, functionally, and financially separate from the rest of healthcare.

There were good reasons for this. Mainstream healthcare was not trained to handle any addiction. Most physicians felt addictions were not “real” illnesses (and unfortunately, far too many continue to believe this). People with addictions presented major behavioral problems that healthcare wanted nothing to do with. So methadone maintenance programs, therapeutic communities, outpatient clinics and hospital rehab programs were designed, developed, and brought to scale using primarily state block grant dollars that were under the control of the “state director of alcohol and drug abuse.”

Very few health insurance companies offered any kind of coverage for even detoxifications. The only health care organization that actually incorporated addiction treatment into its repertoire was the VA—again, because of the tremendous demand among returning veterans and the significant political pressure to “do something.”

But remember: Addictions were still considered crimes.

Evidence of drug use was justification for being fired from employment (and therefore losing employer-subsidized insurance). Addicted individuals could be arrested under “suspicion of internal possession,” and if they tested positive for drugs, they could be charged and incarcerated. So, even as these new treatment programs were funded and created, addicted individuals who sought treatment at these programs could still be (and regularly were) arrested and charged by local or state police.

Physicians and other clinical staff could be required to provide the names and relevant clinical histories of their patients who were in addiction treatment.   

Treatment notes and case records were able to be subpoenaed and used against an addicted individual in a trial. This was not true for the rest of medicine because most other illnesses were not considered crimes, and because clinical information was protected by existing privacy/confidentiality laws. There were some exceptions, such as sexually transmitted diseases and underage pregnancy.

To protect addiction treatment patients and staff, it was necessary to design and develop specially tailored privacy/confidentiality statutes for addiction.

That was the genesis and rationale for Section 42 of the Code of Federal Regulations, Part B, in the late 70s.

42 CFR allowed addiction treatment staff to collect and use a wide range of clinically relevant information without worrying about that information being seized and used against them or their patients. That was a very good and welcome part of the new regulation. In fact, it was the first privacy/confidentiality regulation that recognized that an individual’s healthcare information (in this case, addiction history) was the property of that individual, and that without the individual patient’s signed consent, it could not be shared with any other person or organization. (The only exception to this was a life-threatening medical situation.)

These new privacy protections were a good thing. But there were negative consequences, too.

42 CFR gave patients rights that they had once been denied, even in the rest of healthcare. But it also had negative consequences, which have only intensified as the decades advanced and society’s understanding of and policies surrounding addiction have changed. 

Now, 42 CFR has resulted in an inability to share relevant personal and public health information about addiction with other healthcare professionals or organizations.

Remember, virtually all addiction treatment was (and largely still is) conducted outside the financial and organizational boundaries of the rest of healthcare. So, while this separation has protected many individuals who did not want their addiction to be known by their doctor’s office or by their health insurer, it also prevented addiction treatment programs from sharing important, indeed lifesaving, information about addiction history with the rest of the healthcare professionals who were treating the same patients.  

For example, a primary care physician trying to help control a patient’s pain, perhaps with an oxycodone prescription, would likely be unaware if their patient was concurrently taking methadone or buprenorphine. These unknown drug-drug interactions can be life-threatening.

42 CFR perpetuates the segregation of addiction treatment from the rest of healthcare. 

The separate privacy/confidentiality constraints of 42 CFR have prevented information about addiction and addiction treatment from becoming part of a patient’s general medical record. In the first decade of the 2000s, with the reorganization of healthcare under the Affordable Care Act, there were significant funds available for physicians and other clinical professionals to acquire computers and to begin using electronic health records (EHRs). But because of 42 CFR, those funds were not available to addiction treatment programs—and the resulting EHR programs did not contain provision for screening, diagnosing, or referring patients with addiction to treatment. This has left the entire addiction treatment field seriously behind the rest of mainstream healthcare in the ability to manage addictions using the EHR-related information and tools that are so useful in the management of other chronic illnesses.  

Segregating addiction treatment information has been costly and detrimental to public health.

It’s resulted in an inability to measure the nature and extent of healthcare service utilization by addicted individuals, affecting the related practice of “carving out” insurance benefits for addiction and mental health disorders.

It has prevented insurers, employers, and state agencies from seeing the true costs of undiagnosed, untreated addictions on the rest of healthcare. In turn, the separation of these information systems has prevented or delayed the ability of Medicaid and Medicare to incorporate much-needed coverage for addictions and addiction-related problems.

Progress since the 1970s makes it much safer for addicted individuals to trust healthcare organizations with their information.

An addicted individual who is in treatment and otherwise has a good employment record can no longer be fired from their job for the crime of “being addicted” because of the Affordable Care and Mental Health Parity Acts. So that’s one less reason to fear negative consequences. 

Further, when healthcare records were an actual paper file, risks were higher. Transferring even one piece of health information among professionals meant transferring the whole, physical file, posing greater privacy risks. But today, it’s possible to electronically segment health information, and for a patient to give permission to transfer just that part.

Finally, the rest of healthcare has moved far closer to the confidentiality/privacy standards set by 42 CFR.  The rest of healthcare is now controlled by the Health Information Privacy and Portability Act (HIPPA), which properly respects the patient’s ownership and control of health information. HIPPA training (as well as enforcement) has made the rest of healthcare much more aware of and able to protect patient information.

42 CFR protected patients when they needed it. But as our country begins to integrate addiction treatment into mainstream healthcare, we must evolve policies to make treatment safe and effective—while still maintaining privacy.

New legislation enhances health information-sharing while still strictly protecting patient privacy.

Thankfully, the CARES Act, legislation recently signed into law to address the coronavirus, included a change in law that will allow addiction patients to consent to the sharing of their records with health systems treating them. It further prohibits discrimination against the individual and restricts the use of information by law enforcement. 

That Congress passed this legislation amidst the public health crisis demonstrates that addiction is linked to economic crisis and should alert us all to further exacerbation of the addiction crisis.  This change in privacy policy will be an important tool to ensure those with addiction get quality treatment and is a monumental step toward removing the stigma associated with doing so.

Thomas McLellan, Ph.D., is a member of Shatterproof’s Scientific Board. Dr. McLellan is the founder of the Treatment Research Institute (RTI), a Professor of Psychiatry at the University of Pennsylvania, and former Deputy Director of the White House Office of National Drug Control Policy (ONDCP).