Substance Abuse and HIPAA

War on Drugs

It was the 1970’s: a time of disco dancing, polyester suits, and crazy nights. It was also time of increasing stress, depression, and anxiety following the Vietnam war and Watergate scandal. Many people were looking for an escape and turned to alcohol and drugs. This new era, with President Nixon at the head, ushered in America’s new political relationship with narcotics otherwise known as “The War on Drugs”.

Cocaine, speed, and heroin combined with alcohol and smoking were used so frequently many people became addicted. By the 1980’s the widespread use of drugs went from affecting family and communities to affecting everyone nation-wide. The presidency of Ronald Reagan marked the start of a long period of skyrocketing rates of incarceration, largely thanks to his unprecedented expansion of the drug war. The number of people behind bars for nonviolent drug law offenses increased from 50,000 in 1980 to over 400,000 by 1997.

42 CFR Part 2

As part of the renewed effort to combat ongoing substance abuse and provide resources for prevention, 42 CFR Part 2 regulations (Part 2) were enacted in 1987 by the Secretary of the US Department of Health and Human Services (HHS) as authorized by both the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970 and the Drug Abuse Prevention, Treatment, and Rehabilitation Act of 1972. These Acts with Part 2 regulations provide comprehensive privacy protections in an effort to encourage people to seek treatment for substance abuse problems.
Part 2 sets forth the limited circumstances in which substance abuse patient information may be used or disclosed and no uses or disclosures other than those detailed in the regulations are permitted.

These laws remained unchanged until 2017 and 2018 where minor revisions were made to the releasing restrictions of disclosure for treatment and interoperability. Now Part 2 treatment centers and providers can share certain data to help in the continuity of care while protecting the alarmingly increasing trend of opioid and prescription medication addiction.

Shifting Responsibility

Responsibility is shifting slowly. Just this week three pharmaceutical companies settled an Ohio class-action lawsuit paying $260M, including some of those proceeds going to fighting addiction. In addition, three other major drug distributors are facing a potential $18B lawsuit over 18 years and reportedly are negotiating another multi-billion dollar settlement.

We have seen both HIPAA and 42 CFR Part 2 in action recently in Utah. A nurse employed by Utah Hospital experienced a substance use disorder (SUD) in action. The case was regarding concerns over the patient’s unconscious state and their ability to give permission to release their health information. Because the nurse didn’t have approval prior to the patient being unconscious, she couldn’t release the information. In this case, the police officer was not trained adequately (see lawsuit from officer to city) and believed he was doing the right thing in the situation. Unfortunately, the officer didn’t understand why the nurse was refusing to provide health information. It ultimately came down to the fact that HIPAA and 42 CFR Part 2 protected the patient’s right to require the patient’s authorization to share that health information. That same information could include SUD data. The nurse could not share this data because she was following the two federal regulations.

This is the spirit of 42 CFR Part 2 – to encourage those with addiction to seek help without the concern of being criminally prosecuted. Through this federal regulation, patients are encouraged to seek help without worrying about losing their families through incarceration or child protective services.

Part 2 Questions Added to HIPAA One’s Privacy Risk Analysis

At HIPAA One, we felt we could use our established Privacy Risk Analysis software, which addresses the patchwork of State’s Privacy and Breach Notification laws which supersede Federals laws, to automate the entire process. Why not use the software platform for 42 CFR Part 2 and include it with the HIPAA Privacy rule? HIPAA One has been providing Substance Abuse Disorder compliance as part of the HIPAA Privacy and Breach Risk Assessment since October of 2019. It comes at no extra fee to help ensure patients who seek help at your organization can be protected.

We all know someone with severe addiction. It affects the ones who love them the most. Help ensure their information isn’t used inappropriately so they may seek help and still be there to watch their children grow up.