“You’ll hear people say, ‘that violated HIPAA.’ Actually, it violates Part 2, and it’s now gone,” lamented Zac Talbott, president of the National Alliance for Medication Assisted Recovery (NAMA Recovery) about a recent change made to addiction treatment patient privacy protections. The change took place quietly, passed as a rider to the Coronavirus Aid, Relief, and Economic Security Act (CARES Act); or, as Talbott described it, “under cover of darkness, in the midst of a national crisis, with a stimulus bill that no one could vote against.”
Get Talk Poverty In Your Inbox
The rider is named after Jessica Grubb, a Michigan woman who died at age 30 after being prescribed oxycodone for postoperative pain while only a few months into recovery from a seven-year heroin addiction. The Protecting Jessica Grubb’s Legacy Act was sponsored by Democratic Senator Joe Manchin III and Republican Senator Shelley Moore Capito, both from West Virginia, one of the states hit hardest in recent years by an influx of illicitly manufactured fentanyl. Currently, under 42 CFR Part 2, patients engaged in substance use disorder treatment programs that fall under federal purview — which essentially includes any program that utilizes opioid agonist pharmacotherapy like methadone and buprenorphine — must provide informed consent each and every time their records are shared. So when a patient authorizes a methadone program to share medication information with their primary care doctor, that provider can’t disclose the information to a specialist unless the patient signs a new, specific consent. When the act goes into effect in 2021, patients will only have to provide consent once. After that, their records can be re-shared in perpetuity by any health care entity who receives them.
The changes reflect the way privacy and consent are handled for most of health care. The act is effectively changing records disclosure consent rules to match those of the Health Insurance Portability and Accountability Act (HIPAA), except that it still preserves the initial consent required by 42 CFR Part 2.
Despite popular belief, HIPAA allows health care workers to share patient records without their consent for a number of reasons related to health care operations. “HIPAA is not a [patient] privacy protection. It’s actually an authorization to share your info as broadly as a health care payor believes they need to share it, which I will tell you is very broad,” explained Danielle Tarino, president and CEO of Young People In Recovery, who previously worked at the Department of Health and Human Services and, while there, drafted the 2017 revisions to 42 CFR Part 2.
Now, instead of special protections for patients undergoing addiction treatment, these programs will have the same privacy standards as all of health care.
The fight for privacy rights has divided key players in the addiction treatment community, many of whom are otherwise aligned. Proponents of the changes include the National Council of Behavioral Health, the American Society of Addiction Medicine (ASAM), the Substance Abuse and Mental Health Services Administration (SAMHSA), Shatterproof, and several other prominent treatment and health care voices. Those who oppose it, a group that includes the National Alliance for Medication Assisted Recovery, Legal Action Center, Young People In Recovery, and Faces and Voices In Recovery, have successfully thwarted similar proposals in the past.
“It’s just really disappointing to see that bill go through when the political will was, year after year after year, it’s not going to pass because people don’t want it to pass,” said Tarino.
Those who favor the changes say that not only will this make it easier for health care providers to share patient records, it will also allow these programs to be used in the electronic health records programs that are currently designed to meet HIPAA standards. Senators Manchin and Caputo argued that this kind of care coordination would prevent patients like Jessica Grubb from being “thrown back into the nightmare of addiction,” and insinuated that these privacy changes could have prevented Grubb’s death by ensuring all of her caregivers were informed about her addiction history. “There’s emergency glass that could be broken if someone was not able to disclose,” countered Talbott. “The notion Part 2 could cause what happened to Jessica Grubb to happen is outrageous…She disclosed [her addiction status], as most people do with their treatment providers.”
“42 CFR Part 2 said ‘if you go to treatment, we will give you the security and confidence to work on your issues,’” said Westley Clark, Dean’s Executive Professor in the Department of Psychology at Santa Clara University and the former director of the Center for Substance Abuse Treatment (CSAT) within SAMHSA. “Why would I go to treatment if they are going to blab my business all over town? We have a conundrum: We want people to go to treatment, but we are going to discourage people from seeking treatment by telling them ‘your privacy is irrelevant.’”
Part of what made these protections so strong was the re-disclosure rule eliminated by the Jessica Grubb’s Legacy Act. If a patient signed a consent so that their treatment provider could share pertinent care records with their insurance — a requirement in order to have insurance pay for treatment — then those records could only be shared with the insurance provider. Now, a patient’s insurance can re-disclose those records in perpetuity for a number of reasons, including for the vague and effectively ubiquitous use of “health care operations.” This likewise applies to anyone to whom a patient has granted consent.
The language of the new law explicitly states that patients have the right to revoke consent at any time. The problem is that patients must know they need to do this, and also, once records have been shared widely enough, it becomes virtually impossible to communicate and enforce that revocation. Privacy proponents worry that this re-disclosure license will deter patients from seeking treatment, and could lead to harm for those who decide to engage anyway.
“Some insurers have discriminated against substance use disorder patients, and substance use disorder patients have not gotten life insurance or other key insurance like that because they found out,” said Deborah Reid, senior health policy attorney with Legal Action Center, emphasizing the fact that discrimination against substance use disorder patients is not a thing of the past, but a very real problem her office deals with regularly. She argued that lessening privacy regulations for these patients is likely to increase the problem. Other examples of potential bad case scenarios resulting from the relaxed consent rules that she and her co-worker Jacqueline Setz provided were child custody cases, information spread through small town communities, and law enforcement gaining access to the records.
The new law includes anti-discrimination language, which proponents like Shatterproof say is a big win. “Certainly the illegal nature of using drugs should never be a barrier to someone accessing emergency help or medical care when they need it. That’s something we should hopefully all be working toward. This legislation is consistent with existing federal protections around the treatment of addiction,” said Kevin Roy, chief public policy officer at Shatterproof. Currently, the Americans with Disabilities Act (ADA) covers discrimination against substances use disorder patients — but only if they are not currently using illegal substances. If a patient is engaged with treatment but struggling to maintain total abstinence or does not seek total abstinence as a goal, they are not protected against discrimination by the ADA. But opponents say that the new anti-discrimination language won’t be enough to offset the dangers caused by allowing this sensitive information to move more freely. “It’s in there, you can’t discriminate, but if you do — who’s gonna be able to enforce that? With no patient first right of action, patients can’t stand up for themselves unless they have resources to retain counsel and sue in civil court,” said Talbott, adding, “even the parts that sound good, upon further reflection and digging, seem to be paper tigers.”
Although those who have been involved in the fight for years were disappointed that these changes were slipped through alongside the unrelated coronavirus stimulus bill, they say the fight isn’t totally over yet.
“We still have initial consent…it didn’t remove the complete foundation of Part 2, but it will be a different struggle now,” said Talbott, explaining some early-stage strategies NAMA-R and other groups are discussing in order to ensure addiction patients can still have robust privacy protections in the future.
Then, with a note of sadness, he added: “The 10 year battle to preserve privacy protections in Part 2 is over.”
“These are people’s lives we are talking about,” summarized Tarino. “There are very deep implications to people losing rights and privileges because of their participation in something that was supposed to help them.”