Senate HELP Committee Issues Testimony From Santa Clara University
"My name is Dr.
"I am currently teaching undergraduates about substances of misuse to undergraduates at
"I am here to advocate for maintaining the integrity of 42
"As you well know, we are in the midst of the worse opioid epidemic that this nation has ever seen. And, at the same time, less than 10% of people who need treatment seek treatment.
"Instead of recognizing that we need to reassure those in need of treatment that they can trust the treatment community to use the information they disclose, many are calling for severely weakening 42
"It is argued that the opioid epidemic justifies modifying 42 CFR Part 2 to address the opioid overdose deaths and the misuse of opioids. While the issue of opioid misuse is of major importance, we should keep in mind that 42 CFR Part 2 does not just apply to opioids.
"Data from the
"These numbers alone suggest the magnitude of the issues we are confronting today, as they exceed the 3.4 million people who admit to past month use of pain relievers and the 475,000 who admit to past month users of heroin.
"The critical question today is how do we get the 28.6 million Americans who are current illegal drug users and the 65 million people who are binge drinkers to discuss their substance use with the medical community?
"Although the use of alcohol is legal for those over the age of 21, the medical community should also communicate with their patients about alcohol use. However, as for all psychoactive substances, communications between clinician and patient require trust. Trust is not possible if the function of disclosure is the release of sensitive information into a virtual data storm sewer It is often argued that substance use should be treated like HIV, the flu, diabetes or hypertension and therefore should be treated like those conditions. Those who make this argument blind themselves to the reality that many substances of misuse are illegal, and that disclosure of such information can give rise to harm to the individual affected.
"The harms to which a person who admits to substance use may suffer includes the loss of employment, the loss of housing, the loss of child custody, the loss of benefits, stigma and discrimination, the loss of privacy and the loss of autonomy.iii Medical records can also be used to incriminate a person and subject that person arrest, prosecution, and incarceration.
"It is irresponsible to ignore the real harms to which a person with a history of substance use could be subject. It is also irresponsible to ignore the implication that modern electronic health information has for privacy and confidentiality. It is sometimes said that computers have eidetic memories----they don't forget. Thus, people in recovery from alcohol and drug use who have long since stopped using are still at risk for discrimination and stigma.
"The case is often made that the health care delivery systems need to know about the substance use history of a patient. You don't hear why providers can't simply ask patients themselves about their substance use histories. You hear that it is too confusing for clinicians to know about 42 CFR Part 2 and to apply the rules Yet, these same clinicians and health care systems spend quite a bit of time learning about and executing reimbursement rules, licensing rules, administrative rules, quality standard rules, and all the other rules that are necessary to get paid for the services delivered to the very people whose agency and dignity are now deemed too inconvenient to respect..
"No, I rarely hear or read about concern about the harm to the patient. Instead, I hear concern for the convenience of the delivery system, a concern that creates an adversarial relationship between patient and practitioner rather than respect for and trust from the patient. What appears to underlie the argument for administrative efficiency and systems needs is distrust of the patient, if not contempt for the patient.
"Now is the time to welcome people with substance use disorders into the health care delivery system, not with the demand that such individuals concede their agency, dignity and privacy to the administrative convenience of the health care delivery system, but with the old adage of "First, do no harm."
"Distrust and Contempt for people with substance use disorders has led to distortions and misinterpretation of 42 CFR Part 2. Emergency room clinicians argue that a patient with an opioid use disorder comes into the ED following an overdose and is unresponsive, 42 CFR part 2 keeps them from getting lifesaving information. Not true, 42 CFR Part 2 allows those emergency room clinicians to access Part 2 protected information kept either by a health information exchange or a substance use disorder treatment program in order to treat the patient in the emergency status.
"Internists may argue that it is critical not to prescribe an opioid to an opioid dependent patient who is on methadone. However, they don't establish that asking the patient about their methadone treatment is ineffective. Furthermore, they don't establish that checking the PDMP is ineffective. If the PDMP is ineffective, they don't argue for improving PDMPs by making them real time and regional.
"Family members, concerned about the welfare of their opioid dependent adult relative, are not precluded from getting information when an unconscious adult is brought into the ER following an opioid overdose. Emergency room clinicians under this situation are not prohibited from sharing information with those concerned family members.
"It is argued that 42 CFR Part 2 perpetuates the stigma of addiction. This disingenuous argument ignores the laws, regulations, policies and social view about addiction and substance use disorders. It is not illegal to be depressed. It is not illegal to have diabetes. It is not illegal to have a broken leg. It is illegal to use heroin. People with untreated or active diabetes are protected by the Americans with Disabilities Act. People with untreated or active substance use are not. There are no signs posted at the employment office of employers declaring that the workplace is a hypertension free workplace and that all new applicants will have their blood pressure checked; there are no signs saying that anyone with evidence of hypertension shall be denied employment.
"
"Thus, the regulatory efforts to allow patient to provide a general disclosure for substance use disorder information, to offer some flexibility in transmitting substance use data electronically, and to clarify the circumstances in which providers can disclose patient information to contractors and subcontractors for payment and healthcare operations is not enough. The critics of 42 CFR seek to expose those with substance use disorders who seek treatment, making the exercise of treatment a dangerous proposition.
Patient Attitudes toward Treatment
"We spend millions of dollars collecting information about the substance use patterns of people in the US. Perhaps we should be concerned about the reality that 89% of people, who meet criteria for needing substance use disorder treatment, did not receive such treatment.iv
"Of the 28.6 million people who misused illicit drugs and the 65 million people who were binge drinkers in the past month, only 3.8 million people received treatment in the past year. Of course, mere use does not equate with dependence or needing treatment. However, NSDUH data indicate that over 20 million people 12 or older met criteria for a substance use disorder in the past year in 2016, with 2.1 million meeting criteria for an opioid use disorder.
"What is equally interesting is that of the people who met criteria for needing treatment and did not receive treatment, 95.5% perceived no need for treatment. In short, 18.7 million people needed but did not receive treatment; of these, 17.9 million perceived no need for treatment.
"Now comes the critics of 42 CFR Part 2, under the flag of bringing integrated treatment to those in need, claiming that it is 42 CFR Part 2 that operates as a barrier to effective and efficient treatment of opioid use disorders, claiming that there is no need for special concerns about substance use disorders, today, never mentioning how they will explain to those actually seeking treatment and those in need of treatment the ramifications of attenuating 42 CFR Part 2.
Changing 42 CFR Part 2 and the Response of Substance Users
"It is important to recognize that 42 CFR Part 2 does not apply to most clinicians or most clinical settings. In fact, 42 CFR Part 2 only applies to programs that hold themselves out "as providing, and provides, alcohol or drug abuse diagnosis treatment, referral for treatment or prevention."
"Of course, 42 CFR Part 2 governs substance use disorder patient records for those patients who receive, diagnosis, referral or treatment from (a) an identified unit of a general medical facility that holds itself out as providing, and provides alcohol or drug use disorder diagnosis, treatment or referral for treatment or (b) medical personnel or other staff in the general medical care facility whose primary function is to provide those services.
"So, it is the patient records of a substance use disorder program (which includes the substance use patient records clinicians who hold themselves out as treating people with substance use disorders in even in non-specialty settings), that are controlled by 42 CFR Part 2. This creates a responsibility for the substance use disorder program to explain to the patient the meaning of confidentiality as it applies to information disclosed to the treatment program.
"For the millions of people whose substance use does not meet criteria for protection under 42 CFR Part 2, HIPAA controls. HIPAA regulations allow for unconsented disclosure of patient information for, among other things, healthcare operations.
Healthcare operations include:
* Underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance)
* Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of nonhealth care professionals, accreditation, certification, licensing, or credentialing activities;
* Business planning and development, such as conducting cost-management and planningrelated analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies
* Business management and general administrative activities of the entity, including, but not limited to:
- Management activities relating to implementation of and compliance with the requirements of this subchapter;
- Customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that protected health information is not disclosed to such policy holder, plan sponsor, or customer.
- Resolution of internal grievances;
- The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity; and
- Consistent with the applicable requirements of * 164.514, creating de-identified health information or a limited data set, and fundraising for the benefit of the covered entity.
"Do non-42 CFR Part 2 covered providers explain the width and depth of the health care operations provision under HIPAA? Would patients exempted from 42 CFR Part 2 protections feel that disclosing histories of substance use is wise under HIPAA, even if experimental or rare use of psychoactive substances is involved? Much of the literature favoring weakening 42 CFR Part 2 or aligning it much more substantively does not discuss this perspective.
"Moving from HIPAA into those programs whose records are controlled by 42 CFR Part 2, it is clear that those with moderate to severe substance use disorders requiring treatment already do not believe that treatment is warranted. How are we going to encourage them to participate in treatment when we propose to broadcast their personal information through network of uncertainty entities with uncertain purpose? Unfortunately, there are more serious consequences to voiding the patient's right to consent to the disclosure of sensitive information. The unconsented disclosure of sensitive information resulting in harm to the patient could easily give rise to suicide, relapse to substance use or overdose; these are tragic events that we should be avoiding rather than pretending that the agency and dignity of the patient has no value and can be compromised for the convenience of EHR vendors, data miners and health care operations. Furthermore, we should recognize that many in substance use disorder treatment are at risk for depression, anxiety and other psychiatric disorders, any of which would be. made worse by a breach of trust by substance use disorder treatment programs and the health care delivery system.
Blaming the Vulnerable
"The Health Information Technology for Economic and Clinical Health Act (HITECH Act) was enacted under Title XIII of the American Recovery and Reinvestment Act of 2009v. It provided billions of dollars of incentives to an array of primary care hospitals and to physicians to adopt electronic health records and to promote the exchange of health information. However, that same act essentially ignored the behavioral health community; as a result, there were no incentives available for substance use disorder treatment programs to adopt electronic health records. In addition, there were no incentives to the electronic health record industry to develop software and protocols specific to the behavioral health community and the sensitive information generated by behavioral health providers, information of little use to most primary care providers.
"At the time of the unfolding of the HITECH Act, I was the Health Information Technology Strategic Initiative Lead for SAMHSA. My team and I met with a number of software vendors in an effort to address the unique needs of the behavioral health community and to compensate for the omission of behavioral health from the promulgated incentives provided to general medicine. We met with little success.
"However, in order to compensate for excluding behavior health from the incentives, standards, and designs for the evolving EHR systems, information exchanges, and the growing recognition that comprehensive health care required addressing behavioral health, efforts were mounted to promote the fiction that behavioral health patient information contained nothing unique and distinct from the general health care environment.
"The notion that all health care information is equivalent runs counter to the historical status recognized in the psychotherapist-patient privilege which was justified on the grounds that some personal health information was more sensitive than others. Discussions of mental health, substance use, and sexual health are inhibited unless the patient has certain reassurances that highly sensitive personal health information would remain between themselves and their health care providers. Indeed, "the prevailing legal default and ethical norm in Western nations both strongly favor the preservation of patient confidence in the absence of compelling grounds to act otherwise."vi
"As Shenoy and Appel point out, the behavioral health record "often combines data related to the patient's present symptoms, with a descriptive narrative of the patient's life experience, including sensitive details of psychological trauma, domestic violence, incarceration, sexual encounters, and substance abuse. Much of this information is of great value to a therapist, but not always of clinical use to many other medical providers. The stigma attached to mental healthcare among some individuals and in certain cultural communities even leads some patients to avoid using their insurance for psychiatric care in order to protect their privacy."vii
"At SAMHSA, we recognized the continued sensitivity of behavioral health information, especially for substance use in particular. As a result, we developed an open source codebase through a contract that would provide an inexpensive software application for the behavioral health community.viii Unfortunately, due to complaints of unfair competition we discontinued our efforts.
"The HITECH Act with its focus on meaningful use and information exchange did not change the unique character of behavioral health information. As a result, we developed Consent2Share, an open-source data segmentation platform that could be incorporated into existing electronic health records to allow patients to be able to consent to the disclosure of highly sensitive patient information. ix
"Consent2Share was developed evolved within the Data Segmentation for Privacy (DS4P) initiative within ONC's Standards and Interoperability (S&I) Framework to improve the interoperability of the plethora of EHRs containing sensitive information that must be protected.
"The DS4P initiative met its two goals, which were to: Demonstrate how standards can be used to support current privacy policies, including 42 CFR Part 2, for sharing sensitive health information across organizational boundaries; and develop standards that will enable sensitive electronic health information to flow more freely to authorized users while improving the ability of health IT systems to implement current privacy protection requirements for certain Types of health care data, such as substance use disorder patient records.
"Unfortunately, the EHR vendor community felt no need to support data segmentation, dismissing the importance of privacy and confidentiality to patients. Furthermore, health information exchanges chose to ignore the importance of privacy and confidentiality to the patients by choosing not to embrace the utility of data segmentation and patient choice. Naturally, without data segmentation and consent management capacities, substance abuse treatment programs operating under 42 CFR Part 2 requirements have diminished capacities to share information with integrated treatment models that ignore patient choice.
"In short, SAMHSA was able to demonstrate that patient choice could be respected without compromising the agility and flexibility of required for integrated information exchange.
"However, for matters of mere convenience and low market demand, most EHR vendors and health information exchanges chose to support the less expensive and ethically problematic position of eviscerating 42 CFR Part 2..
Economic Disparities, HIPAA, and Confidentiality
"What is remarkable about the industry and provider objections to having patients weigh in on whether their private medical information should be disclosed is the loophole in HIPAA that 13 allows rich people or middle people to have the right to restrict certain disclosures of protected health information to a health plan where the individual pays out of pocket in full for the health care or service receivedx. Health care providers, under HIPAA, are required to include such a statement in the notice of privacy practices provided to the patient. Thus, if a patient is rich and can pay for their own treatment in full, including substance use disorder treatment or if they are middle class and can mortgage their home to pay for their treatment in full, they can avoid disclosing the fact that they are in substance use disorder treatment to their health plan. What is amazing is that providers who are committed to doing no harm are willing to sacrifice poor whites, poor blacks, poor Hispanics, poor
"Given the well documented harm that can happen to a person who is an admitted substance users, it should not be EHR vendors or health systems that should decide what sensitive information should be disclosed outside of a substance use treatment process. Financial ability should not be the deciding factor on whether a person retains a modicum of control over their personal information.
Increased Liability for Substance Use Disorder Treatment Programs
"Substance Use Disorder treatment programs have a duty to inform patients about the limits of confidentiality. Given the spectrum of entities under the rubric of healthcare operations, it would be difficult for a substance use disorder treatment program to accomplish this with any degree of effectiveness; this would expose the covered program to liability.
"Given that the potential harms from inappropriate disclosure of sensitive information garnered during substance use disorder treatment is real, the disclosure of that information may give rise to legal claims including lawsuits for some form of negligence. Unfortunately, since substance abuse treatment programs will be the entities releasing information under the proposed modified 42 CFR Part 2, undoubtedly they will bear the brunt of the legal burden. Increased liability insurance, legal costs, and impaired reputations will ensue. After all, once sensitive information is released into the entity that releases that information has no control over its distribution. The question would become should substance abuse treatment program that released the information have known that it contained information that could be used to the detriment of their current or past patient.
"Substance use disorder treatment programs caught up in lawsuits may have to withdraw from the treatment marketplace. Treatment programs that close under the weight of malpractice claims will only diminish the number of available treatment slots. The cost of care will also increase as treatment programs have to compensate for thee increased administrative costs of doing business.
Conclusion
"We cannot adequately address the current opioid epidemic if we remove the protections that 42 cfr part 2 and its authorizing legislation, 42
"Efforts to balance the health information technology requirements of integrated systems while preserving a patient experiencing a substance use disorder's right to consent to the disclosure of their substance use treatment history and sensitive matters subsumed under that history have been thwarted by the EHR industry and by health information exchanges. The claim that it would cost too much is overshadowed by the existence of open source strategies that could accomplish the necessary consent management strategies and by the inherent right of a person to determine what happens to sensitive information.
"In truth, 42 CFR Part 2 has been changed in 2017 and 2018. Now is the time to leave it alone, to let the health care delivery system to gain a modicum of expertise to those changes, and to allow the information technology industry an opportunity to further pursue technological accommodations to existing information systems to permit patient consent to sensitive information."
* * *
Footnotes:
i Source: SAMHSA,
ii Satel, Sally, "The Myth of the Roots of the Opioid Crisis",
iii Lopez, Karla & Reid, Deborah, "Discrimination Against Patients with Substance Use Disorder Remains Prevalent and Harmful: The Case for 42 CFR Part 2, " Health Affairs Blog,
iv Source: SAMHSA,
v The American Recovery and Reinvestment Act of 2009, Public Law 111-5).
vi Shenoy, A and Appel, JM, "Safeguarding Confidentiality in Electronic Health Record", Cambridge Quarterly of Healthcare Ethics (2017), 26, 337-341.
vii Ibid
viii http://www.feisystems.com/what-we-do/learn-about-wits/why-choose-wits-2/
ix
x
Nearly 6,000 Pedestrians Killed In 2017 Crashes, Report Says
Otter’s health care plan stuck in committee
Advisor News
Annuity News
Health/Employee Benefits News
Life Insurance News