(This story was updated at 5 p.m ET.)
It's a question the healthcare industry and federal regulators have wrestled with for decades, long before the advent of electronic health-record systems and the latest push to make those electronic records available at any time, anywhere.
HHS weighed in Friday on yet another federal argument against patient control and in favor of more fluid information sharing. The agency proposes modifying a key Code of Federal Regulations privacy rule covering patient records for drug and alcohol-abuse treatment, and by default, behavioral health.
The proposed change to the rule, 42 CFR Part 2, would maintain the requirement that patient consent be obtained prior to disclosing or exchanging medical records that would identify, directly or indirectly, an individual who has been diagnosed or treated for a substance-abuse disorder.
But the proposed rule also would allow “other health-related information shared by the Part 2 program to be disclosed,” without consent, “if permissible, under other applicable laws.”
The changes would allow a broad general consent form to be signed, said Jim Pyles, a principal with Powers Pyles Sutter & Verville, and an expert on 42 CFR Part 2.
Currently under the rule, each facility that seeks to exchange a drug- or alcohol-abuse patient's record must specify who will get the information, Pyles said. The proposed rule “says patients can have a general consent.”
The concern is that handing a patient a general consent form would become a de facto standard, he said. “These people will be presented this consent form at their weakest, where they're suffering and at their most vulnerable,” Pyles said. “It's an effort that appears to preserve the patient's right, when in practice, it sets up a process to ignore it.”
Renee Popovits, principal attorney with Popovits & Robinson, said she sees the proposed rule as a “positive step,” adding she was “thankful” for its general consent provision. But she agreed with Pyle's concern over patients' knowledge of what rights they're signing away.
The key principle of the consent form is that a patient must understand it. “I think the regulations could be drafted more simply so the rules are clearly understood and implemented as intended,” said Popovits, who serves on the executive committee of the Illinois Advisory Council on Alcoholism and Other Drug Dependency.
In 2002, HHS reversed itself in a rewrite of the Health Insurance Portability and Accountability Act, saying providers were authorized to move patient records around to other so-called HIPAA “covered entities” and their “business associates” without patient consent for most common healthcare activities.
Those activities were lumped together under the law as “treatment, payment and other healthcare operations," or TPO.
Prior to 2002, consent was required, even for TPO disclosures.
But the more relaxed interpretation of HIPAA clashed with several older federal privacy rules, one governing the disclosure of veterans' medical records by the Veterans Health Administration, and the other covering patients in federally funded drug- and alcohol-abuse treatment programs. This, by default, included behavioral-health patients, who frequently have drug- and alcohol-abuse problems as well.
Both the VA rule and 42 CFR Part 2 require advance patient consent before those patients' records can be moved, even for TPO.
The arguments both for and against sharing information without consent were laid out in the first two pages of the 144-page proposed rule.
In the document, HHS said the last substantive update to the 1970s-era rule was in 1987, well before the widespread use of EHRs and the recent movement to “new models of integrated care . . . built on a foundation of information sharing to support coordination of patient care” as well as “a new focus on performance measurement within the healthcare system.”
Those care models are also the foundation of HHS' efforts to control healthcare costs.
HHS wants to develop an infrastructure for managing and exchanging patient data, with an increased focus on performance measurement and quality improvement within the healthcare system, according to a news release announcing the changes.
“We are moving Medicare, and the healthcare system as a whole, toward new integrated-care models that incentivize providers to coordinate and put the patient at the center of their care, and we are modernizing our rules to protect patients,” HHS Secretary Sylvia Mathews Burwell said.
The problems of exchanging patient information between substance-abuse treatment providers and general health providers are real, said Edward Zacharias, a partner in McDermott Will & Emery's health industry advisory practice group.
“These limitations have been especially cumbersome for integrated healthcare-delivery systems that offer federally-regulated substance-abuse treatment programs,” Zacharias said. “There is a clear disconnect between HIPAA and the federal substance-abuse treatment regulations in terms of the steps that must be taken to permissibly use and disclose health information under each regulatory scheme.”
On the other hand, the more stringent privacy protections of 42 CFR Part 2 were placed there for good reason, according to the rule makers themselves.
Without proper safeguards and privacy constraints on the sharing of their records, including giving drug- and alcohol-abuse patients the right to limit access to their medical information, those patients may be subject to “loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, prosecution, and incarceration,” according to HHS.
And knowing that, some patient advocates worry that those patients—quite rationally—will choose not to seek treatment, incurring potential harm to themselves and society.
