Broken-glass perils

I was talking with Catherine O'Neill recently about a federal rule called 42 CFR Part 2.

O'Neill is senior vice president and HIV/AIDs project director for the Legal Action Center, a not-for-profit law and policy organization based in New York with an office in Washington.

She is good at her job—so good that when I asked an official with HHS' Substance Abuse and Mental Health Services Administration about whether the unique consent requirements of 42 CFR Part 2 would mesh with a proposed health information network, he recommended I give O'Neill a call.

The 42 CFR Part 2 rule is intended to give drug- and alcohol-abuse patients and their caregivers some protection from law enforcement officers nosing around in medical records—the thought being that if drug users want to kick their habits, they should be encouraged to seek confidential treatment.

What endears 42 CFR Part 2 to some privacy advocates is that it obliges drug and alcohol treatment providers who receive federal funds not to disclose their patient records without written consent. The 42 CFR Part 2 rule is unique because should any records of drug- or alcohol-abuse treatment from a covered provider be passed along to another provider, the same obligations of confidentiality and consent pass with the records.

Each disclosure made with the patient's written consent must be accompanied by an attached written statement informing the next clinician that federal rules "prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains." There are a few exceptions, such as a "break-the-glass" waiver for emergencies, and within that exception looms a significant loophole in the law.

"A treatment provider may disclose information without consent to any outside medical persons who are providing treatment as a medical emergency,” O'Neill said. If the emergency room has access to a health information exchange, the treating clinician can query the exchange asking for any information about that patient, she said.

And if the drug- and alcohol-abuse treatment provider is connected to the exchange, the emergency room clinician "can get access to it without consent, and the thing about it, once I go to an emergency room and they get information about me, that information that was obtained from the drug program is no longer protected," O'Neill said. "It can be re-disclosed without the further consent of the individual."

"'Break-the-glass' was part of the original law," not the rule, O'Neill said, so to close that loophole for secondary use of those records would require a tweak to the law, not the rule. And maybe such a tweak is needed.

O'Neill said that in the paper world, the break-the-glass loophole hasn't been much of a problem. In the coming world of ubiquitous, electronic and interconnected medical records systems, it could be a big headache.