Massachusetts Medical Society: Clarifying Privacy Law: Opioids, HIPAA, and the PMP

Clarifying Privacy Law: Opioids, HIPAA, and the PMP

Law and Ethics


The new opioid legislation signed this month into law includes a new requirement that, as of October 2016, all Massachusetts prescribers must query the prescription monitoring program, or PMP, prior to issuing every Schedule II or III narcotic.

There is often confusion as to whether federal privacy laws, including HIPAA, may limit discussions about patients with potential substance use disorders without prior patient consent.

In this context, the physicians involved in these communications would fall under the definition of covered entities and thus be subject to HIPAA privacy regulations. The content of these discussions — patient identifying information, prescriptions, concerning behavior — would fall under HIPAA’s definition of protected health information, again making these discussions subject to HIPAA rules. HIPAA generally allows for communication with an outside physician pertaining to the treatment of the patient without prior patient consent, so long as several precautions are taken including limiting personal health information disclosures to the minimum necessary.

Psychotherapy Notes

While HIPAA generally provides equal protection to health information regardless of the nature of the content, the regulations have a specific provision for psychotherapy notes. HIPAA requires authorization from the patient prior to the use or disclosure of psychotherapy notes, except where required by law in “duty to report” or “duty to warn” situations. HIPAA defines psychotherapy notes as “notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separate from the rest of the patient’s medical record.”

For the purpose of this PMP-prompted discussion, it should be noted that psychotherapy notes do not include any information about medication prescription and monitoring, nor do they include summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date. While physicians must remain mindful of this limitation to patient consent-free communication about treatment, the psychotherapy notes provision is relatively narrow in its definition.

Separate Provisions

In addition to HIPAA’s confidentiality requirements, there are separate federal drug and alcohol confidentiality regulations, often referred to by its citation, 42 CFR Part 2.

The applicability of who is covered by the provisions of 42 CFR Part 2 is much narrower than HIPAA. Also, 42 CFR Part 2 applies to “programs,” other than general medical care facilities, which is defined as any person or organization that “holds itself out as providing and provides, alcohol or drug abuse diagnosis, treatment, referral for treatment or prevention.” Importantly, the Substance Abuse and Mental Health Services Administration (SAMHSA) has provided some clarification about this broad definition, particularly to primary care practices that may occasionally provide such treatments and referrals.

Important Exceptions

According to SAMSHA, primary providers who do not work in general medical care facilities meet 42 CFR Part 2’s definition of program only if their principle practice consists of providing alcohol or drug abuse diagnosis, treatment, or referral for treatment, and they hold themselves out as such.” Lastly, 42 CFR Part 2 only applies to programs that are federally assisted, though the law provides a broad definition of this including receiving federal funds in any way, receiving tax exempt status, having DEA licensure, being a Medicare provider, etc.

Providers subject to 42 CFR Part 2 must adhere to impor--- tant restrictions on their communications about a patient. Specifically, they are prohibited from unlawful disclosures, defined as any communication of information that directly or indirectly identifies someone as being in, or having been in, or having applied for treatment in a substance abuse program. The scope of protected information that can be considered to identify a patient as an alcohol or drug patient or having a drug or alcohol problem is also quite broad and includes written or oral information about a patient’s status as a current patient, information about a patient’s identity, medical or treatment information, as well as “impressions of program staff.”

There are several important exceptions to the disclosure prohibition in 42 CFR Part 2. The primary exception is prior patient consent. In fact, 42 CFR Part 2 has several specific, important requirements to the consent process that must be reviewed before any signed document is considered valid. These requirements are detailed in the statute, but include the need for an explanation of the need for and scope of the consent, as well as indication of the expiration of the consent, among others. These consent forms do not have to be specific to each given request, so practices subject to these rules should consider drafting blanket consent forms that incorporate the specified consent factors.

Also, 42 CFR Part 2 has an exception for communication pertaining to medical emergencies. Under this provision, patient identifying information may be disclosed to medical personnel who have a need for information about the patient for the purposes of treating a condition which poses an immediate threat to the health of any individual and which requires immediate medical intervention. It is important to note that his exception limits emergency disclosure to medical personnel, which is a narrower take than HIPAA.

While the inclusion requirements for practitioners subject to 42 CFR Part 2 are narrow, the disclosure prohibitions are substantial. It should be noted that SAMHSA and the Department of Health and Human Services are currently working to update and modernize these regulations to make the rule more understandable and less burdensome.

The “Law and Ethics” column is provided for educational purposes and should not be construed as legal advice. Readers with specific legal questions should consult with a private attorney.

Share on Facebook

New: Advertise With MMS

Increase your brand awareness and visibility to physicians and the general public through advertising space on the MMS website and several MMS email newsletters.

Read More »

Subscribe to e-Newsletters

Stay on the cutting edge of medicine by subscribing to free MMS e-newsletters. Choose from up to ten subject areas including physician and patient advocacy, public health, CME, daily health care news, and more. 

Sign Up »

NEJM Resident 360  Ad

Copyright © 2018. Massachusetts Medical Society, 860 Winter Street, Waltham Woods Corporate Center, Waltham, MA 02451-1411

(781) 893-4610 | (781) 893-3800 | Member Information Hotline: (800) 322-2303 x7311