HIT and Behavioral Health: The Challenges of Data Exchange and Privacy

US Pharm. 2012;37(12):HS-16-HS-18.

It is important for pharmacists to be familiar with the complex regulations regarding the privacy of certain data for patients who suffer from behavioral health disorders, including alcohol and drug abuse, since pharmacists may fill medications for these patients and may be otherwise involved as part of the health care team. Furthermore, pharmacists may participate in electronic data exchange concerning such patients, for example, through electronic prescribing networks.

According to the National Alliance for Mental Health, mental illnesses are medical conditions that disrupt a person’s thinking, feeling, mood, ability to relate to others, and daily functioning.¹ Examples of behavioral health conditions include anxiety and depression, psychosis, bipolar disorder, post-traumatic stress disorder, panic attacks, and borderline personality disorder. In addition, patients may exhibit addictive behavior, including alcohol and substance dependency. Behavioral health conditions are usually treatable, and in many cases improvement in symptoms or recovery is possible. Treatment plans are individualized and offer a variety of modalities including medications.¹

Privacy of behavioral health and alcohol and substance abuse records is of utmost importance to avoid stigma and discrimination. Some patients with behavioral health problems are underinsured and do not have adequate coverage for their mental illness. Hence, patients are at risk for fragmented and uncoordinated care. The problem is exacerbated in complex patients who have two or more chronic conditions, such as a behavioral health condition in concert with a distinct chronic medical issue such as diabetes. These patients are at great risk for uncoordinated care of both conditions.

One of the great promises of health information technology (HIT) is the ability to provide critical health care data to all members of the team of clinicians, including pharmacists, who are caring for a complex patient with multiple comorbid conditions, including a behavioral health condition. In caring for these complex patients, there must be communication and data exchange between clinicians who provide services for the physical health of the patient, as well as the clinicians who treat the client’s behavioral health and substance abuse issues. The emerging national and state infrastructure to promote health information exchange can facilitate communication between clinicians, but must be implemented in a manner that protects patient privacy.

HIPAA Rule and More

The foundation for protecting the privacy of behavioral health data lies in the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules, as previously reviewed in one of the earlier columns in this series.² The HIPAA Privacy Rule provides strong legal protection for health care information, but allows sharing of data for health care operations and treatment. In addition to HIPAA, there are applicable federal laws and regulations that are stricter than HIPAA, the most stringent of which are the Substance Abuse Part 2 laws and regulations (42 U.S.C. § 290dd-2 and 42 CFR Part 2).³  

These laws were enacted after Congress recognized that the significant stigma associated with substance abuse, coupled with fear of prosecution, deterred patients from seeking treatment.³ In the absence of assured confidentiality, many patients with behavioral health disorders might actively avoid or refuse treatment. Any drug and alcohol treatment program that receives federal assistance in any form (even if not directly paying for the drug and alcohol services) is subject to the provisions of the Substance Abuse Part 2 regulations. Private organizations that receive no federal assistance of any kind are exempt (the patients at these facilities have either private insurance or pay for care themselves). Hence, the majority of alcohol and substance abuse treatment programs must adhere to the federal rules.³ Any clinician who uses his or her Drug Enforcement Administration registration to prescribe controlled substances for treatment or maintenance in cases of alcohol and substance abuse is also automatically subject to the Substance Abuse Part 2 regulations. The major differences between the HIPAA Privacy Rule and the Substance Abuse Part 2 regulations have been summarized in a document from the Substance Abuse and Mental Health Services Administration (SAMHSA).⁴

It has been challenging to understand how electronic health information exchange can be configured in practice to comply with these stringent federal substance abuse regulations, particularly because explicit patient consent is required for most disclosures, as well as redisclosures, of certain substance abuse data. In 2010, SAMHSA and the Office of the National Coordinator for Health Information Technology issued guidance on how this goal can be legally accomplished.³  

In order for any protected information pertaining to alcohol and substance abuse to be exchanged electronically through a Health Information Organization (HIO), there must be either a record of patient consent or a Qualified Service Organization agreement in place in order for a covered entity to provide the information to the HIO. Then there must be another record of patient consent in order for the HIO to redisclose the information to other HIO-affiliated members. There are only a limited number of exceptions to these rules, such as a medical emergency. In addition, a general consent to release medical information is not applicable. The consent must specifically comply with the substance abuse regulations. A consent instrument in an appropriate electronic format with a legal electronic signature can be utilized. Any electronic transmission of protected alcohol and substance abuse data must also be accompanied by an electronic notice stating that this information is protected. By law, this statement must read³:

This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient.

In addition to the federal laws and rules, there are various state laws that are, in many cases, more stringent than HIPAA. A 2009 report commissioned by the Agency for Healthcare Research and Quality reviews the common features and differences among these laws.⁵ In general, the state laws cover the areas of HIV, genetic information, alcohol and substance abuse, and mental health data. In some states the laws are very restrictive, and in other states more permissive. This intricate legal environment makes interoperable health care data exchange involving any of these data elements across state borders very complex, indeed. Efforts are under way to develop a road map to navigate through this array of state laws.  

One additional area requiring policy clarification is in the sharing of data with health plans and managed care organizations. There is a tension between payers and providers regarding what personal information should be shared for payment purposes for patients receiving mental health and substance abuse treatment. In some cases more stringent state laws will apply, and in other cases federal rules will set the minimum requirements. For example, it is clear that patient consent is required under the Part 2 rules for a payer to receive protected alcohol and substance abuse treatment data to support a disease management or care improvement program.³  

Mobile Devices and Privacy

In addition to considerations relating to legal and policy issues, the introduction of new technology offers both promise of improved care, and challenges to maintain patient privacy. For example, the introduction and widespread use of mobile devices affords patients the opportunity to transmit observations of daily living (ODLs) to health care practitioners. This category of patient-generated information can provide valuable insights into the status of a patient’s health. However, this technology also introduces many security and privacy risks.⁶ From a legal and policy perspective, HIPAA applies to health care practitioners, but it does not apply to patients. Hence, when patients generate their own data using applications on their mobile devices, the HIPAA security rule does not apply.  

In a study entitled Project HealthDesign, funded by the Robert Wood Johnson Foundation, patients received smartphones so that they could send ODLs to health care providers. The investigators attempted to define a security paradigm for data generated by patients on mobile devices and transmitted to health care practitioners.⁶ Major privacy and security threats related to mobile devices include loss, theft, unauthorized access, and cloning. Even though the HIPAA security rule does not apply to patient-generated data, it was used as a useful framework for analysis of the relevant risks.  

One major consideration was encryption of the data, specifically text messages.⁶ Some smartphones, such as BlackBerry, already provide encryption functionality. Other smartphones can accept third-party software for encryption of data. Without appropriate encryption algorithms in place, text messages can be intercepted by third parties and the contents revealed. Alternatives to use of encrypted text messages include the use of a secure Web portal. While passwords and automatic log-off functionality for the mobile device can add more layers of security, patients often view these as inconvenient and bypass these measures.⁶ Health care providers who encourage patients to transmit data from mobile devices should educate their patients about security measures and risk mitigation strategies, particularly if the patient opts not to implement the recommended security measures. The more sensitive the data (such as behavioral health data), the more important it is for the patient to consider implementing recommended security features on the mobile device.

Although originally designed for patient applications, these same security measures could be applied to mobile devices employed by clinicians—for example, e-prescribing applications on hand-held mobile devices. This would improve the security of data transmission between prescribers and pharmacists when mobile devices are employed, especially when sensitive behavioral health data, such as prescriptions for mental health pharmaceuticals, are being exchanged.

Conclusion

In addition to a knowledge of HIPAA rules, an understanding of state and federal laws concerning patient information about behavioral health and substance abuse can help pharmacists ensure privacy, help patients avoid the stigma associated with these conditions, and provide better coordination of care.

REFERENCES

1. National Alliance on Mental Illness. What is mental illness: mental illness facts. www.nami.org/template.cfm?section=about_mental_illness. Accessed November 7, 2012.
2. Figge H. HIPAA: privacy, security, and pharmacy information technology. US Pharm. 2011; 36(11):78-81.
3. U.S. Department of Health and Human Services. Legal Action Center for the Substance Abuse and Mental Health Services Administration. Frequently asked questions. Applying the substance abuse confidentiality regulations to health information exchange (HIE).1-17. www.samhsa.gov/HealthPrivacy/docs/EHR-FAQs.pdf. Accessed November 17, 2012.
4. U.S. Department of Health and Human Services.   Substance Abuse and Mental Health Services Administration. The confidentiality of alcohol and drug abuse patient records regulation and the HIPAA privacy rule: implications for alcohol and substance abuse programs. June 2004. www.samhsa.gov/HealthPrivacy/docs/SAMHSAPart2-HIPAAComparison2004.pdf. Accessed November 17, 2012.
5. RTI International; Agency for Healthcare Research and Quality; Office of the National Coordinator for Health IT; Health Policy Institute & O’Neill Institute for National and Global Health Law, Georgetown University. Privacy and security solutions for interoperable health information exchange. Report on state law requirements for patient permission to disclose health information. August, 2009. http://healthit.hhs.gov/portal/server.pt/document/910326/disclosurereport_pdf. Accessed November 17, 2012.
6. McGraw D, Pfister HR, Ingargiola SR, Belfort RD. Lessons from Project HealthDesign. Health Inf Manage. 2012; 26(3):24-29.

To comment on this article, contact rdavidson@uspharmacist.com.