Being patient-centered means respecting patient confidentiality
The DSM-V hasn’t shown-up in bookstores yet, so hopefully I can still convince the APA to add one more diagnosis to the tome: CFR 42.2 GAD (Code of Federal Regulations Section 42, Part 2 Generalized Anxiety Disorder). This diagnosis is narrowly defined, but is apparently spreading virally among mental health professionals. It originates from the effort to adhere to state licensing laws and professional ethical standards while practicing in integrated settings. It is, of course, primarily triggered by those stringent regulations imposed by 42CFR Part 2 ("Part 2”)’ which regulate the confidentiality of alcohol and drug information. Unlike HIPAA, Part 2 provisions require stringent confidentiality protections even for information used only for healthcare or payment purposes.
- Loss of sleep for operations managers attempting to write policy (i.e. locking down access in EMR’s, obtaining appropriate informed consent);
- Anger among exasperated medical records staff ;
- Deflated self-esteem among clinicians;
- Misery loving company with equally obsessive colleagues;
- Recreational or therapeutic usage of wine among all involved;
- Frequent co-morbidity with Part 2 Avoidance Disorder.
In this spirit, I offer the perspective of one non-legal, neurotic worrier and BHI provider/administrator in an FQHC. My case will be that, while Part 2 is arduous to implement as written, it is doable. And further, at its heart, it is a worthy regulation that protects patients and holds healthcare systems accountable to a reasonable standard for confidentiality.
There is indeed plenty of information to weigh in this debate. If you missed CFHA’s annual meeting this year, you can still find some great information on confidentiality issues from CFHA website posts and catch the March special edition of Family, Systems and Health featuring ethical issues in integration. SAMSHA-HRSA’s Center for Integrative Health Solutions site includes resources on understanding 42CFR. The Legal Action Center has a useful compilation of information including books, webinars, power points and free downloadable forms for compliance.
Why is adherence challenging but possible -- even with Part 2? For one, most generalist BHPs like myself are not considered Part 2 "programs”, even though we may diagnose and treat substance use disorder (SUD) conditions. As such, we are not required to do all that covered providers ("programs” in Part 2 language) must do to protect SUD information. The sticky part comes when receiving SUD information from a Part 2 provider, such as an LADC or methadone clinic that receives federal funds. A health center must still protect these records via Part 2 standards.
What does this mean? Well, a number of factoids leading to temporary 42GAD. My colleagues and I must still obtain a Part 2 release even to submit a SUD diagnosis for billing if received from a Part 2 (i.e., specialized) "program”. Most problematic for integration, a LADC or other Part 2 "program” operating as part of a team within a health center cannot freely exchange protected information with others outside of their specialized alcohol and drug unit at the center, except in limited circumstances, without Part 2 protections.
As we do employ an LADC within our group, we present authorization forms for her patients at intake, using the unified HIPAA and Part 2 authorization template form available for download by the Legal Action Center at www.lac.org. Our protocol requires her patients’ consent for billing and for exchange of information with the team and agency. As for any records obtained by her or other "programs”, it is easy enough at least in my setting to secure her notes using our EMR’s locking capabilities. This allows our medical records staff to identify these and other protected "SUD” notes, which require the special authorization for re-release outside our agency.
Our new patient portal holds further promise for reducing the barriers to compliance, once workflows and mechanisms for communication with patients through this system are in place. With secure email for authorization requests and signatures, the process of consent could be quicker and more efficient. If you assume as I did that under-served patients are not likely to afford or use email or texts, consider that nearly 30% of the predominately Medicaid funded patient population in one sample primary care group used secure messaging for their health care needs.  Half of the author’s patients and even geriatric patients were on board.
Alternatively, a center may opt to establish a Qualified Service Authorization Agreement (QSOA) with outside parties that the center frequently uses, (or between the LADC and the health center) such as for referrals or billing. With these agreements in place, a patient’s authorization is not required for release of Part 2 information.
Our center also includes in its registration paperwork (which the patient is provided at the time of establishing care) signature lines for patients to indicate that they know that their BHP (if utilized) documents in one medical chart along with medical providers, and that their clinical information may be sent to referred providers for healthcare reasons, and that this includes, where applicable, alcohol and drug information. Our registration materials also include information about mandatory reporting. We feel this covers BHPs in the case of warm handoffs and unscheduled intakes. 
Practicing the serenity prayer so well known to Part 2 patients, I am well beyond wishing the law away. It is here to stay. In fact I see the need for the law’s strong protections, given the very real discrimination and stigma these patients must endure, such as in employment, custody battles and procurement of needed pain medications or procedures. I have seen providers omit diagnoses in the medical chart where protections don’t exist. This of course may lead to the same black hole that occurs when patients don’t disclose their SUD or seek treatment.
And, holes are costly. As we all know, lethal drug interactions occur, and inaccurate diagnoses or omitted information about SUDS lead to time and dollars wasted. Not surprisingly, hospital access to behavioral health records is associated with significantly lower readmission rates. 
Given compelling arguments for and against security protections, no wonder the angst. And if health care continues to evolve, we will have blessedly more information to safeguard. The prescription drug monitoring program just passed last summer in NH as in other states should no doubt increase SUD detection rates, as will the SBIRT program our center is rolling out next month. 
Contrary to popular opinion the law was not written to create 42GAD and thus drum up more business. Written into the code is its critical rationale--"so patients will not be made more vulnerable by reason of the availability of his or her patient record than an individual who has an alcohol or drug problem and who does not seek treatment”.  And, patient centered care is after all grounded in the belief that patients are fully informed and engaged in decision-making, after weighing information pertinent to care, including risks involved in treatment.  Why shouldn’t this include risks of having one’s information disseminated to third parties, when such release might impact on their care or reputation?
The solution is not to override patient choice for the sake of expediting treatment "for their own sake”. Nor should their choice be eradicated for the ease of providing care. Medical decisions are grounded on patient choice: Consent for disclosure of sensitive information is no different. Let’s work harder to make the choice more efficient and speedier, rather than the release. It is simply and only the patient who should decide where and how much their information gets disclosed. Given the chilling effect otherwise, it is well worth the technical fixes, extra paperwork and workflow headaches to enable this.
Being Type A and returning home from a one week vacation without internet, you can imagine my reaction to yet another New Hampshire power outage as I type this, and the prospect of hours, if not days of no home internet. Yet I will begrudgingly accept the speed limits along the way to the nearest Starbucks outlet and wi-fi to plug in my computer. After all, even ambulances slow down at dangerous junctures.
||I think Dr Rose may need therapy...|
The new DSM-V may not include Dr. Rose’s proposed CFR 42.2 GAD diagnosis but as we continue to navigate the pathways of sharing patient information across the integrated spectrum of care, I’m continually reminded that there is potential for a diagnosable "CFR 42.2 Delusional Disorder”. Subtypes include but are not limited to the following:
- Bizarre Delusions that involve common medical culture phenomena that are totally implausible such as a fully integrated health record
- Delusional Jealousy regarding the perception that Behavioral Health personnel do not have the same free flow of information sharing that medical provider’s do.
- Grandiose Delusions related to one member of the medical team having delusions of inflated worth, power, or higher status.
- Of Being Controlled Delusions where data entry in the EHR, face-to-face communications and other interaction are being monitored and controlled by a higher force.
My colleague and co-presenter deserves respect for her comprehensive investigation of this topic and subsequent informed opinions regarding confidentiality and consent. She however, may have gone a bit over the deep end this time. The core issue here regards assuring that we do the best thing for patient at all points of contact right? Right! And, if accurate and relevant information does not flow freely between agencies how can we, the providers of integrated care, the disciples of medicine self-chosen to transcend all the boundaries of traditional patient care—be it biological, psychological or social—ensure the best care for the patient has been accomplished? How can we know that medications are not being duplicated, misused, abused or prescribed in an unsafe manner? How can we ensure that patients are checking their A1C’s, are eating healthy foods and exercising three times a week or not overusing emergency services?
I try to imagine what a physician would do with an incomplete EKG reading or an MRI that only showed the upper left quadrant when the issue was in the lower right? Providers need the right information to make the right decisions and with humans being so complex it is safe to say the more information we have, the easier it would be to make a safe, calculated decision. It would be wonderful to believe in the conceptual comforts of patient controlled information sharing but I can’t help but wonder if patients really control their information? More importantly, if they had the opportunity, would they really want that level of responsibility? How could they know what is best for them regarding the complexity of most chronic illnesses? I guarantee that there is not a provider out there that has not experienced the increased hypochondriasis happening just from patients overindulging in a simple WebMD! How do patients know what information is relevant to their overall health? Providers are trained to care for patients and to do this they need full access to the patient’s biopsychosocial history.
One of Dr. Rose’s concepts I think we can all get behind regards the futility of wishing away the laws. In this case, the Serenity Prayer may not be as effective as Mother Necessity. We need to get creative. One key element Dr. Rose mentioned pertained to 42 CFR Part 2 and the exchange of information between "program” specialists and providers. Why in anyone’s right mind would they hire a specialist such as a LADC if it is going to inhibit the flow of information? What we are talking about here in the first place is short-term solution focused interventions. We do not need a specialist license for that.
Furthermore, why would we not adhere to the KISS [keep it so simple] model and just hire non-specialist BHS providers that could communicate between providers without all of these complicated policy and licensing barriers? Reimbursement models for licensed specialists are not that robust to begin with, never mind being unsustainable. We could simply continue Behavioral Health tax write-offs and hire less skilled BHS providers. Why do we need a highly skilled, highly specialized Ph.D level Psychologist to deliver generalized short term brief therapy? We could simply have our highly integrate-able, non-licensed, non-specialized BHS providers send a note to the medical provider explaining the rationale behind giving the patient the substance use or even mental health diagnosis and the medical provider could enter in the chart. Workaround complete!
One concept worth mentioning is the idea of Regional Health Information Exchanges [RHIE] and how they are designed to access and distribute patient information. RHIEs could be designed so patients have to opt-out of the privilege, not opt-in. Giving them the opt-in option will only increase their skepticism of the beneficence of their shared information. Various countries in Europe designate organ donation as opt-out. The results are that some countries have donation rates as high as 99% while other countries have opt-in policies resulting in organ donation rates as low as 14%. If what we are looking for is getting the information out there to share, we need to reduce the number of hurdles in the way as well as proactively create opportunistic policies to maximize the number of people in the system.
I honor Dr. Rose’s reverence and optimism towards confidentiality. She mentioned that a solution is not to "override the patient choice for the sake of expediting treatment for their own sake and to focus on working harder to make the choice of release of information more efficient and speedier for the patient”. This may be falling on deaf ears. We have been trying this approach for years and no one seems to listen! All the guilds want their control. The Substance Abuse people won’t meet with the Mental Health folks; the Mental Health folks won’t meet with the Primary Care folks; this proverbial sandbox is a mess and no one is playing well together. It appears that the folks in the sandbox don’t want true equality across the spectrum of care as much as they want to be the one with the best sandcastle.
Although the biopsychosocial model was officially postulated in the late 70’s, common sense has supported the integrative nature of healthcare way before we started officially silo-ing providers. Our grassroots movement that has been growing and expanding over the past two decades has hit a ceiling. Above us now sits the three-siloed thrones of care--medicine, psychology and substance abuse--none willing to heed advantage to the other. None willing to collaborate from the top down to meet the grass root efforts growing upward like vines.
The ultimate question is this: Do we really want a patient centered medical home where the patient has "real” control of the information? In the end, consumer choice typically leads to over-consumption, confusion and waste of resources. So regardless of what end of the spectrum your beliefs lie, ultimately, we need to focus patient care the triple aim—improving health, reducing costs and improving the patient experience. All of the above could be attained by paying more attention to access to, not permission for, complete patient information.
||Sandy Rose is a psychologist and Director of Behavioral Health for Goodwin Community Health, an FQHC in the Seacoast area of NH. She is past president of the New Hampshire Psychological Association and served two terms on the Council of Representatives of the American Psychological Association. She is currently a Psychology Advisory Member of the New Hampshire Board of Mental Health Practice.|
||Peter Fifield is an integrated Behavioral Health Consultant at Families First Health and Support Center; an FQHC in Portsmouth NH. He presented with Sandy Rose on this topic at the 2012 CFHA conference and they are co-authoring an article in the upcoming special iethics issue of Families, Systems, and Health. |
 The Federal Law for Confidentiality of Alcohol and Drug Abuse Records.
 Steve Arnault, Cathy Hudgins, and Peter Fifield—see our upcoming article on ethical issues in the Family, Systems and Health special addition on ethics due March, 2013.
 See Legal Action Center’s Confidentiality and Communication, A Guide to the Federal Drug and Alcohol Confidentiality Law and HIPAA (2012) for internal program communications, pp. 72-73.
 Franklin, R, (2013, Jan/Feb). Secure Messaging, Myths, Facts and Pitfalls. Family Practice Management Magazine.
 Apparently (and hopefully) peculiar to NH, we have prescribed language for informed consent under our licensing law and so we are bound to provide informed consent documents specific to MH at time of scheduled intakes.
 SAMSHA’s interpretation of Part 2 excludes SBIRT information as requiring Part 2 protections if arising outside of a "program”—See FAQs-revised, Q10.