skip to Main Content

Policymakers Seek to Balance Patient Information Sharing with Privacy Protections

  • This page as PDF


Coordinated information sharing can facilitate the delivery of integrated care to patients using both physical and behavioral health services.

Healthcare data is a key element in providing patients coordinated, personalized care. Yet sharing personal healthcare data, particularly related to substance use disorders (SUD), raises confidentiality concerns. Today’s healthcare landscape, marked by an escalating opioid crisis and calls for greater integration of mental and physical care, underscores the need to balance patient protections with appropriate access to SUD patient information. Achieving this balance could help better identify at-risk patients and more effectively manage care.

Multiple federal laws exist to protect SUD patient information, including 42 C.F.R. Part 2 (“Part 2”), which limits the permitted disclosure or use of information about individuals in federally assisted alcohol or drug abuse treatment programs. More broadly, the Health Insurance Portability and Accountability Act (HIPAA) addresses how to protect individually identifiable health information and sets minimum federal standards for patient confidentiality. While Part 2 has undergone multiple revisions since it was established in 1975, its requirements are still considered by some stakeholders to be a barrier to integrating addiction treatment and physical healthcare. Further, public comments to recent Part 2 revisions raise concerns over the lack of alignment between Part 2 and HIPAA.

One approach to navigating these challenges is through thoughtful design of health information exchanges (HIEs), an electronic system that gives providers access to patient information from various electronic health record systems within the state where the patient receives care. HIEs can improve the quality of care and reduce costs by, for example, reducing hospitalizations and duplicative tests.

Avalere evaluated Rhode Island’s HIE, CurrentCare, as a case study for overcoming some of these challenges. CurrentCare has integrated care through coordinated information sharing among diverse providers and treatment settings, while also facilitating compliance with state and federal laws. While Rhode Island Requires patients to opt-in to CurrentCare, its broad consent model enables patients to authorize consent to a wide network of providers within a community, while ensuring protection of SUD information as required under Part 2.

With healthcare information technology capabilities rapidly evolving and a growing imperative to address unmet SUD treatment needs, policymakers may consider elements of a model like CurrentCare to balance information sharing and confidentiality.

To see Avalere’s report click here.

To receive more expert insights on healthcare trends and issues, connect with us.

Funding for this research was provided by Otsuka. Avalere maintained full editorial control.

From beginning to end, our team synergy
produces measurable results. Let's work together.

Sign up to receive more insights about Federal Policy
Please enter your email address to be notified when new Federal Policy insights are published.

Back To Top