Interpretation and integration of the federal substance use privacy protection rule in integrated health systems: A qualitative analysis

Background: Federal regulations (42 CFR Part 2) provide special privacy protections for persons seeking treatment for substance use disorders. Primary care providers, hospitals, and health care organizations have struggled to balance best practices for medical care with adherence to 42 CFR Part 2, but little formal research has examined this issue. The aim of this study was to explore institutional variability in the interpretation and implementation of 42 CFR Part 2 regulations related to health systems data privacy practices, policies, and information technology architecture. Methods: This was a cross-sectional qualitative study using purposive sampling to conduct interviews with privacy/legal officers (n = 17) and information technology specialists (n = 10) from 15 integrated healthcare organizations affiliated with three research nodes of the National Institute on Drug Abuse (NIDA) National Drug Abuse Treatment Clinical Trials Network (CTN). Trained staff completed a short survey and digitally recorded semi-structured qualitative interview with each participant. Interviews were transcribed and coded within Atlas.ti. Framework analysis was used to identify and organize key themes across selected codes. Results: Participants voiced concern over balancing patient safety with 42 CFR Part 2 privacy protections. Although similar standards of protection regarding release of information outside of the health system was described, numerous workarounds were used to manage intra-institutional communication and care coordination. To align 42 CFR Part 2 restrictions with electronic health records, health systems used sensitive note designation, “break the glass” technology, limited role-based access for providers, and ad hoc solutions (e.g., provider messaging). Conclusions: In contemporary integrated care systems, substance-related EHR records (e.g., patient visit history, medication logs) are often accessible internally without specific consent for sharing despite the intent of 42 CFR Part 2. Recent amendments to 42 CFR Part 2 have not addressed information sharing needs within integrated care settings.