Safeguarding Confidentiality

The special security, privacy, and confidentiality needs of behavioral health information are issues of utmost importance for the EHR system to be usable by behavioral health care consumers and clinicians. The Federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) "governs access and sharing of standard health information but does not sufficiently protect behavioral health information," Ms. Wattenberg says.

That is because "the HIPAA privacy rules allow for the exchange of information among entities such as health plans, clearinghouses, and treatment providers without clients' consent," she explains. "There are also many other provisions in this ‘Privacy Rule' that allow for sharing information without consent."

The records of all individuals receiving substance abuse treatment through federally funded programs, however, are governed by additional regulations called the "Confidentiality of Alcohol and Drug Abuse Patient Records" (42 Code of Federal Regulations, part 2). These rules do not allow the exchange of information under most circumstances without the individual's consent.

In addition, many states have established legal protections for mental health information that exceed those in HIPAA. Under the provisions of HIPAA, the more stringent protections, which vary from state to state, are the ones that apply. To better serve behavioral health issues, therefore, SAMHSA is pursuing—through the Behavioral Health Treatment Standards Work Group and other activities—the development of an EHR system architecture that can flexibly accommodate Federal and variable state confidentiality rules.

Back to Top

Protecting Safety

The requirements of confidentiality must, however, be carefully balanced by considerations of safety. Suppose, for example, that an individual receiving behavioral health care also needs care for an entirely separate matter. The special rules of confidentiality regulate access to the EHR in that encounter as well. That means the individual could refuse to allow other practitioners to see the portion of the EHR referring to substance abuse treatment, for example. In other words, a person taking the medication Antabuse (disulfiram) for alcohol addiction could suffer dangerous respiratory distress if a podiatrist unwittingly treated a foot ailment with an alcohol-based injection.

The fully interoperable system foreseen by the President's Executive Order will have to contain built-in solutions to such conflicts. The system could, for example, inform the health care professional—without disclosing details—that a proposed treatment or substance is counter-indicated by an existing prescription. The individual would then have the choice to allow access to the record. In addition, the system would have a "break the glass" function so that emergency room personnel could immediately access critical records if the individual were unconscious or otherwise unable to give consent.

Only by taking such requirements fully into account could the system adequately serve individuals with behavioral health issues or chronic conditions (e.g., sexually transmitted diseases, epilepsy, cancer).

Back to Top

Building Awareness

Few knowledgeable observers doubt that electronic records will be part of the future of the Nation's health care system or that EHRs will have an enormous impact on everyone receiving, providing, paying for, or administering care.

In developing the complex standards and technologies that will bring that vision to reality, Ms. Wattenberg says, "the question is how do you structure this huge national health information system and electronic health records so that they can accommodate the need for consent when that's required? And, at the same time, we need to provide the safeguards vital for behavioral health." To make sure this is done properly and cost effectively, this consent functionality must be considered from the outset.

"SAMHSA is working hard to ensure that behavioral health is at the table," Ms. Wattenberg continues. "The big issue is that we need to help those developing the system to understand how behavioral health can be part of it, and how technology can serve that purpose without being unduly burdensome to providers, to payers, or to people creating the system."

For more information about electronic health records and health information technology, visit the HHS Web site at www.hhs.gov/healthit. For more information on HIPAA, visit SAMHSA's Web site at www.hipaa.samhsa.gov. 

Back to Top

« See Part 1: Electronic Records: Health Care in the 21st Century

See Also—Electronic Records: Health Care in the 21st Century

System Requirements »

Message from Dr. Broderick: Electronic Records:
Transforming Behavioral Health Care »

See Also—Next Article »

Back to Top