HeinOnline is a subscription-based resource containing thousands of academic and legal journals from inception; complete coverage of government documents such as U.S. Statutes at Large, U.S. Code, Federal Register, Code of Federal Regulations, U.S. Reports, and much more. Documents are image-based, fully searchable PDFs with the authority of print combined with the accessibility of a user-friendly and powerful database. For more information, request a quote or trial for your organization below.
![handle is hein.crs/govych0001 and id is 1 raw text is:
Congresina Reeac Seric
December 10, 2018
Private Health Information and Prescription Drug Monitoring
Programs (PDMPs)
Prescription drug monitoring programs (PDMPs) maintain
statewide electronic databases of prescriptions dispensed
for controlled substances (i.e., prescription drugs of abuse
that are subject to stricter government regulation).
Information collected by PDMPs may be used to support
access to and legitimate medical use of controlled
substances; to identify or prevent drug abuse and diversion;
to facilitate the identification of prescription drug-addicted
individuals and enable intervention and treatment; to
outline drug use and abuse trends to inform public health
initiatives; or to educate individuals about prescription drug
use, abuse, and diversion, as well as about PDMPs. For
more information about PDMPs, see CRS Report R42593,
Prescription Drug Monitoring Programs.
PDMPs have elicited numerous concerns about patient
privacy, including issues around the scope and breadth of
authorized access-and specifically, by law enforcement
agencies-as well as the potential for unauthorized access
or breaches. While PDMPs are seen as a valuable source of
information in the effort to address improper prescribing of
controlled substances, concerns exist about the potential
deterrent effect on timely access to needed medication due
to fear that sensitive health information will be shared with
PDMPs, and may be subsequently legally disclosed or
illegally accessed through a breach.
PDMPs have varying requirements with respect to the
security and authorized use and disclosure of their stored
information. These are governed by state law. PDMPs
receive protected health information (PHI) from
pharmacists and other health care providers (HIPAA
[Health Insurance Portability and Accountability Act]
Privacy Rule-covered entities) who are subject to the
federal HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart
E). In addition, individually identifiable health information
that is generated pursuant to treatment at substance abuse
facilities is subject to stricter privacy requirements
established by the Part 2 rule (PHSA Section 543 [42
U.S.C. §290dd-2]; 45 C.F.R. Part 2).
The H PAA Pr vacy Rule and PDMPs
The HIPAA Privacy Rule governs covered entities' (health
care plans, providers, and clearinghouses) and their
business associates' use and disclosure of PHI. Protected
health information is defined as individually identifiable
health information created or received by a covered entity
that is transmitted by electronic media, maintained in
electronic media, or transmitted or maintained in any other
form or medium (45 C.F.R. § 160.103).
The rule describes multiple situations in which covered
entities may use or disclose PHI without authorization,
while all uses and disclosures of PHI that are not expressly
permitted under the rule require an individual's prior
written authorization. Generally, covered entities may share
PHI between and among themselves for the purposes of
treatment, payment, or health care operations, with few
restrictions (and specifically, without the individual's
authorization) (45 C.F.R. §164.506). Health care operations
include a number of activities as they relate to covered
functions; for example, conducting quality assessment or
improvement activities, reviewing the competence of health
care professionals, and business planning and development.
Express authorization is required for the use and disclosure
of psychotherapy notes and for marketing or sale purposes
(45 C.F.R. §164.508).
Certain other uses and disclosures (e.g., sharing PHI with
family members and friends) are permitted, but they require
the covered entity to give the individual the opportunity to
object or agree to the PHI's use or disclosure [45 C.F.R.
§164.510). In two cases, covered entities are required to
disclose PHI. They must disclose PHI to the individual who
is the subject of the information in certain circumstances
and they must disclose PHI to the Secretary of the
Department of Health and Human Services (HHS) for
purposes of determining compliance with the rule [45
C.F.R. §164.502(a)(2)).
Covered Entity Reporting of PHI to PDMPs Under
the Rule
The Privacy Rule also recognizes that PHI may be useful in
other circumstances aside from health care treatment and
payment for a given individual. For this reason, the rule
lists a number of national priority purposes for which
covered entities may disclose PHI without an individual's
authorization or opportunity to agree or object (45 C.F.R.
§164.512). PDMPs may receive PHI from covered entities
under authority of one or more of these exceptions.
Relevant exceptions identified in the rule may include
disclosures required by law-in this case, state PDMP laws,
disclosures to a public health authority for public health
activities, or disclosures to health oversight agencies for
oversight activities, among others.
Generally, the rule requires disclosures of PHI to be limited
to only the minimum amount necessary to meet the purpose
of the disclosure. With respect to disclosures to public
officials to meet the national priority purposes (e.g., for
public health activities), the covered entity may assume the
requested information is the minimum necessary if the
requesting official represents that it is (45 C.F.R.
§164.514).
https://crsreports.congress go
0](ViewImageLocal?handle=hein.crs/govych0001&div=1&collection=&method=preview&ext=.png&size=3)