Healthcare Information Security

Cloud News

Senate Bill Has Version of Jessie’s Law, Not Aligned with HIPAA Privacy Rule

A Senate panel this week passed the Opioid Crisis Response Act of 2018 with a version of Jessie’s Law that allows for the display of opioid abuse information on a patient’s medical records, but does not align 42 CFR Part 2 rules with the HIPAA Privacy Rule.

capitol hill

Source: Thinkstock

By Fred Donovan

- The Senate Health, Education, Labor and Pensions Committee this week passed the Opioid Crisis Response Act of 2018 (S 2680) with a broad range of measures to combat the opioid epidemic, including a version of Jessie’s Law that allows for the display of opioid abuse information on a patient’s medical records, but does not align 42 CFR Part 2 rules with the HIPAA Privacy Rule.*

*Editor's note: An earlier version of this article incorrectly reported that the Senate bill included a version of Jessie's Law that would align 42 CFR Part 2 with the HIPAA Privacy Rule.

The provision, known as Jessie’s Law (S 581), would help healthcare providers get information about a patient’s history of opioid abuse to improve healthcare treatment for and prevent the prescribing of opioids to addicts.

The bill would require the Department of Health and Human Services to develop best practices for prominently displaying this information in electronic health records, when requested by the patient.

In addition, the bill calls for identifying model training programs on how to appropriately disclose confidential medical records on substance use disorders (SUDs) for healthcare providers, patients, and their families.

READ MORE: Considering HIPAA Privacy Rule with Mental Health Data

However, the opioid crisis bill would not amend 42 CFR Part 2, which is intended to protect the confidentiality of people who seek treatment for drug or alcohol abuse. 42 CFR Part 2 restricts the disclosure of patient records concerning addiction treatment by any federally assisted alcohol and drug abuse program without the express written consent of the patient. Since most programs receive federal assistance or use a federally controlled substance for detoxification and treatment, the rule has widespread application.

While the rule is designed to protect the privacy of people who seek SUD treatment, some healthcare organizations are advocating amending it, arguing that the strict confidentiality requirements have a negative impact on the healthcare of addicts.  

Several healthcare associations lobbied the Senate panel to include another version of Jessie’s Law (S 1850) in the comprehensive opioid treatment bill. That version would amend 42 CFR 2 to bring it in line with the HIPAA Privacy Rule.

The Association for Behavioral Health and Wellness (ABHW) sent a letter April 11 to the committee leaders arguing that the restrictions on substance abuse clinics and health plans from sharing information with other healthcare providers without patient written consent is a major barrier to fighting opioid abuse.

“Obtaining multiple consents from the patient is challenging and obstructs whole-person, integrated approaches to care, which are part of our current health care framework. Part 2 regulations may lead to a doctor treating a patient and writing prescriptions for opioid pain medication for that individual without knowing the person has an opioid use disorder,” argued ABHW President and CEO Pamela Greenberg.

READ MORE: How Do HIPAA Rules, Patient Privacy Apply in Emergencies?

“Without written consent from the patient, ABHW member companies have had cases where the health plan cannot speak to the patient’s primary care provider and other specialists about the patient’s SUD, even if that provider is prescribing opioids to the patient,” she added.

“Harmonization of Part 2 with HIPAA would also increase care coordination and integration among treating providers and other entities in communities across the nation.”

This is a view shared by the American Hospital Association (AHA), which has been lobbying both houses of Congress to amend 42 CFR Part 2.

AHA has joined with more than 40 other healthcare stakeholders to form the Partnership to Amend 42 CFR Part 2 to align the regulation with HIPAA, which allows the sharing of medical records without patient authorization for healthcare treatment, payment, and operations.

The partnership sent a letter April 23 to the Senate committee leaders urging incorporation of Jessie’s Law (S 1850) into the opioid crisis bill.

READ MORE: Do HIPAA Regulations Need Updates on Patient Privacy?

“Without the changes envisioned by S. 1850 treating providers may not see the entire medical record of an individual with an addiction. This means that the individual may be prescribed an opioid to treat their pain without the provider knowing that the individual has a history of addiction; the end result could be relapse or worse yet, death,” the letter argued.

“HIPAA applies to every single illness, including other stigmatized diseases like mental health, HIV/AIDS, and SUD. However, because HIPAA sets the ‘floor’ or minimum protections for health information, the overly-stringent restrictions imposed under Part 2 supersede HIPAA and prevent alignment with all other health care conditions,” it added.

The group stressed that S 1850 would leave restrictions in place for sharing SUD medical records, with an employer, law enforcement, or a landlord.

S 2680 with the less strict version of Jessie’s Law now goes to the Senate floor for a vote of the full Senate. The House Energy and Commerce Committee is working on a similar opioid crisis bill; Committee Chairman Greg Walden (R-Ore.) wants to move the bill to the House floor before Memorial Day. The House is considering a companion bill to S 1850, HR 3545, but the House Health Subcommittee did not include that bill in its opioid crisis bill approved April 25.


SIGN UP and gain free access to articles, white papers, webcasts and exclusive interviews on

HIPAA Compliance
Data Breaches

Our privacy policy

no, thanks

Continue to site...