Recommendations to Inform Substance Use Disorder Data Sharing Research: Scoping Review and Thematic Analysis

Abstract

Objectives.

Title 42 Code of Federal Regulations Part 2 (42 CFR Part 2 or Part 2) was enacted in 1975 to protect patients receiving treatment for substance use disorders. A scoping review on Part 2 characterized published work.

Methods.

Seven databases were searched. Studies were categorized based on date of publication, primary objectives, methods, and findings. A thematic analysis was conducted using article titles and abstracts.

Results.

Of the 36 studies identified, the majority (78%) were opinions or legal reviews, (22%) employed quantitative and/or qualitative methods to study the impact of Part 2, and over half (58%) were published in the past 5 years. Only 8% of studies reported stakeholder involvement in Part 2 studies and no study included patients or patient advocates. No study discussed the efforts to align Part 2 with HIPAA or provided evidence of the benefit of this alignment. Three main themes emerged from the review: care delivery (46.6%), law and ethics (27.6%) and technology (25.9%). There were no studies focusing on stigma and its effect on substance use treatment and Part 2.

Conclusions.

Despite the significance of Part 2, the literature is sparse. It is time to initiate a new era of scholarly research that focuses on the impact of statutes and policies that govern substance use disorder data sharing. Specifically, we recommend research on Part 2 and HIPAA alignment, the effects of Part 2 on patients, as well as providers and other stakeholder perceptions on the regulation.

BACKGROUND AND SIGNIFICANCE

With the rise of substance use in the 1960s, the U.S. government used law enforcement measures to suppress substance use disorder (SUD).¹ At the same time, the discrimination and stigma of SUD was being compounded by the fear of prosecution, deterring people from entering the SUD treatment programs. To remedy those social ills and move toward the medicalization of SUD, the federal government enacted the Comprehensive Alcohol Use and Alcoholism Prevention, Treatment and Rehabilitation Act of 1970 ², establishing the National Institute on Alcohol Abuse and Alcoholism within the National Institute of Mental Health, and set its mission as developing national programs and policies aimed at the prevention, control, and treatment of alcohol use and alcoholism. The Act contained general rules establishing the confidentiality of records of patients receiving alcohol use and alcoholism treatment. Soon thereafter, similar programs with identical rules protecting confidentiality were established for SUD treatment and rehabilitation through the Substance Use Office and Treatment Act of 1972, aimed at supporting SUD treatment and rehabilitation programs.³

Title 42 of the Code of Federal Regulations Part 2, “Confidentiality of Alcohol and Drug Abuse Patient Records,” or simply 42 CFR Part 2, or more simply, Part 2, was enacted in 1975 pursuant to the authority of 42 U.S.C. § 290dd-2.⁴ These regulations “…ensure that a patient receiving treatment for SUD… is not made more vulnerable [because they seek treatment] than an individual with a SUD who does not seek treatment.” The regulations specify that patient consent must be obtained before records disclosing participation in a federally assisted Part 2 SUD treatment program can be shared.

When Part 2 was enacted in 1975, most SUD treatment was delivered via standalone addiction treatment settings where the required consents for Part 2 information sharing were easily managed. Part 2 was first amended in 1987, with subsequent revisions in 2017, 2018 and 2020, matching an increased recognition of SUD as a diagnosis and the need for treatment integration into general medical practice to expand access to and acceptability of treatment options.

The 2017 revisions updated and modernized the confidentiality regulations while facilitating information exchange within new health care models and working to reduce unnecessary burden.⁵ SAMHSA [Substance Abuse and Mental Health Services Administration] wanted to ensure that patients with SUDs have the ability to participate in, and benefit from health system delivery improvements, including from new integrated health care models while providing appropriate privacy safeguards.

The 2018 revisions sought to better align the regulations with advances in health care delivery while retaining important privacy protections for individuals seeking treatment for SUDs.⁶ These pertained to use and disclosure of patient identifying information for purposes of payment, health care operations, audits and evaluations.

The 2020 revisions further aligned the regulations with the environment, making the regulations more understandable for patients and providers, and less burdensome.⁷ These changes included exempting records created by non-Part-2 providers based on their own encounters with patients; relaxing patient consent requirements to allow disclosure to organizations (rather than requiring specified individuals); clarifying what activities are covered by the terms payment and health care operations, audits and program evaluation; permitting disclosures to and queries of state prescription drug monitoring programs; clarifying the definition of bona fide medical emergency and streamlining disclosure for research purposes.

Integrating SUD services into general practice is feasible, and could increase access to SUD treatment. However, studies have also shown that Part 2 is a source of legal confusion, complicating communication and information sharing in integrated care environments.^8,9 Wu et al. study reported that Part 2 may cause healthcare facilities to store behavioral health data separately from the other EHR data, thereby contributing to data incompleteness.¹⁰ The same study pointed out that SUD data incompleteness might be because SUD treatment services have often been provided in separate specialty addiction treatment programs or contracted out and managed separately from a larger healthcare plan. Integrated health plans report using workarounds to manage intra-institution communications and care coordination while exhibiting varied interpretations of Part 2.⁸

There have also been proposals to align Part 2 with the 1996 Health Insurance Portability and Accountability Act (HIPAA) privacy rules, specifically to allow SUD data sharing without explicit consent.^11,12 This proposed HIPAA harmonization met intense public debate. Patient were concerned that alignment of Part 2 with HIPAA privacy protections could increase patient vulnerability, while opposing organizations argued that such an alignment could improve integration and coordination of care, improve safety and reduce stigma towards SUD.¹³ More recently, the 2020 Coronavirus Aid, Relief, and Economic Security (CARES) Act was passed to combat the COVID-19 public health crisis, including a provision to better align Part 2 and HIPAA regulations.¹⁴ These changes are not limited to the duration of the COVID-19 national emergency.

The objective of this study is to conduct a scoping review on Part 2 to characterize published work, discover emergent themes, and identify knowledge gaps to guide future research.

MATERIALS AND METHODS

A systematic search identified relevant articles. This was followed by thematic analysis to help categorize emergent themes related to Part 2.

Design

Using an iterative team approach, we conducted a scoping review following the PRISMA-ScR (Preferred Reporting Items for Systematic Review and Meta-Analyses extension for Scoping Review) guidelines. The review team, consisting of four members, regularly met to discuss progress, reach consensus on next steps, and to ensure clarity of purpose and balance between breadth and comprehensiveness of review.

Systematic search

We worked in collaboration with domain experts and a librarian to identify relevant data bases and search keywords. We selected the databases Academic Search Premier, Elsevier/ScienceDirect, Google Scholar, HeinOnline, PsycInfo, PubMed and Scopus to find relevant articles. We could not find Medical Subject Heading (MeSH) terms for Part 2, therefore we created a list of keywords referring to Part 2: “42 CFR Part 2” OR “42 C.F.R. Part 2” OR “Part 2 of volume 42” OR “Title 42 of the Code of federal regulations” OR “Confidentiality of Substance Use Disorder Patient Records” OR “Confidentiality of Alcohol and Drug Abuse Patient Records” OR “42 C.F.R. § 2”. We also reviewed the reference lists of studies that met our inclusion criteria to find additional articles. The resulting articles were aggregated, tracked in a shared Excel file and full texts were obtained. Duplicate articles were tracked and removed.

Selection criteria

A historical context was used to develop and frame the inclusion criteria: published in the U.S., English language, during Part 2 activity (1975 to July 1, 2020) and peer-reviewed journals only. Peer-reviewed journals are reviewed by editors and experts in the field to evaluate quality, validity, and rigor of work prior to publication. For legal journals, authors sought counsel from legal experts to ensure a reproducible inclusion process. The search strategies were drafted and further refined through team discussion (Supplementary Material).

Methods of applying selection criteria

The resulting articles were divided among four reviewers who dependently read the title and abstract of the articles for relevance and to determine inclusion based on criteria. When the four reviewers did not agree, the articles were read in entirety and a unanimous decision to include or exclude was reached. Backward and forward snowballing, using articles’ references and citations from the systematic literature search, was undertaken for all included articles to ensure all possible relevant articles could be reviewed. A data-charting form was jointly developed by the four reviewers to determine which variables to extract. Full articles were checked by each researcher and independently charted in terms of objective(s), methodology, and outcome(s). Through the four iterations of the review process, researchers discussed the papers to ensure unanimous agreement and updated the data-charting form. Articles were stratified by design and by year of publication.

Data analysis

All retained articles were summarized by title, authors, year of publication, objectives, primary methods, stakeholder engagement and primary findings. Our systematic literature search identified relevant articles followed by a thematic analysis to identify emergent themes. For the thematic analysis, the unit of analysis was the article title and abstract. Ten articles were chosen randomly to develop the initial codebook through inductive coding, focusing on frequency of topics and concepts discussed. In vivo coding was used prior to simplifying codebook names through following iterations. Thematic analysis was done through seven iterations of coding, cleaning, and honing the codebook definitions and codes among three researchers. Thematic analysis results were further categorized into hierarchies depending on how themes were related to each other within articles. Results reflected themes across all articles and allowed for equality in the analysis. Complex coding query was used to search for co-occurring themes as well as themes by year of publication and provide visualization of interrelationships of themes.

RESULTS

Scoping Review

Of the 341 results from the systematic literature search, 36 met all inclusion criteria (Figure 1). Of those excluded, 34 duplicates resulted from the seven databases. For instance, of the nine articles we retrieved from PsycInfo, seven were also in PubMed. Moreover, 164 articles, 48 of which were relevant to Part 2, were removed from our final analysis because they were not published in a peer-reviewed journal.

Figure 1:

Summary of the Part 2 Scoping Review.

Details of the included studies are displayed in chronological order (Table 1).

Table 1.

Summary of the primary objectives, methodology(s), and findings from the studies included in this review

Author(s) & Year	Title	Primary objective(s) and/or significance	Primary approaches(s)	Primary Finding(s)
Helms D.15 (1975)	A guide to the new federal rules governing the confidentiality of alcohol and drug abuse patient records	Explains the function of Part 2, why it was constructed, and its theoretical framework.	Examines Part 2 rule covering structure and basic content.	Part 2 enforces patient’s privacy
Goldstein M.16 (1979)	Confidentiality conflicts: Is discretion the better part of valor?	Discusses Part 2 based on effects on criminal justice and drug & alcohol treatment systems. Defines the relationship between the two institutions.	Examines different laws and regulations that affect the relationship between criminal justice and treatment of SUD patients.	Part 2 is ambiguous in providing instructions to the judiciary about determining the appropriateness of law enforcement intervention.
Lanman R.17 (1980)	The federal confidentiality protections for alcohol and drug abuse patient records: A model for mental health and other medical records?	Analyzes significant characteristics of alcohol and drug abuse confidentiality statues and how they can be used as a blueprint for mental health privacy laws.	Examines similarities and differences of patients with SUD and mental illness with overview of Part 2.	While Part 2 may be useful as a blueprint, there are unique issues that patients seeking SUD treatment may face.
Blume S.18 (1981)	Changing the federal regulations on confidentiality of alcohol and drug abuse patient records: Views of clinical staff	Focuses on understanding clinical staff opinion on Part 2 and assesses participants’ understanding of changes in Part 2.	Surveys 14 providers in state-operated treatment centers in New York.	Providers report positive impact of Part 2. They feel they understand present rules and can discuss potential changes appropriately.
Winslade W.19 (1982)	Confidentiality of Medical Record: An Overview of Concepts and Legal Policies	Provides the overview and trends of federal and state regulation of the confidentiality of medical records.	In-depth examination of federal and state regulations of confidentiality of patient medical records.	Though Part 2 provides maximum confidentiality to patients, it focuses only on confidentiality rather than privacy. The scope of privacy intrusion necessary for health care is left to the discretion of health care providers.
Pascal C. 20 (1987)	Selected Issues About AIDS for Drug Abuse Treatment Programs	Sensitizes SUD program personnel to the legal issues surrounding Acquired Immune Deficiency Syndrome (AIDS) with special emphasis on confidentiality and disclosures of patient information.	Discusses local, state, and federal confidentiality laws and interaction among them. Discusses how these laws affect SUD programs and patients with AIDS.	It is essential SUD-program personnel learn the relevant laws in their localities to recognize relevant legal issues affecting them and to know when to seek advice of legal counsel.
Bromley et al.21 (1989)	Complying with mandated child protective reporting: A challenge for treatment professionals	Discusses recommendation on how to achieve a balance between Part 2 and child protection.	Explores case examples with case discussion based on laws to walk through the given recommendation.	Provides potential steps providers may take to balance Part 2 and child protection.
Manhal-Baugus M.22 (1996)	Confidentiality: The legal and ethical issues for chemical dependency counselors	Reviews federal regulations, ethical guidelines, and the legal and ethical exceptions of confidentiality for chemical dependency counselors.	Reviews confidentiality definitions, Part 2, its exceptions, and ethical considerations that a SUD treatment specialist might encounter.	With current changes in Part 2, SUD specialists are recommended to keep track of the laws and regulations and should seek advice from supervisors.
Doyle K.23 (1998)	Confidentiality revisited: A response to Manhal-Baugus (1996)	Reviews issues relating to confidentiality discussed in Manhal-Baugus’ paper.	Discusses five legally permitted exceptions that the original paper did not cover.	Exceptions are such as qualified service organizations, and nonpatient identifying information.
McGovern T.24 (1998)	Vulnerability: Reflection on its ethical implications for the protection of participants in SAMHSA programs	Discusses ethical implications for protection of participants in SAMHSA program.	Reviews ethical issues relating to vulnerable populations and develops a framework to address those issues.	Vulnerable participants are protected by strategies such as individual & community stigmatization and target population involvement in program planning.
Schleuderer et al.25 (2004)	Assessing substance abuse questions in child custody evaluations	Provides recommendations on how to integrate and assess substance use with child custody evaluation	Develops strategy for evaluators to use when conducting child custody evaluation	To protect client and evaluator, evaluator should follow federal guidelines when obtaining client’s informed consent for any evaluation that may contain a SUD component.
Miller et al.26 (2006)	Addressing substance abuse in health care settings	Provides summary of roundtable proceedings of research society on alcoholism.	Summarizes a roundtable discussion involving seven different speakers/presenters.	Effective screening strategies for alcohol, different intervention models, review of pharmacotherapy in healthcare sitting, and many others are reported.
Coffey et al.27 (2008)	Transforming mental health and substance abuse data systems in the United States	Describes current federal and state initiatives for improving data interoperability in substance abuse data systems.	Conducts qualitative analysis of different aspects of data sharing to form a coherent set of recommendations.	Data interoperability is key for comprehensive health care in the US.
Walley et al.28 (2009)	Are opioid dependence and methadone maintenance treatment (MMT) documented in the medical record? A patient safety issue	Explores the risk of opioid dependence and MMT patients having missing medical information that may lead to drug-drug interactions.	Examines 84 patients’ EHR to evaluate the frequency of opioid dependence and MMT missing documentation.	The proportions of medical records without opioid dependence and methadone documentation are estimated and potential medication-methadone interactions are identified.
Weisner et al.29 (2009)	Trends in prescribed opioid therapy for non-cancer pain for individuals with prior substance use disorders	Examines the trends and characteristics of long-term opioid use in persons with non-cancer pain and a substance abuse history.	Pulls health plan data and compares rate of incidence.	There is a need for more careful screening of SUD history in the process.
Tai et al.30 (2012)	Integrating information on substance use disorders into electronic health record systems	Discusses the clinical rationale for National Institute on Drug Abuse (NIDA) developing a common set of core questions to screen, diagnose, and initiate treatment for SUD	Describes the efforts of the NIDA thus far to develop consensus standards for patient information collection and protection in EHRS.	Provides steps to appropriately move SUD information into EHRS and how implementation of standard would reduce stigma, increase engagement in treatments.
Manuel et al.31 (2013)	Confidentiality protections versus collaborative care in the treatment of substance use disorders	Explores the special protections for substance abuse documentation, discrepancies in treatment documentation, ways to deal with these issues in clinical practice.	Reviews Part 2 regarding proposed changes, the ambiguity of the regulation regarding enforcement and application due to EHRs/integration, and how to move forward.	Staff in SUD treatment programs are recommended to: 1) know why confidentiality laws exist, 2) consider state law, 3) ask for help from experts, 4) update guidelines to reflect changes in the laws, and 5) get feedback from stakeholders involved.
Goldstein M.32 (2014)	Health information privacy and health information technology in the us correctional setting	Describes the legal environment surrounding health information sharing in correctional settings by focusing on HIPAA and Part 2.	Reviews Part 2 and HIPAA and outlines some of the challenges encountered in the correctional settings when dealing with these laws.	With disparities in state and federal regulations, data segmentation may be employed to protect inmate health record privacy.
Hecker et al.33 (2014)	The impact of HIPAA and HITECH: New standards for confidentiality, security, and documentation for marriage and family therapists (MFTs)	Discusses HIPAA and security rules and how they apply to marriage and family therapy.	Reviews HIPAA and discusses relevant questions such as who a covered entity is, what are the client’s specific rights, when to use and disclose client’s protective health information and HIPAA definitions of those key terms.	Summarizes the legal safeguards in various cases. It points out the penalties involved in HIPAA violation. It emphasizes how MFTs should focus more on the regulation laws.
Trestman et al.34 (2014)	Justice-involved health information: Policy and practice advances in Connecticut	Discusses coordination of care, inmate privacy, and the correctional system in Connecticut.	Describes the use of Connecticut Health Information Network and staff interviews to amend process for coordination of care while providing inmate privacy.	Collaborative environments are necessary for overcoming federal, state, and correctional facilities' barriers to patient confidentiality and coordination of care.
Rough et al.35 (2016)	Suppression of substance abuse claims in Medicaid data and rates of diagnoses for non–substance abuse conditions	Examines the association between implementation of CMS suppression of substance abuse claims policy in Medicaid data and rates of diagnoses for non-substance abuse conditions.	Pulls data from Medicaid for before and after CMS suppression policy was implemented and designs linear regression models to compare the changes in level and tend after implementation of the policy.	Suppression of substance abuse claims in Medicaid data and rates of diagnoses for non-substance abuse conditions were correlated.
Schaper et al.36 (2016)	Substance use disorder patient privacy and comprehensive care in integrated health care settings	Examines Part 2 regulations and the effect they have on clinical practice and how to effectively adhere to Part 2 with minimal effect on comprehensive integrated care.	Reviews Part 2 and discusses best way to responsibly share SUD information in integrated care without violating the laws.	Seeking individuals with SUD consent and setting up QSO or BA agreement are some strategies to share Part 2 without violating the laws.
BrintzenhofeSzoc et al.37 (2017)	Social workers have an obligation to all patients regarding confidentiality … however, for some patients, the obligation is greater	Discusses how Part 2 works with other laws, where there may be conflicts, and ways to handle these conflicts.	Reviews Part 2, provides a brief history and overview of the laws, and offers examples of how Part 2 works with other laws.	Social workers need to know current laws and how they impact them and patients, but also focus on continuing education on these laws as they are amended.
McCarty et al.9 (2017)	The perceived impact of 42 CFR part 2 on coordination and integration of care: A qualitative analysis	Analyzes providers’ views on 42 CFR Part regarding care coordination and integration.	Conducts stakeholder interviews on questionnaire pertaining to the pros and cons associated with Part 2 in care coordination and integration.	Findings include that 1) limited legal knowledge on Part 2 creates confusion, 2) Part 2 is viewed as a barrier to communication, data sharing, and overall integration of care, etc.
Strickler E.38 (2017)	Federal government finalizes changes to 42 CFR Part 2 (Confidentiality of Substance Use Disorder Records)	Provides updates on key changes to Part 2.	Reviews the 2017 and 2018 final rules of Part 2 and discusses key changes.	Key changes include 1) definition of “lawful holder,” 2) use of general designation in consent form, 3) application to both electronic and paper records, and 4) changes in audit and evaluation procedures.
Barnett et al.39 (2018)	Implementation challenges of the final rule of Title 42 of the Code of Federal Regulations part 2: Can privacy endure in an era of electronic health information exchange?	Describes implementation challenges of the final rule of Part 2 and provides examples of those challenges.	Reviews Part 2 and highlights implementation challenges.	Technological safeguards must be ensured to protect patient privacy from electronic health information exchange (HIE) and individual internet user profiles.
Beidler A.40 (2018)	Operationalizing the changes to 42 CFR Part 2, alcohol and drug abuse patient records	Explains changes made in Part 2 in 2017 and 2018 final rules for stakeholders to operationalize these changes.	Reviews the 2017 and 2018 final rules of Part 2 and discusses key changes.	Some key changes made in Part 2 include 1) definition of “lawful holder,” 2) use of general designation in consent form, 3) application to both electronic and paper records, and 4) changes in audit and evaluation procedures.
Busch et al.41 (2018)	Improving electronic health record adoption in psychiatric care: A cornerstone for healthcare transformation	Provides recommendations to improve eHealthcare Records adoption in psychiatric care.	Reviews psychiatric care unit and explains how the Meaningful Use (MU) financial incentives excluded psychiatric hospitals.	Recommends congress to: 1) implement additional efforts on developing EHR capability, 2) enact an incentive program to facilitate EHR adoption in psychiatric care, and 3) design a timeline for progress
Rosenbloom D.42 (2018)	Commentary on “Gaps in the Substance Use Disorder Treatment Referral Process: Provider Perceptions”	Provides a summary of the findings from Blevins et al.’s article, arguing recommendations provided in that article are less likely to happen.	Discusses a list of barriers, including Part 2, not easily addressed by a new technology or software as recommended in Blevins et al.’ article.	While Blevins et al. provided a vivid description of the dysfunction in referrals for SUD treatment, none of their recommendations are likely to happen anytime soon or at scale.
Sweeney M.43 (2018)	Cutting the yellow tape with 42 C.F.R. Part 2: A health care—based approach to combating gun violence	Provides perspectives on how to amend Part 2 to handle gun violence and its relation to SUD.	Conducts court ruling and literature review on gun regulations, HIPAA, and Part 2.	Recommendations on how courts are approaching gun violence in relation to SUD and alcohol use are proposed.
Virani et al.44 (2018)	Decoding New York state’s prescription monitoring program	Discusses New York’s i-STOP (Internet System Tracking Over-Prescribing) and how it works with HIPAA and Part 2 regulations.	Provides context of i-STOP and explains the relevant of this system.	It is unclear where literature review is done and how case scenarios are determined.
Campbell et al.8 (2019)	Interpretation and integration of the federal substance use privacy protection rule in integrated health systems: A qualitative analysis	Explores institutional variability in the interpretation and implementation of Part 2 regulations.	Conducts a cross-sectional qualitative study using purposive sampling with 15 integrated healthcare organizations. Participants completed a demographic survey followed by a semi-structured interview.	There is great variability in institutional interpretation and implementation of Part 2.
Ennever et al.45 (2019)	Developing language to communicate privacy and confidentiality protections to potential clinical trial subjects: Meshing requirements under six applicable regulations, laws, guidelines and funding policies	Discusses six pertinent laws/regulations and explores way to incorporate them in an integrated manner to address some of the tensions among them.	Develops a consent form template as one example of language that incorporates all six pertinent laws/regulations to address tensions among the various laws/regulations to communicate to participants in a clinical trial research.	IRB executive committee approved the developed form, covering all laws/regulations, for clinical trial use.
Knopf A.46 (2020)	Confidentiality of substance use disorder treatment records: Update	Provides updates on how CARES Act may affect Part 2.	Reviews the Coronavirus Aid, Relief, and Economic Security (CARES) Act and explore Legal Action Center (LAC) recommendations regarding the Act.	LAC encourages stakeholders to fully participate in the regulatory process relating to change-making.
Shields et al.47 (2020)	Electronic health information exchange at discharge from inpatient psychiatric care in acute care hospitals	Measures the use of electronic HIE at acute care hospital inpatient psychiatric units at the time of transition to a subsequent level of care and examines the characteristics of the psychiatric units associated with that use.	Conducts statistical analysis of data pulled from national programs regarding use of electronic HIE upon transfer of patients from inpatient psychiatric units of acute care hospitals.	There is no evidence that a state having mental health privacy laws more stringent than HIPAA is associated with differences in electronic HIE from inpatient psychiatric units.
Wu et al.10 (2020)	Using a health information technology survey to explore the availability of addiction treatment data in the electronic health records: A national drug abuse treatment clinical trials network study	Establishes the importance of complete and structured data to be used by EHRs and Health IT to make the most of pragmatic clinical trials and other observational studies.	Conducts health IT survey within the National Drug Abuse clinical trial network to explore information related to data completeness and presence of unstructured data (e.g., clinical notes, free text) for conducting EHR-based research for SUDs.	Heterogeneity in the existing EHRS, use of both paper records and EHRs of separate EHR for behavioral healthcare hinders the ability to obtain complete and structured data across disparate healthcare systems.

The earliest study we identified was a guide to Part 2, published in 1975.¹⁵ From 1979 to 2013, Part 2 was the focus of only one or two articles published each year. Since 2014, more articles were published on this topic every year.

A change was noticed in the preferred reference to the legislation. Older publications named the policy as “Confidentiality of Substance Use Disorder Patient Records” and “Confidentiality of Alcohol and Drug Abuse Patient Records”. Newer publications chose not to reference SUDs and titled the regulation as “42 CFR Part 2”, “42 C.F.R. Part 2”, “Part 2 of volume 42” and “Title 42 of the Code of federal regulations part 2”.

The majority (78%) of the studies retrieved were opinions or legal reviews within peer-reviewed journals. The rest (22%) of the publications used quantitative and/or qualitative methods to study Part 2, including surveys,¹⁸ interviews,⁹ cross-sectional qualitative studies using purposive sampling⁸ evaluation of EHR and claim data,^10,28,35 and analysis of data from the Inpatient Psychiatric Facility Quality Reporting and the American Hospital Association Annual Survey.⁴⁷

We identified 28 opinion papers and legal reviews. Opinion papers on Part 2 covered a broad range of subjects including child protection,²¹ vulnerable populations,^24,45 correctional settings,^32,34 family therapy,³³ prescription monitoring programs,⁴⁴ gun violence,⁴³ criminal justice to drug and alcohol treatment,¹⁶ SUD referral challenges,⁴² legal issues surrounding patients with acquired immunodeficiency syndrome (AIDS) suffering from SUD,²⁰ and other privacy laws.³⁷ Legal reviews on Part 2 focused on key changes to Part 2 regulation,³⁸ the 2017 and 2018 final rules,⁴⁰ legal and ethical exceptions to Part 2,²² characteristics of SUD programs and confidentiality statutes,^17,23 current initiatives to improve data interoperability in SUD systems,²⁷ special protections for SUD documentations,³¹ Part 2 implementation challenges,³⁹ SUD in health care settings,²⁶ overview and trends of federal and state confidentiality and privacy of medical records,¹⁹ trends and characteristics of long-term opioid use in persons with non-cancer pain and a SUD history,²⁹ and the effect of the CARES Act on Part 2.⁴⁶

Opinions and legal reviews on Part 2 were two-fold: discussions of Part 2 challenges, and recommendations on how to comply with Part 2. In terms of Part 2 challenges, the following conclusions were reported: the regulation is ambiguous in providing guidance to the judiciary about determining the appropriateness of law enforcement intervention, especially in correctional settings,¹⁶ Part 2 focuses only on confidentiality rather than privacy,¹⁹ Part 2 compliance is challenging in the context of mental health and other medical records,¹⁷ and Part 2 compliance has challenges in the context of prescription monitoring programs.⁴⁴

Recommendations to health providers, social workers, counselors and other professionals included: take steps to balance Part 2 and child protection,²¹ track laws and regulations and seek advice from supervisors,^20,22,33,37 obtain informed consent involving SUD data sharing,²⁵ screen or track SUD history,^26,29 comply with existing confidentiality laws,³⁷ and comply with both Part 2 and state laws.³⁷ Proposed recommendations related to technology included implementation of standards to help reduce stigma, increase engagement in treatments,³⁰ employment of data segmentation to protect inmates,^27,32 and deployment of technological safeguards to protect patient privacy in HIE and individual internet user profiles.³⁹

Recommendations on how to comply with Part 2 included the involvement of vulnerable individuals in program planning and evaluation of community stigmatization.²⁴ Advice was given on how courts should approach gun violence in relation to SUD and alcohol use.⁴³ Recommendations to support integrated care delivery and continuity of care included implementing more effective ways to seek consent from individuals with SUD and set up qualified service organizations or business associate agreements,^23,36 and realizing the importance of collaborative environments for overcoming federal, state, and correctional facilities' barriers to patient confidentiality and continuity of care.³⁴

Recommendations to Congress included implementation of additional efforts on improving EHR functionality in the behavioral health setting, enactment of incentive programs to facilitate EHR adoption in psychiatric care, and design of a timeline for progress toward these goals.^41,47 Finally, the Legal Action Center encourages the general public to fully participate in the regulatory process relating to change-making.⁴⁶

Only 8% of studies engaged stakeholders through surveys or interviews to express their perspectives on Part 2. Health care professionals included facility administrators, clinical staff, coordinated care organization leaders, addiction and mental health treatment providers, and medical providers.⁹ Privacy officers or general counsel and information technology specialists also provided perspectives.⁸

Thematic Analysis

Thematic analysis was performed on 36 peer-reviewed papers. From the 62 total codes, three main Part 2 themes emerged: care delivery (46.0%) focuses on provision of health care, often from a patient or/and provider perspective; law and ethics (30.2%) discusses topics specifically focused on legal and ethical perspectives; and technology (23.8%), includes any provision of software or hardware related to Part 2 (Figure 2). Topics found within subthemes were included for SUD & treatment, safety, and privacy.

FIGURE 2.

Emerging themes, arranged in order of highest frequency. Total N seen on the main three themes contain the codes of the subthemes, which may co-occur though part of the larger single theme.

Of the ten subthemes, the most populated were privacy, coordination and integration of care, SUD and treatment, and EHR. Subthemes all fit within the greater three main emergent themes and were coded for using the codebook (Supplementary Material). Topics found within the subthemes exemplify the diversity of work surrounding Part 2. For example, papers discussed privacy in terms of general application of Part 2 but also relating specifically to four different stakeholders. Moreover, these topics show that while the majority of subthemes could be consistently defined, there are underlying trends as well. Safety was generally referenced patient safety, but included a focus on the safety of others. The range of topics and subtopics suggest that Part 2 has a large, complex scope of impact on the multiple dimensions of health care from soft and hard infrastructures to care processes, even at the level of the individuals.

Complex Coding Query Outcomes

While thematic analysis identified the emergent themes, complex coding query demonstrated the complexity and interrelationships of Part 2 discussion (Supplementary Material). Although most papers on Part 2 remained in the specific domain of their main theme (58.3%), we identified work (41.7%) that included other major themes. No paper discussed all three themes, care delivery, law and ethics, and technology. Initial papers from 1975 through 1998 focused on law and ethics, with care delivery appearing consistently since 1981, and technology appearing only after 2012 (Supplementary Material). With the emergence of technology, legal and ethical issues emerged again as focal points. Emergent themes and subthemes convey the depth and diversity of Part 2 impact discovered through peer-reviewed work and complex coding query.

DISCUSSION

The literature review uncovered significant issues necessitating future work and limitations that require addressing. We address each below:

Limited research on Part 2.

Despite its 45 years of existence, our systematic literature search produced only 33 peer-reviewed articles on Part 2, the majority published after 2014. Taking HIPAA as a point of comparison, a search in the HeinOnline database using keywords HIPAA OR Health Insurance Portability and Accountability Act OR Kennedy–Kassebaum Act OR Kassebaum–Kennedy Act led to 5107 articles, while for Part 2 it resulted in 20 articles. Since 1981, there has been a consistent stream of publications linking Part 2 with care delivery. We relate this to several factors, including the emergence of integrated care, a focus on the opioid overdose epidemic and the availability of FDA-approved therapy for SUD that can be prescribed by primary care clinicians and in other healthcare settings.⁴⁸ However, the technology perspective on Part 2 did not emerge until after 2012, when the ARRA-HITECH incentives resulted in broad EHR adoption and the development of HIEs.

Lack of key stakeholder engagement in Part 2 studies.

While only 8% of studies reported some stakeholder involvement, no study included patients or patient advocates. Patients, advocates and clinicians from primary care and integrated clinics, health plans and health systems, behavioral health care and SUD treatment facilities, homeless clinics, HIV/AIDS/infectious disease centers, state HIEs and other relevant participants should be involved in Part 2 studies, particularly those that empirically assess patient and other relevant perspectives. This is necessary to inform the sometimes seemingly incompatible goals of service integration and privacy protection.

Lack of discussion on the efforts to align Part 2 with HIPAA.

While there have been efforts to align Part 2 with HIPAA to allow SUD data sharing without explicit consent as a way to ensure that patients with SUD participate in, and benefit from health system delivery improvements, none of the studies discussed or provided evidence of the benefit of this alignment. Our results emphasize that efforts and recommendations to align Part 2 with HIPAA are not evidence-based as no studies were identified in this review on this topic.

Dearth of information on the impact of Part 2 on care delivery.

We found that providers from a 1981 study reflect greater positivity about Part 2’s impact¹⁸ than those from a 2017 study.⁹ More research on the influence of Part 2 on the quality and delivery of patient care from clinical and patient perspectives is needed.

Alleviating stigma and encouraging access to SUD treatment.

While stigma was a major factor for enacting Part 2 and still affects SUD accessibility and treatment-seeking behaviors, our systematic literature search did not identify research on this topic. Thematic analysis identified stigma as a subtheme of interest, but there were no studies focusing on the relationship between stigma, SUD treatment, and Part 2.

More interdisciplinary research is needed.

Part 2 is a long-lived regulation that has become increasingly more complex with integrated care, health information technologies, and evolving patient SUD treatment needs. Our thematic analysis revealed three major themes (care delivery, law and ethics, and technology) and showed interrelations among them, such as privacy within law and ethics, congruent to coordination of care/integrated care and stigma, yet few articles explored these relationships. A better understanding of the multidimensionality of Part 2 is needed.

Inadequate quantitative and qualitative research on Part 2.

Most (78%) of the literature we identified was comprised of legal opinions, anecdotes, and personal advice. There is an urgent need to assess the Part 2 interpretation, implementation and compliance using rigorous methodology as it evolves with CARES Act implementation. Such empirical research could inform our national and state policymakers during this critical time and beyond. Systematic, formal methodologies that use EHR data to assess perspectives on Part 2 privacy protections could play an important role, while systematically exploring SUD data sharing protections could leverage publicly-available data.^49,50

In light of the current CARES Act implementation, our findings emphasize the need for high quality, quantitative and qualitative research employing systematic, formal methodologies that provide empirical data from diverse stakeholders on the broad range of Part 2 compliance issues prevalent in SUD treatment programs. This capsulation of Part 2 research and recommendations can help guide future research on SUD data privacy protections.

CONCLUSION

Despite its 45-year history, our scoping literature review with thematic analysis revealed a significant death of literature on Part 2. Legal analysis and commentary comprised most studies and none involved rigorous qualitative or quantitative analysis. Patients, patient advocates and clinical stakeholders are poorly represented, and no studies have been published about the impact of Part 2 on stigma. There is a lack of research on Part 2 and HIPAA alignment. Finally, there is a need for more interdisciplinary research that addresses perspectives from those in care delivery, technology, law and ethics. It is our desire that this study heralds a new era of scholarly research on CARES Act, Part 2 revisions and other policy changes that impact SUD data sharing, an essential component in our struggle to overcome the opioid epidemic.