Confidentiality in Addiction Treatment

May 23rd, 2019

In late April of 2019, it became evident that confidential information from nearly 150,000 patients at a Pennsylvania alcohol and drug rehab center were exposed online. A researcher found what turned out to be nearly five million rows of data containing what proved to personally identifiable information for former patients of the Steps to Recovery rehab centers who enrolled at the facility between 2016 and 2018. The researcher immediately notified the search engine ElasticSearch, where the files were discovered, and the records were taken out of public circulation. It is unclear whether or not Steps to Recovery has notified their alumni and former patients of the breach.

Anytime a rehab facility or other type of medical organization experiences a security breach and patients’ information is exposed, it creates a serious issue for both the patient and the organization that suffered the breach. Patients rely on discretion and confidentiality during the addiction treatment process, as well as for all other types of medical procedures, and the law guarantees the safeguarding of their privacy. This guarantee is a cornerstone of the treatment process, and it’s questionable whether or not patients would seek treatment in the first place if they knew their tenure in these programs had the potential to become a matter of public record. The fundamental mechanism that protects these rights is known as the Health Insurance Portability and Accountability Act (HIPAA).

What Information Does HIPAA Protect?

Signed into law in 1996, HIPAA was designed to offer concrete protections in the face of the inevitable transition of patients’ medical records from print files to an electronic platform. The law has emerged into greater prominence in recent years with the proliferation of health data breaches caused by cyber attacks and ransomware attacks on health insurers and providers. This recent data breach of Steps to Recovery is not the first time something like this has happened. The primary purpose of the law is to protect the medical information of patients and standardize a way of storing records in an electronic database.

The Critical Importance of Confidentiality in Substance Abuse Treatment

As important as it is for patients to be able to rely on the confidentiality of their general medical information, the legal right to privacy and discretion related to addiction care is absolutely sacrosanct. In a society that still largely stigmatizes addiction and views it as a moral failing, the realization that a person is in treatment or struggling with substance use disorder (SUD) can irrevocably change lives, derailing careers and even compromising friendships.

The Substance Abuse and Mental Health Services Administration (SAMHSA) reports that a little more than 10 percent of the approximately twenty million Americans who need substance abuse treatment actually receive it, a large reason for this being the fear, shame, and stigma associated with a SUD diagnosis. While treatment professionals, law enforcement, and prevention advocates have all done their part to lessen the stigma, it still has real-life implications for many who are engaged in the struggle.

Protection for Personal and Professional Discretion

One of the ironic things about addiction is that it affects everyone, but very few want to admit or talk about it. SUD sufferers are doctors, lawyers, artists, teachers, parents, children, the impoverished, the wealthy, and everyone else. Unfortunately, a realization that their lawyer is a person suffering addiction can cause a client to lose confidence and seek counsel elsewhere; a realization that a teacher is in recovery can prompt parents to remove their child from their class; the discovery that the person making your sandwich is in recovery may cause you to think twice before eating it.

While this may seem fundamentally unfair, it’s the world we live in, and laws like HIPAA do their best to account for this reality and maneuver within its framework. Addiction has been designated by the Department of Health and Human Services (HHS) as a chronic medical condition, and records for treatment and diagnosis are subject to the same protections as those for heart disease, diabetes, and all other medical and behavioral issues.

The Future of Confidentiality in Addiction Treatment

As cybersecurity threats become increasingly sophisticated, it may become harder and harder to adequately guarantee the protection of personal and confidential information. It’s important, however, not to let this deter you or your loved one from getting treatment. The reality is that these breaches are few and far between, and personnel at almost every rehab facility are prepared to deal with them and prevent them. Treatment for SUD is the only remedy for this deadly and insidious condition, and fear over stigma and exposure should not preclude patients from seeking the help they need. If you or someone you care about is struggling with SUD, the most important thing is to get help now.

Resources: