A. Instituting use mandates

First and foremost, PDMPs must become a standard tool for prescribers and dispensers of opioids, as well as benzodiazepines, barbiturates, stimulants, and muscle relaxants, like carisoprodol. Some states, like Connecticut, have also begun requiring medical marijuana dispensing to be tracked on PDMPs, and to the extent that mixing marijuana with other controlled substances can pose a medical risk, we recommend these measures as well.³⁴ Although it has been less than a decade since Nevada implemented the first law mandating that prescribers consult PDMP information before prescribing opioids to patients, early studies have indicated that such efforts to mandate PDMP consultation have had salutary effects. Health care providers have been shown to change their prescribing patterns when given access to PDMPs during their decision-making process,^{Reference Baehren35} often prescribing fewer opioids as a result.³⁶ These effects have been especially strong in states where, rather than requiring prescribers to make a subjective assessment of the patient's reasons for seeking opioids, legislation has required all physicians to consult the PDMP when prescribing in certain circumstances, especially to new patients.³⁷ To date, thirty-six states legally require that physicians query the database before prescribing a controlled substance under certain conditions, like suspicion of an SUD,³⁸ and Ayres and Jalal's in this symposium paper suggests that such laws are crucial to PDMPs' success.³⁹

Kentucky is an illuminating example of such a comprehensive mandate. In 2012, the Kentucky General Assembly passed House Bill 1, which implemented mandatory registration with the Kentucky All Schedule Prescription Electronic Reporting (KASPER) system and set new requirements for providers to query KASPER before prescribing opioids to their patients.^{Reference Freeman40} This initiative led to a 262% jump in prescriber registrants to KASPER, with a 650% spike in the mean number of annual queries to the system, as well as a 322% increase in pharmacist registrants, with a 124% increase in the mean number of system queries.⁴¹ This widespread use of KASPER has appeared to have considerable effects on prescribing practices, as morphine milligram equivalents (MME) per capita decreased in 62% of counties between 2010 and 2015.⁴²

Most interesting, however, was the qualitative feedback from health care providers, who are among the most resistant parties to widespread implementation and mandatory use of PDMPs. Prescribers, pharmacists, and law enforcement officials reported, after initial confusion and discomfort with altering routine, no negative impact of KASPER on their practice or professional duties.⁴³ Kentucky also provides a model for legislative flexibility, for after medical professionals raised objections to the broad-sweeping 2012 law, the legislature made adjustments in 2013, creating exceptions for emergency situations and before or during surgery.⁴⁴

In the long term, technological advancements might make must-access PDMPs logistically integral to the prescribing process. Sophisticated computer systems could block doctors from filing prescriptions — and pharmacies from dispensing controlled substances — unless they queried the PDMP and indicated acknowledgement of certain risks. In the short term, the transition into a mandatory PDMP regime can also be eased through the implementation of streamlined enrollment processes and training courses for prescribers, dispensers, and law enforcement and public health officials to navigate these databases. Technological improvements, especially integration of PDMP access into electronic health record systems (discussed below), will aid in this effort.⁴⁵ In the meantime, however, enabling online registration for a secure PDMP account or incorporating automatic registration into the process of state-controlled substance registration or medical license renewal will lower the barriers to entry for physicians who may currently be wary of the hassle of PDMPs.⁴⁶

Because accessing PDMPs takes time and therefore money, it would also make sense to provide positive incentives for access. These “carrots” could include insurers reimbursing PDMP checking and legislators granting physicians partial immunity from lawsuits — or at least establishing a presumption of non-negligent behavior — based on whether they checked the PDMP or not. Such lawsuits could include those by patients who were refused opioids based on a PDMP result as well as those by loved ones angry that a patient overdosed after being prescribed an opioid.

The federal government can also serve a vital role in promoting the adoption of more stringent PDMP requirements. Funding for PDMPs comes largely from state budgets, with most of the expenses arising up front for developing the technology and training health care professionals in how to use the systems,⁴⁷ but the federal government has provided some funding to cover these transitional costs. The Department of Justice's Bureau of Justice Assistance oversees the Harold Rogers Prescription Drug Monitoring Program, which annually awards grants “to create, implement, and enhance” state-run PDMPs.⁴⁸ In 2016, the Rogers program distributed over $8.8 million in twenty separate awards to nineteen states.⁴⁹ Through legislation like the Prescription Drug Monitoring Act of 2017 mentioned above, Congress has considered conditioning receipt of such funds on several requirements,⁵⁰ including mandating that practitioners consult PDMPs before prescribing controlled substances. The federal government is a much better source of supplemental support for PDMPs than the pharmaceutical industry, which at times has played that role in some states,^{Reference Mattina51} because the incentives for the industry may be in the direction of underfunding.

B. Improving user interface and streamlining with electronic medical records

The main pushback against adoption of mandatory PDMPs comes from medical providers, who in addition to believing in the general principle of physician autonomy,^{Reference Guevremont, Barnes and Haupt52} worry in particular that having to navigate a new database will slow them down and create unnecessary complications to their medical practice.⁵³ Others were concerned that enforcement agencies with little understanding of medicine would use the PDMP information to punish doctors who had a legitimate need to prescribe outlying amounts of opioids (e.g., hospice physicians).

Despite these initial reservations, studies in Kentucky and other locations have shown that providers can adjust quickly to querying PDMPs — and often come to find them a valuable resource in treating their patients. An integrated interface, streamlined with existing EMR systems, would make such an adjustment even easier.^{Reference Hildebran54} Indeed, a key part of the final recommendations from the White House Commission on the Opioid Crisis concerns simplifying access to such information by integrating the PDMPs into existing EMR systems — a recommendation borrowed from a comprehensive report prepared by the Heller School at Brandeis University.⁵⁵ Such an effort could also be part of a larger initiative to eliminate paper prescriptions entirely and to shift to electronic prescribing of controlled substances, a push recommended by both the American Medical Association and the American College of Physicians.⁵⁶

One feature of such an integrated system should be the automatic querying of a PDMP whenever a health care provider pulls up a patient's EMRs.⁵⁷ Pilot studies with such integrated medical records and automatic querying have shown a clear preference on the part of providers for such a unified system, with 97% of participants in one study finding the PDMP data easier to access and consider.⁵⁸

C. Ensuring timely data uploads

Another important variable in improving the effectiveness of PDMPs is to ensure timely uploading of the relevant prescription information. PDMPs collect information, conveyed by prescription drug dispensers, on filled controlled substances prescriptions. These data are conveyed by the dispensers to the PDMP, which reviews the data for completeness and accuracy — normally using an algorithm — and then either uploads them into the database or returns them to the dispenser for supplementation.⁵⁹ The main variable in these systems is the frequency with which dispensers are required to update the PDMP. Although Oklahoma has real-time turnaround — pharmacies transmit the data on individual transactions within five minutes of a sale⁶⁰ — and Nebraska has real-time turnaround for most of its pharmacies, the bare majority of states (26) had daily updates as of 2015.⁶¹

One reasonable goal for improving the effectiveness of PDMPs is to shorten this turnaround time in the remaining jurisdictions. As of 2015, four states updated the PDMP every three days, fifteen states updated on a weekly basis, and two states updated after two weeks or more.⁶² There is some debate over whether real-time updates, as opposed to daily updates, are a significant boon to avoiding doctor shopping and detecting unscrupulous prescribers or dispensers.⁶³ Faster upload rates may come with higher costs, and pharmacies have been resistant to implementing real-time systems for fear of transition costs, workflow delays, and shoddier data quality.⁶⁴ Moreover, as Ayres and Jalal point out, the benefits of real-time uploads versus longer intervals are dwarfed by the difference in must-access versus discretionary systems.⁶⁵ Still, a more complete set of data, both in terms of contemporaneity and scope of information included, has evidence of leading to better prescriber decision-making and to lower opioid-related mortality rates.⁶⁶ When upgrading their PDMPs, states would be wise to consider implementing at least daily uploads and, regardless of which interval they initially choose, using evidence-based practices to adjust the upload rates in line with results.

D. Establishing a national data repository

A clear area where technology can be improved is in linking, or even uniting,^{Reference Simoni-Wastila67} the many state PDMPs together to allow for cross-state comparisons of prescribing practices. To date, states have often had to go it alone, relying on their internal data gathering and one-off partnerships with surrounding states. For instance, one third-party vendor, Appriss, provides PDMP services that link together data from forty-five states and territories, enabling health providers “to obtain multi-state information about their patients' controlled substance prescriptions.”⁶⁸ Although such efforts are promising, the scope of the national opioid crisis demands a more unified — and likely public — response. In December 2017, the Aspen Institute Health Strategy Group, co-chaired by two former Secretaries of the Department of Health and Human Services (HHS) — Kathleen Sebelius and Tommy G. Thompson — identified investment in data and knowledge as one of the top five “Big Ideas” for confronting the opioid crisis.^{Reference Weil and Dolan69} Recommendations in their Report included sharing data across different state PDMPs and linking data across insurers, pharmacies, employers, and public health departments to build more comprehensive patient profiles.⁷⁰

Two limitations to a unified, interoperable system are the technical incompatibility of different state-run programs and the regulatory problems with different states' privacy and EMR sharing regimes. Creating a federally operated PDMP could eliminate the former concern. Although PDMPs vary across the states — with different upload timelines, types of data gathered, and provider-access requirements — a national system backed by federal resources should nevertheless be able to overcome these technical discrepancies by implementing a uniform and interoperable database, even if at some expense. The question of privacy would remain, however, and potentially grow larger as a breach in a federal system would by definition expose more individuals' data than would a breach in a state system. States currently differ in their willingness to allow law enforcement access to PDMPs, with thirty requiring a court order, subpoena, search warrant, or grand jury order.⁷¹ One path forward would be a federalist approach, namely, setting some general guidelines nationally and then allowing states to make individual determinations about which information they draw from a national repository and which information they upload to it, consistent with their particular privacy and law enforcement concerns. That being said, the current success of Appriss, a private company, in joining together over forty states speaks to a general openness and urgency in addressing this problem through innovative, collaborative techniques.

The recent Final Report from the White House Commission on the Opioid Crisis proposes a middle path, between the independent state-level systems that currently exist and a totally unified PDMP: a national data repository, or an “integrated data environment” in the words of the Report, that can connect various public actors, from federal agencies to state PDMPs, together to create an informed, targeted plan for addressing the opioid crisis.⁷² Such a repository could accommodate privacy concerns in a number of ways, including allowing states to upload only as much medical information as state privacy laws permit and leaving each state to determine which internal officials — public health versus law enforcement, for instance — have access to the repository.

E. Equipping Medical Providers With Training On How To Respond To Evidence Of Doctor Shopping

If discovering that an opioid-addicted patient has obtained many prescriptions furtively results in the physician “firing” the patient, the patient may turn to the increasingly deadly heroin and illicit opioid market to treat cravings. If this shift happens on a broad scale nationally, the benefits of PDMPs in reducing deaths from prescription opioids will be cancelled out by the increasing deaths from heroin and fentanyl — and, increasingly, carfentanyl. Physicians must therefore be trained in how to connect patients filling multiple prescriptions to appropriate SUD care, which could mean obtaining a waiver to prescribe buprenorphine/naloxone — known popularly by its trade name, Suboxone — and delivering that care themselves. The implementation and development of PDMPs could thus foster teachable moments and opportunities to improve health rather than to spur heroin use.

F. Mitigating privacy concerns

One final question regarding PDMPs is the extent to which they can mitigate the security concerns associated with aggregating individuals' prescription data. Unlike the insurers implementing “lock-in” programs, the public health or other state officials managing PDMPs receive information from prescribing practitioners or pharmacists, rather than from the individual seeking a reimbursement. Although both processes can, in practice, be faceless from an individual patient's perspective, state-mandated PDMPs represent a much greater privacy concern insofar as they gather and distribute prescribing information to practitioners, pharmacies, and public health administrators, rather than merely blocking reimbursements after an internal review. Florida, cited earlier as having an effective PDMP from a public health perspective, has also drawn controversy after accidently releasing the prescription drug data for over 3,000 individuals to defense attorneys in May 2013.^{Reference Kam73} Moreover, given that stigma associated with SUDs can have a negative impact on individuals' experiences in the health care system, this increased exposure of sensitive prescribing information is not to be dismissed.

Despite these risks, the potential benefits of PDMPs for improving individual treatment for SUDs and for reducing doctor shopping and pill mills are signifi-cant, and the balance clearly tips in favor of creating secure, state-run PDMPs despite the privacy concerns. Rather than casting aside PDMPs as necessarily too high a security risk, measures should be taken to protect patients' data, such as aligning each state's PDMP security protocols with federal standards, like HHS's 2013 “Security Rule” under the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.⁷⁴

PDMPs can also be open to law enforcement agencies: twenty states currently allow law enforcement officials to query the database, without a warrant or subpoena, as part of an active investigation.⁷⁵ Granted, the original PDMP in California was created in 1939 to tamp down on the opium problem, and it was utilized by law enforcement in that effort.⁷⁶ But some states, such as Massachusetts, have begun excluding law enforcement except when public health officials identify suspicious activity and choose to report it.⁷⁷ Other states, like West Virginia,⁷⁸ have established into law a legal-health partnership in PDMP management, recognizing both that medical expertise is essential when evaluating what constitutes overprescribing and that an unsupervised medical community played a signifi-cant part in starting the epidemic in the first place.⁷⁹ Trusting medicine to self-regulate is thus a case of “once bitten, twice shy.” Ideally, medicine ought to be allowed to regulate itself, thereby eliminating PDMP critics' fear of roving law enforcement officials and promoting accountability among doctors and other medical professionals. State licensing officials could rely on PDMPs to identify suspect prescribers and initiate investigations, if not delicensing. PDMPs could also be used to guide physicians who are prescribing many more opioids — or, perhaps, many fewer — than other similarly situated doctors. These interventions would protect patients' privacy and establish welfare-promoting norms within the medical community, but it will likely take re-earning the public trust that medicine lost through over a decade of lax prescribing of opioids before doctors can operate without law enforcement involvement.

Although the prospect of law enforcement officials searching through medical records is unappealing to some commentators, there are at least two important reasons to enable them to have an active role in overseeing and using the PDMPs. First, as Pardo found in his study of PDMPs, law enforcement administration of PDMPs was “associated significantly with a reduction in overdose deaths.”^{Reference Pardo80} Pardo accounts for this result in two ways. First, he notes that early PDMPs were created and run by the law enforcement, thus those older programs, run by law enforcement, are more seasoned programs and likely to be effective in reducing overdose mortality rates.⁸¹ Second, given that the stated goals of PDMPs are “to reduce misuse or inappropriate use of prescription drugs,” Pardo argues that law enforcement's mission might align more closely with these PDMP programs.⁸²

Both of these explanations require a bit more unpacking, however. Pardo does not disentangle law enforcement management of a PDMP from the age of that PDMP. Experience, under this explanation, might the primary factor in PDMPs' reduction of overdoses, rather than law enforcement involvement per se. Is it the case, for instance, that law enforcement management is key, or that the oldest programs just happen to be run by law enforcement officials — as a historical accident — who then have more experience relative to their younger peers and thus create greater reductions in their mortality rates? Moreover, it is unclear whether law enforcement must manage the system, or whether their mere access to it, in advancement of their efforts to stop doctor shopping and pill mills, might be sufficient. Further testing, with a control group of states where law enforcement can merely query, but not manage, the PDMP would be helpful. It would also be helpful if Pardo situated his discussion of law enforcement's engagement with PDMPs within a broader discussion of the importance of PDMP data in providers' prescribing decisions in states, like Kentucky and Florida. Gathering further research about how these elements interact and which combinations prove optimal would allow for better evidence-based practices going forward. Still, Pardo's numbers are likely accurate, and before privacy advocates move to disentangle law enforcement from the PDMPs which they currently manage — and, more broadly, to which they have access — further research should be done into the benefits of allowing law enforcement to access PDMPs directly, rather than through referral by public health officials.

A second important reason for affording law enforcement an active role in using and overseeing PDMPs is the increase in legitimacy that comes from enabling a different, non-medical agency to review the PDMP data and to audit the medical community's work. As noted above, medical providers have been some of the most resistant parties to the creation of PDMPs and the implementation of mandatory consultation policies. Enabling law enforcement to have direct access to PDMP data will not only enable them to identity and address potential criminal activity more readily, but will also dissolve any notion of professional collusion within the PDMP system. Some limiting measures will have to be taken. Even in a unified EMR system, law enforcement should still not be able to see individuals' entire medical histories. But perhaps non-medical personnel should be allowed to see a form of “meta-data,” as it were, showing prescribing trends that could then — if raising a certain level of suspicion, like “probable cause” — be grounds for beginning a more fine-grained data analysis.

Finally, some people flagged by PDMPs are not legitimate patients or prescribers. Individuals faking pain in order to run a drug dealing ring are a legitimate matter for law enforcement, as are doctors who run pill mills for the sole purpose of enriching themselves rather than treating patients.^{Reference Quinones83} In these cases, there is no tension between what health care does and what law enforcement does. Indeed, they are directly aligned.

A. The Structure of the Privacy Mandate

One widely recognized hurdle to providing individuals suffering from SUDs with such comprehensive, wrap-around medical services is 42 C.F.R. Part 2 (Part 2), a hoary privacy regulation that prevents federally funded SUD treatment programs from sharing information with other medical officials. Part 2 is a product of an earlier age. As Lembke describes it, Part 2 provided a crucial layer of privacy and protection from harassment for individuals with SUDs in the 1970s:

Created to protect individuals with SUDs from being arrested and harassed in an era when the Health Insurance Portability and Accountability Act of 1996 (HIPAA) did not yet exist, these regulations now frustrate, rather than promote, good medical care.

The source of this frustration comes from the regulation's vision of a near-absolute separation between the records associated with an individual's use of an opioid use disorder treatment program or other SUD program and the records associated with every other aspect of a patient's medical records. Part 2 applies to any “federally assisted drug abuse program” and prevents the disclosure of information that “[w]ould identify a patient as having or having had a substance use disorder either directly, by reference to publically available information, or through verification of such identification by another person.”⁸⁵ Under this system, a “federally assisted drug abuse program” consists of any individual or entity that (1) receives federal aid — including participating in Medicare or having a DEA registration number⁸⁶ — and (2) holds itself out as providing diagnosis, treatment, or referral for treatment of SUD.⁸⁷

Part 2 requires that addiction treatment specialists acquire written consent from the patient before sharing any information linked to the patient's SUD with other health professionals. The specific requirements of this consent regime are onerous, and it is very difficult to provide blanket consent, meaning that the addition of any new provider, program, or facility to the list seeking to access one's records requires additional approval.⁸⁸

Substance Abuse and Mental Health Services Administration (SAMHSA) has recently tried to loosen these requirements, releasing an updated version of the Rule in January 2017, which went into effect in March 2017, that allows for patients to include a “general designation” for which entities can receive their information.⁸⁹ This measure allows patients to release their records to a larger, more dynamic set of medical professionals than previously possible, but also affords them the opportunity to request a list of entities to which their SUD medical information has been disclosed.⁹⁰

Nevertheless, some health care providers have still found the restrictions too onerous for requiring consent from patients to release records to primary care physicians and to doctors that patients may not plan to see. For instance, SAMHSA still requires that the consent form explicitly describe the SUD-related information that can be disclosed with enough specificity to ensure compliance, meaning that a seemingly “general designation” might be underinclusive.⁹¹

B. Potential Avenues of Reform

Although the efforts by SAMHSA are steps in the right direction, a more comprehensive reconsideration of Part 2 might be due. Senators Manchin and Capito are trying to rework some of these regulations through the “Protecting Jessica Grubb's Legacy Act,” which was introduced in September of 2017 and as of late February 2018 remains in the Committee on Health, Education, Labor, and Pensions.⁹² The bill would bring Part 2 and the current regulations around SUD records closer to the HIPAA standards that guide “the allowable uses and disclosures to carry out treatment, payment, or health care operations.”⁹³

Unlike Part 2, HIPAA provides the flexibility for practitioners and other health care providers to share and transfer EMR as needed, both to improve care and enable research. HIPAA applies to a wide range of health information — from insurance plans to health care data clearinghouses — and the Act shields individuals from having their medical histories exposed while nevertheless allowing the transfer of EMR by a “public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability.”⁹⁴ HIPAA still strictly limits disclosure of these records, especially to an individual not affiliated with a patient's care, but it streamlines the process for sharing valuable information among the health care professionals and public health researchers who need the information for the sake of individual patients and public safety.

In light of the utility of HIPAA, an increasingly popular refrain among Part 2 critics is a push to scrap the distinction between records concerning SUDs and other medical records, effectively eliminating the Part 2 framework and allowing other privacy statutes, like HIPAA, to take the lead. Such a move would still protect medical records and require consent protections, but health care providers would have an easier time understanding the existing prescriptions by other facilities, including SUD treatment facilities, and providing a higher standard of care. When it comes to prescribing opioids — as well as other drugs that might interact with opioids, especially benzodiazepines — this sort of openness is key to safe, effective, honest medical care. It seems unthinkable nearly two decades after publication of To Err is Human — the Institute of Medicine's landmark report revealing that iatrogenic mistakes lead to at least 44,000 deaths per year^{Reference Kohn95} — that we still support a system that allows, for example, a primary care provider or psychiatrist to prescribe long-term benzodiazepines to a patient prescribed high-dose methadone for opioid use disorder without the prescriber's knowledge of the latter.

Support for a shift in Part 2, and even its eventual repeal, is growing. Many organizations dedicated to advocating for individuals with SUDs backed the recent SAMHSA reforms, but have been hesitant to advocate for the outright repeal of Part 2. In their eyes, the criminal element of SUDs, as well as the discrimination and stigma that they carry, are grounds for erecting strong privacy protections in the hope of encouraging more individuals to come forward for treatment.⁹⁶

Other organizations, like the National Alliance on Mental Illness (NAMI), are in support of eliminating Part 2 or, at least, aligning its restrictions with those of HIPAA.⁹⁷ This more fundamental change would likely have to occur alongside a major investment in eliminating stigma from other realms of medical care, as at least according to anecdotal evidence, individuals with SUDs — and mental health disorders more generally — receive worse care from primary care physicians and those in more acute settings, who often shift the blame onto the SUD or mental health disorder.^{Reference Garey98} That being said, the potential adverse consequences of prescribing a benzodiazepine alongside an unreported methadone treatment, under Part 2, are much worse than those experienced by a patient unable to receive MAT as easily. Even if not true for patients with mental health disorders more broadly, individuals with SUDs necessarily receive compromised care when doctors are unable to know which other medications they are receiving.

This heightened problem of mixing medications makes the need to reform Part 2 particularly clear and pressing. Even with HIPAA as a baseline, however, other questions about EMRs and patient privacy still remain. For instance, should the notes taken by psychiatrists and psychologists, which are not included in standard medical records and must be specifically released by a patient, be lumped into the general pool of medical records, or should the distinction between mental health care and other forms of medical care be preserved? Given the considerable instances of comorbidity between SUDs and other mental health problems, this question of partitioning care is of direct relevance to the opioid crisis. Still, the best approach remains unclear, and in reforming Part 2 and other privacy standards, the medical community should look to evidence-based research in determining the optimal balance of privacy precautions and informed care.

Finally, the historical experience of the Veterans Health Administration is relevant. The agency was never subject to Part 2,⁹⁹ yet built a large, widely accessed SUD treatment system that pioneered many psychosocial and pharmacological treatments. The VHA is widely seen as providing the best, most integrated care for all of SUD patients' needs in the public sector.¹⁰⁰ The claim that SUD patients inherently suffer without Part 2 cannot account for VHA's success.