WPF files comments on US government proposal on confidentiality of drug/alcohol patient records, urges revisions

The World Privacy Forum commented on an important proposal to make changes to the existing rules regarding the confidentiality of alcohol and drug abuse patient records. The proposal is from the Substance Abuse and Mental Health Services Administration (SAMHSA), part of the US Department of Health and Human Services.

These proposed rule changes are important, as the current rules are among the strongest confidentiality rules in HIPAA. The new rule, when it is final, will change the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 C.F.R. Part 2.

Here is a brief summary of the most important aspects of our comments regarding the SAMSHA proposal:

We have major objections to the proposal to add to consent forms a “statement that the patient … confirms their understanding of the terms of their consent.” This part of the proposal may be the single most anti-patient provision in the entire proposed rule. We strongly recommended deleting this proposed requirement from the consent form. It serves those requesting consent, not the patients.

We found several definitional problems in the proposal. Problematic definitions included the definition of a program, the proposed definition of a record, and the proposed definition of patient identifying information. These definitions are deficient for various reasons which we discussed at length in our comments, and we suggested solutions and changes.

We supported the proposed changes to the scope of activities permitted by a Qualified Service Organization (QSO).

We discuss additional issues, including disclosures, research, internal confidentiality agreements, and data use agreements in the comments. Please see our detailed comments here.

Related Documents:

Read WPF’s comments (PDF, pages)

Read the SAMSHA proposal

Posted April 4, 2016 in Health Privacy, Health Records, HIPAA, Human Subject Research Protection, Notice of Proposed Rule-making Comment, Public Comments, U.S. Department of Health and Human Services
Tags: 42 C.F.R. Part 2, Confidentiality of Alcohol and Drug Abuse Patient Records regulations, SAMHSA

New Report: Risky Analysis: Assessing and Improving AI Governance Tools

We are pleased to announce the publication of a new WPF report, “Risky Analysis: Assessing and Improving AI Governance Tools.” This report sets out a definition of AI governance tools, documents why and how these tools are critically important for trustworthy AI, and where these tools are around the world. The report also documents problems in some AI governance tools themselves, and suggests pathways to improve AI governance tools and create an evaluative environment to measure their effectiveness. AI systems should not be deployed without simultaneously evaluating the potential adverse impacts of such systems and mitigating their risks, and most of the world agrees about the need to take precautions against the threats posed. The specific tools and techniques that exist to evaluate and measure AI systems for their inclusiveness, fairness, explainability, privacy, safety and other trustworthiness issues — called in the report collectively AI governance tools – can improve such issues. While some AI governance tools provide reassurance to the public and to regulators, the tools too often lack meaningful oversight and quality assessments. Incomplete or ineffective AI governance tools can create a false sense of confidence, cause unintended problems, and generally undermine the promise of AI systems. The report contains rich background details, use cases, potential solutions to the problems discussed in the report, and a global index of AI Governance Tools.
National IDs Around the World — Interactive map

About this Data Visualization: This interactive map displays the presence...
Report: From the Filing Cabinet to the Cloud: Updating the Privacy Act of 1974

This comprehensive report and proposed bill text is focused on the Privacy Act of 1974, an important and early Federal privacy law that applies to the government sector and some contractors. The Privacy Act was written for the 1970s information era -- an era that was characterized by the use of mainframe computers and filing cabinets. Today's digital information era looks much different than the '70s: smart phones are smarter than the old mainframes, and documents are now routinely digitized and stored and perhaps even analyzed in the cloud, among many other changes. The report focuses on why the Privacy Act needs an update that will bring it into this century, and how that could look and work. This work was written by Robert Gellman, and informed by a two-year multi-stakeholder process.