Prescription drug monitoring programs come under fire

As the President’s Commission on Combating Drug Addiction and the Opioid Crisis prepares to issue its final report next week, one legal expert is sounding the alarm about the potential privacy risks from state databases that track prescriptions and the fact that they are expanding in size and scope.

The commission issued an interim report in late July recommending that the federal government provide funding and technical support to states to improve interstate data sharing between state-run prescription drug monitoring programs (PDMPs) to better track prescriptions written for addictive medications. PDMPs record a patient’s opioid prescribing history and are used to flag suspicious activity.

However, according to Leo Beletsky, associate professor of law and health sciences at Northeastern University, there has been a huge expansion in the scope and number of PDMPs, and along with that, “a number of privacy issues with these programs that have not received adequate attention” have also arisen.

Beletsky made his remarks during a presentation Thursday at the “Data Privacy in the Digital Age” symposium in Washington hosted by the Department of Health and Human Services.

He contends that PDMPs are a central feature in the government’s response to the opioid epidemic to “better control and surveil” such prescriptions. “All the states became really engaged in either starting or expanding their prescription drug monitoring efforts,” he adds.

Also See: States need to share prescription data to combat opioid crisis, finds commission

While Beletsky acknowledged that public health surveillance is “an essential tool in addressing” crises such as the opioid epidemic, he warned that “there’s also a sinister side” to this kind of surveillance, resulting in the deployment of systems that have in the past “targeted people who are vulnerable—the poor and disproportionately affecting people of color.”

One of the problems with the data held in PDMPs is the “availability of the information to a wide variety of actors” and the fact that these databases serve as “very limited” electronic records that “just track someone’s prescriptions without a way to contextualize this information.”

He referenced a recent privacy breach involving Stephen Paddock, the shooter who killed 58 concertgoers in Las Vegas earlier this month. A day after the mass shooting, a newspaper published leaked information regarding Paddock’s prescriptions that was taken from the Nevada PDMP, according to Beletsky, who added that the article posed the question of whether the medication affected his behavior.

“Most people would be shocked to know that their private prescription information is tracked by PDMPs, which by the way, includes things like testosterone for gender reassignment surgery and anxiety medications,” he said.

Another potentially negative development is the “emerging practice on the state level of bundling PDMP information with criminal justice data,” Beletsky noted. For instance, he revealed that three states—Kentucky, Maine and Wisconsin—now include drug conviction information and drug charges (with no conviction) in PDMPs.

“This begs the question: What kind of decision support does that provide for a healthcare provider, and why is that information bundled with your prescription information?” Beletsky concluded. “PDMPs are decision support tools for clinicians and are supposed to help facilitate care coordination.”

“There is no notice and choice framework for PDMP data—as a consumer, when you get your drugs prescribed, the information by law is transmitted into this government database,” he added. “This is something that requires additional federal legislation and perhaps—this is a little bit pie in the sky—we can expand the scope of covered entities to also apply to the owners of these data because they involve identifiable health information. It certainly would make sense if HIPAA were expanded.”