COVID-19: Isolating the Problems in Privacy Protection for Individuals with Substance Use Disorder

I.     Introduction

Even in ordinary times, addiction can be a disease of isolation.1 Substance use disorder2 (SUD), which is commonly referred to as drug addiction, is a chronic disorder that impacts neural networks in the brain and the central immune system.3 Individuals with SUD are at increased risk for COVID-19 and its adverse outcomes, including death and hospitalization.4 The pandemic has introduced social distancing orders and exacerbated housing instability and unemployment, interfering with SUD treatment.5 Prior to the pandemic, disparate access to SUD treatment was already a national concern due to the ongoing opioid epidemic.6 Access concerns, along with concerns about privacy, stigmatization, and discrimination, continue to pose problems for those with SUD.7

The pandemic has reinvigorated discussions about the legal protections available to those experiencing stigmatization and discrimination on the basis of SUD records.8 In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act),9 which, inter alia, amended the privacy framework for SUD records.10 This privacy framework is provided in 42 U.S.C. § 290-dd; its implementing regulations are in the Confidentiality of Substance Use Disorder Patient Records11 rule (hereinafter referred to as “Part 2”).12 The CARES Act amendments (hereinafter referred to as the “CARES Act Modifications”) substantially alter statutory provisions regarding patient consent13 and include a new antidiscrimination standard.14 Patient privacy advocates view reduced consent requirements as reducing the degree of control patients can exercise over the sharing of their records.15 Broadened record sharing may be problematic for SUD patients due to persistent stigmatization and associated discrimination.16

This Comment evaluates the extent to which the CARES Act Modifications sustainably balance individual privacy expectations with strong public interests in obtaining SUD records and integrated care. Moreover, it suggests avenues to fill gaps in protection for individuals with SUD after their information has been disclosed.

The Comment will proceed as follows. Part II outlines the existing fragmented privacy protections for SUD records as well as the existing antidiscrimination protections for individuals with SUD. Part III examines the CARES Act Modifications. Part IV argues that, although Part 2 provides individuals with SUD some degree of control over their records, privacy protections are fragmented, unpredictable, and unstable. This Part suggests that heightened antidiscrimination protections will ultimately provide the most sustainable protection for individuals with SUD, but robust protections will require courts to reevaluate existing antidiscrimination standards. This Comment concludes that, with these changes, courts can help to reduce barriers to treatment and avoid widespread treatment discontinuity in a future pandemic.

II.    “Part 2”: Privacy and Substance Use Disorder

While the clinical concept of substance use disorder has changed over time, the legal protections for individuals with SUD have largely stayed the same. This Part will explain the history of SUD and analyze the existing need for stringent privacy protections for individuals with SUD. It will survey the patchwork of privacy protections available for individuals receiving SUD treatment and evaluate the synergy between privacy and antidiscrimination protections for SUD treatment records. Ultimately, this Part will conclude that the unpredictability of both privacy and antidiscrimination protections leave individuals with SUD vulnerable to stigmatization and discrimination.

A.    Substance Use Disorder: Definition and Impact

In 2017, the U.S. Department of Health and Human Services (HHS) declared the nationwide opioid epidemic a public health emergency in response to the overwhelming rate of opioid overdose deaths.17 Currently, an estimated 130 people die every day from opioid overdoses,18 and opioid-related deaths in the United States exceed the number of deaths related to car accidents.19

Drug policy has historically treated substance use as the result of a “deviant moral failing,” but the narrative shifted with the opioid crisis.20 Rather than employing a moral-defect framing, media and policymakers alike have characterized opioid addiction as a complex health condition and shifted the blame to clinical overprescription and aggressive pharmaceutical marketing.21 A medicine-centric view is aligned with the modern understanding of SUD among healthcare providers.22 The prevailing diagnostic resource, the Diagnostic and Statistical Manual of Mental Disorders (DSM-5), classifies SUD as a “cluster of cognitive, behavioral, and physiological symptoms indicating that the individual continues to use the substance despite significant substance-related problems.”23 “Repeated, regular misuse of substances”—both illicit and legal—can qualify an individual for a diagnosis if other criteria are met.24 Not all criteria are necessary for a diagnosis under the DSM-5, which categorizes symptoms as mild, moderate, or severe.25

As scientists have begun to understand the disorder, they have suggested a number of therapies that may reduce symptoms and dampen relapse risk.26 Overall, the outlook remains dire: The clinical efficacy of laboratory-approved treatment models is limited, and avoiding relapse remains a huge challenge for recovering individuals.27 Those seeking treatment for SUD must surmount hurdles including insurance difficulties,28 provider stigmatization and discrimination,29 and fear of social costs—such as adverse effects at work or in the community.30 Estimates suggest that only one in ten Americans with SUD access treatment,31 which may indicate that treatment barriers remain significant.

Treatment providers traditionally separated treatment for SUD from general healthcare,32 but advocates have recently pushed toward “integrated care.”33 Integrated care refers to a comprehensive system of treatment services that tracks patients over time and through a holistic array of health services, including “prevention, early intervention, treatment, continuing care, and recovery support.”34 Providers have come to see integrated care as a necessary shift in SUD treatment models.35 Yet a long history of segregated care has persistently impeded adequate care options for individuals with SUD.36 For one, segregated care is thought to reinforce the idea that SUD is different from other medical conditions.37 Until recently, few insurers offered comparable reimbursement for SUD treatment services relative to other conditions.38 Moreover, healthcare providers themselves perpetuate stigmatization of individuals with SUD by carrying personal beliefs into their professional work.39 While there is evidence that the tide is turning,40 more certainly needs to be done.41

B.    The Privacy Problem

While SUD is increasingly integrated into generalized healthcare systems, research suggests that the public continues to perceive addiction as more stigmatizing than other conditions, including other mental disorders.42 Likely, the erroneous perception that individuals with SUD have control over their disorder—and thus, are more responsible for their behavior—contributes to this persistent stigma.43 Such stigma has led to governmental concern that fear of discrimination impacts the decision to seek out treatment.44 Concern about treatment deterrence has motivated heightened privacy protections for SUD treatment records.45 To understand why stringent protections for these records continue to be necessary, it is important to explore the limitations of existing privacy protections for individuals with SUD, including constitutional, common law, and statutory protections.

1.     The Constitution (currently) provides no solution to the SUD privacy problem

There is no explicit privacy clause in the U.S. Constitution.46 That said, courts have interpreted the Fourteenth Amendment’s substantive due process protection to protect privacy in some situations,47 and in Griswold v. Connecticut,48 the Supreme Court found that the right to privacy was a penumbral right implicit in the Constitution’s text.49 The Court has since held that the constitutional right to privacy covers a “zone of privacy” that includes individual autonomy in decisions involving one’s body and family.50 The Court clarified the concept of a “zone of privacy” in Whalen v. Roe,51 a landmark case that applied the right to privacy to the release of prescription information to public officials.52

In Whalen, the Court upheld a New York statute which required that the state be provided a copy of every prescription for certain drugs for the purpose of maintaining a centralized computer file.53 The file was intended to aid in monitoring and investigating prescription drug abuse.54 The plaintiffs argued that patients in need of prescriptions would decline treatment due to fear that the information would stigmatize them as drug addicts.55 Two parents testified that their children would be stigmatized by the filing system, and one of these children had been taken off his medication due to this concern.56 Three adult patients testified to their fear of stigmatization and discrimination in the event of disclosure, and four physicians testified to their observations of patient fear and concern.57 The state countered that public disclosure of this information was explicitly prohibited by the statute and access was limited.58

Despite plaintiffs’ evidence and the statute’s potentially deterrent impact on treatment seeking, the Court recognized the state’s broad police powers in regulating drug prescriptions.59 The Court dismissed the plaintiffs’ concerns about public disclosure as unfounded and determined that the mere requirement that private information be disclosed to public officials was not “meaningfully distinguishable from a host of other unpleasant invasions of privacy that are associated with many facets of health care.”60 The Court found that disclosure of private medical information to healthcare providers is often essential to treatment, “even when the disclosure may reflect unfavorably on the character of the patient.”61

While the Court subsequently declined to extend Whalen beyond its facts, the majority opinion delineated two kinds of privacy interests that form the foundation for the modern conception of privacy in healthcare records.62 The Court determined that the zone of privacy extends to two types of interests: (1) independence in making certain kinds of important decisions; and (2) an individual interest in avoiding disclosure of personal matters.63 The latter interest, often referred to as the “right to information privacy,” has been referenced in cases since Whalen.64 But because the Whalen Court merely determined that a right to information privacy may exist, later decisions have not fully embraced the interest as constitutionally protected.65 For example, the Court’s subsequent decision in Nixon v. Administrator of General Services66 affirmed the right to privacy in personal matters but determined that an individual’s expectation of information privacy must outweigh the government’s interest in the disclosure for that interest to be protected.67 In National Aeronautics and Space Administration v. Nelson,68 the Court assumed there was a right to information privacy without deciding that the right existed.69

Thus, Whalen and subsequent Supreme Court decisions give lower courts little guidance for information privacy cases. The Whalen Court left unclear which circumstances would constitute a violation of the information privacy interest and failed to delineate the constitutional treatment that courts should use when assessing that interest.70 Every federal circuit court except the D.C. Circuit71 has interpreted Whalen to establish a right to information privacy,72 but there is no consensus among circuits on the circumstances that necessitate protection.73 It is clear, however, that courts generally allow disclosure of medical information when the government’s interest in that information outweighs the individual’s interest in privacy.74

2.    Common law and statutory privacy law provide inconsistent protection

Whether or not a constitutional right to information privacy exists, the confidentiality of health information is protected to some degree by common law doctrines and statutory protections at both the federal and state level.75 Despite ostensible protection, scholars have generally seen information privacy law as “neither comprehensive nor consistent.”76

Until Congress enacted recent federal statutory protections, states were the primary regulators of health information under state constitutional, common law, and statutory provisions.77 Medical ethics and a common law duty of confidentiality have formed the historical foundation for protection following unauthorized disclosure of health information.78 Courts have recognized actions under legal theories including invasion of privacy, implied breach of contract, and breach of fiduciary relationship.79 Recovery under these theories is far from assured,80 and protection under these doctrines is limited.81 Common law protections generally require a special relationship, such as a physician-patient relationship.82 This limitation is substantial because health information access is not restricted to physicians; hospitals, insurance companies, and government programs can access personal health information.83 Moreover, the existence and scope of state-level physician-patient privileges vary, and no federal privilege exists.84

3.    Shortcomings of HIPAA

Due to inconsistent state protection, the federal government recognized the need for national unity in privacy law.85 This recognition led to the enactment of the federal Health Insurance Portability and Accountability Act86 (HIPAA) in 1996.87 The HIPAA Privacy Rule88 safeguards protected health information (PHI).89 PHI is health data that can be used to identify an individual patient on some “reasonable basis.”90 Only covered entities—including healthcare plans, clearinghouses, and certain providers and their business associates—are restrained by HIPAA.91 Covered entities, however, may disclose or use PHI without the consent of the individual if used for treatment, payment, or healthcare operations.92 Such use is restricted to the information that is minimally necessary to accomplish the intended purpose of the use or disclosure.93

HIPAA continues to establish national standards for patient records,94 but it sets only a protective floor that does not displace more stringent state laws.95 Therefore, states continue to play an important role in protecting health information by imposing stricter obligations beyond those required in HIPAA.96 State-level privacy protections are important because HIPAA leaves gaps in protection as information is shared throughout the healthcare system.97 For example, HIPAA only covers a limited group of persons and organizations and does not cover employers and life insurers.98 It also does not cover third-party nonmedical social services, which may be instrumental for providing comprehensive treatment.99

Another limitation of HIPAA is that it does not provide a private right of action, which practically reduces enforcement of the statute.100 To establish a claim under HIPAA, an individual must first file a complaint to HHS.101 After receiving the complaint, HHS conducts an investigation into the allegation.102 The Secretary of HHS has complete discretion in determining whether or not to impose a civil monetary penalty or turn a case over to the Department of Justice for criminal prosecution.103 Often, HHS will “work[ ] informally with health care organizations to achieve compliance without implementing any sanctions.”104 Lack of HIPAA enforcement has led some scholars to argue that a private right of action is necessary in order to do justice to aggrieved patients.105 Typically, HHS has enforced complaints that have a wide impact before using resources to address isolated violations, leaving individual patients with little recourse.106

Recently, some state courts have determined that HIPAA can create a standard of care for health information protection, allowing HIPAA violations to form the foundation for state tort actions that can provide individual patients some relief.107 Specifically, state courts have found that HIPAA, like state laws and professional codes, can establish a standard of care under a negligence theory.108 This duty of care applies despite the fact that HIPAA does not expressly provide a private right of action.109 Such an approach can help fill gaps in privacy protection and deter noncompliance.110

While scholars see HIPAA as public recognition of the need for heightened privacy protections in the digital age,111 statutory and common law protections for information privacy continue to leave significant gaps in protection.112 Congress intended HIPAA to set a floor that balanced the needs of the individual with the needs of society,113 but the framework for this balancing remains unclear.114 The public interests in integrated care, government monitoring of prescription records, and the financial security of the healthcare system all counterbalance individual expectations of privacy.115 A standard-of-care approach may help to fill gaps in protection, but this approach has not been adopted in every jurisdiction.116

C.    Part 2: An Answer to Privacy Concerns?

Information privacy protection under constitutional, common law, and statutory provisions is fragmented and inconsistent, with gaps that are not unique to SUD.117 In the early 1970s, government actors began to show heightened concern for SUD information privacy gaps in particular due to the high degree of stigmatization that individuals with SUD face.118 This concern was piqued by problematic instances of patient methadone119 records being used in nontreatment settings, such as criminal cases.120 Disclosed SUD information also posed problems in circumstances beyond the courtroom.121 Disclosures to insurers or employers, for example, could make it difficult for patients to obtain disability or life insurance, as well as maintain employment.122

These concerns led to federal legislation that specifically protects SUD records.123 Part 2 was promulgated in 1975124 and implements § 543 of the Public Health Service Act.125 Congress intended Part 2 to ensure that a patient receiving treatment for SUD in a Part 2 program would not face adverse consequences due to treatment participation.126 Patient privacy advocates hoped to diminish the use of SUD records in criminal proceedings as well as domestic proceedings such as those related to child custody, divorce, or employment.127 Part 2 continues to “place[ ] especially stringent protections around all information that identifies patients as either having a SUD or having had a SUD in the past,” including treatment details, diagnoses, and enrollment in SUD programs.128

Importantly, Part 2 initially provided stringent privacy protections that extend beyond HIPAA’s protective floor.129 Scholars celebrated these protections as a victory for patient privacy advocates.130 Over time, however, healthcare providers began to voice concern that Part 2’s protections were incongruous with the changing face of SUD treatment models.131

D.   The Part 2 Problem

As the opioid epidemic raged on unhindered by treatment facilitation efforts, providers pushed for SUD treatment integration into general medical practice.132 When Congress enacted Part 2, and for most of Part 2’s history, standalone addiction treatment settings operated independently, with little need for communicating with external parties.133 A simple treatment center easily managed Part 2’s stringent requirements.134

Since Part 2’s enactment, however, SUD treatment’s gradual integration into mainstream medical settings has complicated SUD treatment.135 Providers have criticized Part 2 for several reasons.136 First, providers were concerned that the extra layer of protection reinforced, rather than mitigated, stigma against individuals with SUD, as was originally intended, due to the necessity of segregating SUD records from the rest of an individual’s medical history.137 Next, providers complained that the requirements hindered their ability to provide integrated care—not only did Part 2 requirements lead to significant administrative burden, but they were confusing and led to difficulty updating patient records.138 Updated records are imperative for SUD treatment due to the dangerous interactions among prescription and illicit substances, which can be especially problematic during emergency situations.139 Moreover, empirical research has shown that integrated care is critical to successful recovery from addiction.140

Overall, the burdens of Part 2 resulted in difficulty reconciling privacy protections with the modern, fluid teams that worked to meet patient needs.141 In response, the Substance Abuse and Mental Health Services Administration142 (SAMHSA) repeatedly attempted to align Part 2 with contemporary health systems.143 SAMHSA made regulatory changes to Part 2 in January 2017, January 2018,144 and August 2020, each time resulting in intense debate.145 While health providers tended to support the revisions, advocacy groups raised concerns that the changes limited patient protections.146

E.    Antidiscrimination Protections: Another Avenue for Relief

For individuals with SUD, antidiscrimination protections can serve as a supplement to fragmented, inconsistent, or otherwise limited privacy protections. Privacy and antidiscrimination laws are conceptually related.147 Protecting privacy can prevent discrimination by restricting access to the information that forms the basis of discrimination,148 and antidiscrimination law can provide protection after private information is released. Some individuals with SUD are protected from discrimination by federal disability law.149

Opioid addiction is a disability under § 504 of the Vocational Rehabilitation Act of 1973150 (Rehabilitation Act), the Americans with Disabilities Act151 (ADA), § 1557 of the Affordable Care Act152 (ACA), and §§ 3601–3619 of the Fair Housing Act.153 Disability law protects only a limited set of individuals with SUD: (1) “individuals who have successfully completed a supervised drug rehabilitation program, or are otherwise rehabilitated, and are not currently engaged in the illegal use of drugs,” (2) individuals who are participating in a supervised drug rehabilitation program and are currently not engaging in the illegal use of drugs,” and (3) “individuals who are only erroneously thought to be engaging in the illegal use of drugs.”154 Thus patients with SUD who are currently using illegal drugs, as opposed to recovering individuals who are not currently using, are not protected under existing antidiscrimination law.155

Whether the law considers an individual to be “currently using” illegal drugs depends on the circumstances.156 The House Report for the ADA clarifies that individuals with “current” abuse are individuals whose illegal use of drugs is recent enough to support a reasonable belief that the individual is presently using drugs.157 The trier of fact, therefore, is given discretion in determining whether an individual is currently using or in recovery,158 and the “current use” versus “recovery” distinction carries a significant degree of weight.159

Relatedly, federal antidiscrimination law excludes any individual with SUD who “pose[s] a direct threat to the health or safety of other individuals in the workplace.”160 Entities, such as employers, are entitled to make individualized assessments of risk based on reasonable judgement that relies on “current medical knowledge or on the best available objective evidence, to ascertain the nature, duration, and severity of the risk.”161 They can also consider “the probability that the potential injury will actually occur” and “whether reasonable modifications of policies, practices, or procedures will mitigate the risk.”162 Courts have struggled to evaluate these risks.163 Often, individuals with SUD are engaged in illegal activity, and detoxification and rehabilitation frequently require extended absence from work, making these exclusions more problematic for individuals with SUD relative to individuals with other disabilities.164

Despite these challenges, administrative agencies and courts interpreting federal disability laws have required employers to provide “reasonable accommodations” for otherwise qualified individuals.165 For example, individuals receiving medication-assisted treatment—a type of treatment using federally approved medications such as methadone, buprenorphine, and naltrexone—in theory cannot be denied protection under federal disability law on the basis of that treatment as long as they are otherwise qualified.166 Yet employers may still heavily scrutinize patients participating in medication-assisted treatment and implement drug-free workplaces that disincentivize or prohibit their employment.167 Employers may have difficulty providing accommodations because individuals that are enrolled in or have completed SUD treatment programs relapse at an unpredictable rate.168 Public employers can test employees for substance use and terminate employees who have relapsed regardless of whether they are enrolled in treatment.169 It is challenging to predict what a reasonable accommodation might entail because judges are given discretion in this determination.170

Consequently, predicting when an individual with SUD will be protected under antidiscrimination laws is complicated. Individuals with SUD who are “currently using” illegal drugs or who pose a direct threat to the health and safety of others are not protected, but there is no bright line to determine who is currently using or a direct threat. Moreover, even though employers are required to provide reasonable accommodations for otherwise qualified individuals, the high degree of judicial discretion in defining both “reasonable” and “qualified” makes determinations unpredictable.

In light of this unpredictability, both antidiscrimination and privacy laws leave individuals with SUD vulnerable to discrimination. The CARES Act, however, may offer a solution.

III.  The CARES Act Part 2 Modifications

On March 27, 2020, President Trump signed the CARES Act into law.171 Section 3321 of the CARES Act “substantially amended several sections of the Part 2 authorizing statute.”172 The statutory amendments went into effect on March 27, 2021.173 These modifications (the “CARES Act Modifications”) were prompted by the ongoing need to better situate Part 2 among advances in the healthcare system.174 Congress intended the modifications to more closely align Part 2 standards with HIPAA and allow greater flexibility for healthcare providers to share records.175 These changes are a result of the ongoing movement to facilitate information exchange while balancing the legitimate privacy concerns of patients.176 This Part examines the CARES Act Modifications in detail. It first reviews the new reduced consent requirements, then discusses the new antidiscrimination provision. It ultimately juxtaposes the consent requirements with the antidiscrimination provision and evaluates their balance of protections.

A.    Reduced Consent Requirements: A Step Back

Significantly, the CARES Act Modifications reduced previous written patient consent requirements (hereinafter referred to as the “Consent Modifications”) in § 2.31. The original Part 2 consent provision required written patient consent each time that information was shared outside the treatment facility177 —a more stringent requirement than HIPAA’s open sharing allowance among providers for treatment purposes. The Consent Modifications, however, permit a patient to give written consent “once for all [ ] future uses or disclosures for purposes of treatment, payment, and health care operations,” as permitted by HIPAA.178 The Consent Modifications coincide with recent regulatory changes to Part 2179 that allow treatment programs to disclose dispensing and prescribing data to prescription drug monitoring programs180 (commonly referred to as “PDMPs”), subject to consent and as required by state law.181

In the past, reductions in Part 2 consent requirements have sparked concern—namely, fear that records would be given to “interconnected health care systems, unknown future entities, and vendors with only one general consent and signature.”182 The harm of such disclosures lies in reduced patient control over information sharing, as information is shared with neither patient knowledge nor explicit consent.183 Widespread sharing, due to both the Consent Modifications and PDMP permission, increases the risk that SUD information will be misused.184 While HIPAA has always allowed wide data sharing, the spread of SUD data has the potential to be used in an especially pernicious manner given the considerable stigmatization surrounding SUD diagnoses.185 There is also risk of harm stemming from currently limited scrutiny over PDMP functioning, especially as the opioid crisis has resulted in the rapid expansion in number, scope, and legal authority of PDMPs.186

A particular concern in light of the Consent Modifications and wide sharing capabilities is that Part 2—like HIPAA—does not provide a private right of action.187 Until recently, penalties for Part 2 violations carried criminal fines, and individuals were required to report violations to SAMHSA and the Department of Justice.188 Federal enforcement of Part 2 was practically nonexistent.189 The CARES Act, however, aligned Part 2 penalties with the penalties under HIPAA.190 There is hope that aligning Part 2 enforcement with HIPAA enforcement will result in heightened federal scrutiny for SUD records and that this scrutiny will help to counterbalance the CARES Act Modifications that permit broad record sharing.191

B.    New Antidiscrimination Provision: A Step Forward

The new antidiscrimination provision may also help to counterbalance the Consent Modifications. As discussed above,192 Part 2 was originally enacted because lawmakers did not want to deter individuals from seeking out treatment for fear of arrest; loss of parental rights; employment discrimination; eviction from public housing; or denial of health, disability, or life insurance.193 Legislators reasoned that especially stringent protections for SUD records minimized the risk that other entities would be able to easily access personal health information and discriminate using that information.194 The CARES Act Modifications have increased the risk that health information is accessible to other entities, but this risk is counterbalanced with a new antidiscrimination provision.195 The provision prohibits discrimination by any entity on the basis of information received from SUD records for healthcare, employment, worker’s compensation, housing, and social services and benefits.196

The new, broad antidiscrimination provision in the CARES Act Modifications provides an additional avenue of protection for individuals with SUD following disclosure of treatment records. The antidiscrimination provision was included to balance out the reduced privacy protection under Part 2 following its alignment with HIPAA standards.197 Moreover, the modifications incorporate a rhetorical change from “substance abuse” to “substance use disorder” that commentators perceive as an additional effort toward combatting stigmatization.198 The impact of the antidiscrimination provision and rhetorical change remains to be seen; likely, the scope of the impact lies in the government’s enforcement.199

C.    COVID-19: Tipping the Scale

The COVID-19 pandemic has reinvigorated discourse regarding information privacy protections in the healthcare sector more broadly.200 Social distancing mandates have made access to healthcare more difficult across the board, but treatment inaccessibility is a special concern for patients with SUD.201 Without treatment continuity, the risk of relapse and withdrawal is dangerously elevated and compromises long-term treatment success.202 Social distancing increases the risk of overdose without intervention as well as difficulty accessing resources like syringe services programs.203 Increased caseload at emergency departments reduces the likelihood that SUD cases will be prioritized when making resource determinations.204

When the pandemic began to sweep the nation, federal agencies were quick to waive several rigid legal requirements that had previously acted as barriers to treatment.205 To improve treatment access during the pandemic, the Drug Enforcement Agency (DEA) temporarily suspended barriers to the use of telehealth services in providing medication-assisted treatment.206 SAMHSA increased flexibility in SUD pharmacotherapy by allowing patients to obtain a greater supply of medication doses and waiving requirements for written patient consent forms.207 Overall, the pandemic has amplified the need for integrated treatment among SUD service providers, who face real challenges in ensuring patient safety when prescribing medications to those at risk for overdose.208

Moreover, the pandemic has heightened the need for comprehensive case management for individuals with SUD, ideally with connections to housing and social services.209 SUD patients often face unstable employment, which, combined with loss of housing and food insecurity, contributes to relapse risk.210 According to some estimates, “suspected overdoses increased nationally by 18 percent, 29 percent, and 42 percent in March, April, and May 2020, respectively.”211 Experts speculate that the COVID-19 SUD treatment reforms are not sustainable solutions to the opioid crisis that has been exacerbated by the pandemic.212

IV.  Part 2 and COVID-19: Asking For Forgiveness, Not Permission

Barriers to SUD treatment, as highlighted by the pandemic, are tremendous.213 The CARES Act Modifications were intended to improve access to integrated care after an individual seeks treatment.214 The liberalization of previously stringent Part 2 privacy protections, however, has raised concern that SUD treatment information will be misused,215 and options for recovery following misuse are limited. The new Part 2 antidiscrimination provision helps temper criticism and may serve as a legislative form of balancing.216 Aligning Part 2 penalties with HIPAA penalties may increase scrutiny of Part 2 compliance, which also helps to counter privacy concerns.217

Part 2 strikes a balance, but is it enough? Part 2 is illustrative of the difficult equilibrium between individual privacy expectations and the public health interest in efficient and effective SUD treatment.218 The modifications also illustrate the potential for robust antidiscrimination protections to provide facilitate recovery following misuse of personal health information. The remainder of this Comment will address whether the CARES Act Modifications strike an adequate and sustainable balance between individual privacy interests and societal interests in public health and data aggregation. Further, it will examine the potential for alternative privacy protections to impact this balance and suggest that the pandemic may tip the scale, underscoring the need for heightened legal protections for individuals receiving SUD treatment. Last, this Comment will evaluate whether the CARES Act Modifications are sensitive to widespread stigmatization concerns and scrutinize whether the Part 2 antidiscrimination provision can close gaps in privacy protections available to individuals with SUD.

A.    Privacy Protections Are Unstable

As described above, there are currently three forms of protection for an individual’s right to information privacy: constitutional, common law, and statutory protections.219 All three are unstable and inadequate, and they share a set of similar problems. First, existing privacy protections are fragmented and leave gaps in protection.220 Second, the repeated fluctuations in the existing legal framework foster lingering doubts as to the value of privacy and the restrictions necessary to protect it.221 New statutes and court decisions can reduce common law protections,222 and legislative and regulatory protections are subject to similar instability.223 Legislation can be amended or repealed according to the whims of majoritarian public sentiment.224

It is important to critically examine the impact of public sentiment on information privacy. One problem with subjecting privacy protections to public sentiment is that, once sentiment swings against privacy, it is difficult to go back.225 In the case of SUD treatment records, once information is shared across facilities, it may be difficult for patients to regain control over that information in the future. The rapid pace of PDMP emergence, coupled with the recent PDMP permission in Part 2, additionally increases the risk that information spread will get out of hand.226 Should an individual with SUD wish to revoke consent for data sharing, which is allowed under Part 2,227 it is unclear how far revocation extends. It is possible, and perhaps likely, that revoked consent only prohibits future sharing; previously shared information, whether to healthcare facilities, insurers, or PDMPs, is a sunk cost.

Of course, statute-based protections can attempt to implement or recalibrate the balance that courts have struck in applying privacy protections.228 Legislative balancing, however, is fraught with problems. While the federal government might appear to be a logical source of privacy protection, it is also among the greatest collectors of information.229 There is a strong argument that, wherever the government can collect more information than it needs or wrongfully disclose information, individuals must have protection from the government itself.230 There is a balance in preserving the government’s ability to be efficient while also protecting individual privacy interests. The inherent conflict, however, between the government as a protector and as a collector of personal information casts doubt on the efficacy of relying on state and federal legislatures to protect individual information privacy interests.231

In the context of SUD treatment records, the government has a robust interest in gaining access to personal information: Not only is information sharing a vital part of integrated care, but aggregated treatment information in the form of state PDMPs is considered a valuable part of combatting the opioid epidemic.232 Yet there is little evidence that PDMPs actually promote public health.233 In light of law enforcement access to PDMP records, scholars have argued that PDMPs exacerbate, rather than mitigate, overdose rates.234 Scholars are critical of the public-health-facing frame surrounding PDMPs and have suggested that PDMPs are “criminal and regulatory surveillance tools dressed up in public-health-promoting rhetoric.”235 It remains unclear, therefore, whether the legislative balancing of individual privacy protections and public health interests in the CARES Act Modifications is sufficient to protect individuals with SUD from privacy violations.

Problematic legislative balancing means that courts have a critical role in protecting patient privacy. Courts can, and should, reduce ambiguity and gaps in privacy protections.236 There are two avenues for court action: constitutional interpretation and common law development. There is no clear-cut standard, however, to evaluate whether privacy protections are adequate.237 The Ninth Circuit, for example, recognizes no minimum standard for alleging an infringement of one’s information privacy rights.238 If the Supreme Court were to interpret Whalen to establish a constitutional right to information privacy, arguably inadequate Part 2 balancing might be rectified using a unified standard to evaluate the strength of privacy protections.

B.    A Constitutional Right to Information Privacy is Unlikely to Be Helpful

The Supreme Court has declined to explicitly declare a right to information privacy following Whalen, despite having several chances to clarify whether such a right exists.239 Moreover, circuit courts are inconsistent in interpreting Whalen—while some circuits unequivocally affirm the right to information privacy, others do so only in certain circumstances.240 Circuits also evaluate the right in different ways.241 Circuit balancing tests demonstrate how susceptible a fundamental right to information privacy may be in instances of strong societal interests.242

In light of the ongoing opioid epidemic, balancing tests are problematic for patient privacy advocates. Privacy advocates have generally struggled to successfully argue that individual privacy interests outweigh the public interest in electronic databases, such as PDMPs, that (at least ostensibly) serve a public health function.243 Of course, a constitutional right to information privacy might help close gaps in existing privacy protections available to individuals with SUD.244 However, to truly close these gaps, courts would need to be willing to find that individual privacy rights outweigh societal interest in treatment information.245 Thus far, courts have typically failed to do so.246 It is unclear, therefore, what functional value a right to information privacy would have to individuals with SUD; if such a right exists but no plaintiff is able to benefit using it, the right is inadequate.247 There is little value in recognizing a right that no court upholds in practice.248

There is a plausible argument that the treatment-deterrent effect of inadequate privacy protections is a matter of societal interest that cuts against the strong public need for access,249 but Whalen is instructive here. In Whalen, the Court recognized that the prescription monitoring file would potentially deter some patients from treatment.250 The Court still found that the individual privacy interest was not violated251 and denied that the physician-patient relationship was violated by mandated disclosure.252 Whalen exemplifies judicial balancing of the public interest with individual privacy concerns in the prescription monitoring context,253 and patient privacy advocates will likely struggle to circumvent Whalen in similar situations.

C.    A Part 2 Standard of Care Is Only a Limited Solution

While constitutional protection seems to be an unlikely option for sustainable privacy protection for individuals with SUD, it is possible that courts can use Part 2, like HIPAA, to establish a standard of care. In cases recognizing a HIPAA-based standard of care,254 courts have determined that, to the extent that HIPAA has become common practice for healthcare providers to follow in rendering services to patients, it may be utilized to inform the standard of care for negligence claims.255

As Part 2 becomes more closely aligned with HIPAA, it is difficult to argue that Part 2 cannot establish a similar foundation for a standard of care. While courts are firm that Part 2 does not establish an explicit or implicit private right of action,256 there is no case law to suggest Part 2 cannot establish a standard of care similar to HIPAA. Case law addressing Part 2 requirements is limited; most Part 2 cases merely address Part 2’s role as an evidentiary barrier rather than as a mechanism for compliance.257 The dearth of case law addressing Part 2, and the strong legislative push to align Part 2 with HIPAA, suggest that a standard of care argument is likely to be well-received, or at least, is not incongruous with precedent. If given the opportunity, courts should determine that a standard of care is applicable in state negligence claims using Part 2 as a guidepost. Such a standard could help to close privacy gaps for those with SUD.

D.   Antidiscrimination Protections May Provide the Most Sustainable Solution

So far, this Comment has outlined the ways in which privacy law is problematic in the context of SUD records. Privacy protection is not only fragmented and unstable but also unpredictable, given the strong countervailing public interests. A constitutional right to information privacy, while compelling as an avenue for filling privacy gaps, is inadequate in light of robust, competing public interests. A Part 2 standard of care is also compelling but not yet developed in case law; regardless, it is likely to be limited. Strong antidiscrimination protections, however, may provide a solution to this problem. Where privacy protections are weakened in the CARES Act Modifications, the new antidiscrimination provision, as well as existing antidiscrimination protections, can pick up the slack.

As discussed above,258 privacy laws and antidiscrimination laws are related—both can protect individuals against the negative effects of shared personal information.259 Privacy protections may be preferable because they operate earlier in the process of discrimination by impeding access to personal information.260 Legislators and judges, however, often hesitate to provide relief for invasions of privacy without evidence of a tangible harm.261 In instances of purely dignitary harm, antidiscrimination law may assist privacy law.262 Further, scholars have suggested that judges are more likely to enforce a privacy protection that is linked to an antidiscrimination initiative; antidiscrimination law can increase the reach of privacy law by providing an additional justification for legal intervention.263

Moreover, while public interest in access to SUD records may reduce the likelihood of recovery for invasions of information privacy, public health interests are not balanced in antidiscrimination protections. Put another way, an individual is protected under antidiscrimination law regardless of the public interests involved. As the opioid epidemic continues and the COVID-19 pandemic leads to treatment accessibility barriers, it is likely that the public interest in access to SUD records will only intensify, which may result in weaker protections for individual privacy.264 Increasingly, the government may be asking for forgiveness, not permission, when gaining access to personal health information.

Antidiscrimination law is not free from problems as a protective mechanism. Critics will counter that the nature of discrimination is changing. When antidiscrimination laws were originally passed, overt, intentional exclusion was the dominant form of discrimination rather than the subtle, cumulative exclusion prevalent today.265 Modern antidiscrimination law is inadequate when it requires that plaintiffs demonstrate intent to discriminate or when it ignores smaller, more subtle manifestations of discrimination.266 Because privacy violations do not require a showing of intent, privacy law may provide an easier avenue for recovery than antidiscrimination protections.267

The calculus is different in the context of SUD records. Individuals with SUD are protected under disability law, and there is no consensus that disability law requires a showing of intent to recover on a discrimination claim.268 While courts may require proof of intent before allowing recovery, intent is not necessary for reasonable accommodation cases according to both the statutory text and legislative history.269 The reasonable accommodations requirement makes disability law distinct from other forms of antidiscrimination law.270 The requirement also makes disability law more amenable to disparate impact claims, which are claims that define discrimination in terms of disparate consequence rather than purpose and motive.271 Courts should focus on whether or not reasonable accommodations were provided, rather than discriminatory intent, in determining whether an individual can recover for discrimination based on SUD records. Further, in the event that intent is required, courts should show heightened sensitivity to more subtle, systemic displays of discrimination when evaluating whether the plaintiff has offered sufficient evidence to show discriminatory intent.272

Moreover, existing antidiscrimination protections are inadequate to protect individuals with SUD from harm because they are not protective during the entire rehabilitation process. Specifically, existing antidiscrimination laws do not deal with the complicated issue of relapse in accord with scientific understanding, especially with regard to current users, who are excluded from federal antidiscrimination protections.273

It is notable that current use is excluded from protection because individuals recovering from chronic addiction are at high risk for relapse, and courts often consider relapse to be current use.274 Empirical studies and modern medical understanding, however, indicate that relapse is “an expected part of recovery from SUD,” rather than an indication of recovery failure.275 The CARES Act antidiscrimination provision, although it does not explicitly protect current users or those using medication-assisted treatment,276 has the potential to change such exclusion.

The most reasonable interpretation of the CARES Act antidiscrimination provision is that it protects current users. The provision reads: “No entity shall discriminate against an individual on the basis of information received by such entity pursuant to an inadvertent or intentional disclosure of records, or information contained in records.”277 Current illegal substance use, relapse-related or otherwise, would certainly be indicated in the “information contained in records” that are protected under Part 2.278 Moreover, as Professors Dineen and Pendo propose, the definition of “individual” suggests that the statutory text of the CARES Act antidiscrimination standard does not exclude current users.279 Notably, Dineen and Pendo emphasize that the drafters were aware of exclusion under existing laws and could have incorporated similarly exclusive language in the CARES Act Modifications.280 They also postulate that the decision to protect current users is consistent with the purpose of the CARES Act Modifications: to remove fear of discrimination with treatment.281 If Part 2 protects current users from discrimination on the basis of SUD records, such protection could go a long way toward combatting widespread discrimination against individuals with SUD.

Part 2 can, and should, be used to expand antidiscrimination protection to current users, but more needs to be done to strengthen existing protections. Courts can play a vital role in expanding these protections by broadly interpreting existing antidiscrimination laws and providing evidence-based leeway in interpreting the “currently using” language to give relapsing individuals space to recover. For example, courts should be aware of high relapse risk and work to use objective, evidence-based, and individualized factors to determine whether a recovering individual is a direct threat to the safety of others. Courts should carefully evaluate each circumstance and avoid generalizing across cases using stereotypes or assumptions. Legislative history and interpretive guidance suggest that a bright-line rule would be inappropriate for this determination.282 While a bright-line rule, such as a timing-based trigger for antidiscrimination protection, would ease application and predictability of disability law in SUD cases,283 such a rule would be out of touch with medical understanding, which suggests that recovery is an individualized process that is highly dependent on an individual’s support network and other circumstantial factors.

V.    Conclusion

The CARES Act Modifications reduce the stringent privacy protections available to individuals with SUD, just as the COVID-19 pandemic has highlighted problematic barriers to treatment and services. The CARES Act Modifications also include a notable antidiscrimination provision, which may help to counterbalance the reductions in privacy protections. The Part 2 antidiscrimination provision can easily be interpreted to expand protection to current users of illegal substances, who until now were unable to find protection under existing antidiscrimination law.

While the Part 2 provision can go a long way to protecting individuals with SUD, stigmatization and discrimination against individuals with SUD remain prevalent, and more needs to be done. A constitutional right to information privacy, while appealing, is unlikely to be helpful in filling gaps in privacy protection for individuals with SUD due to the strong public interest in integrated care and governmental monitoring of prescription records. Further, a private right of action under Part 2 may help to fill protection gaps but is likely to be limited and has not yet been developed in case law. As the pandemic demonstrates, treatment discontinuity can be devastating to recovering individuals.284 The CARES Act Modifications exemplify legislative recognition of treatment and administrative barriers, difficulty providing integrated care, and fear of discrimination. Courts should expand existing antidiscrimination protections to provide ready accommodation for relapse in recovering individuals. Antidiscrimination protections are the most sustainable solution to the SUD privacy problem as the government increasingly asks for forgiveness, not permission, when accessing private SUD treatment records.

• 1See Emma Goldberg, “Relapsing Left and Right”: Trying to Overcome Addiction in a Pandemic, N.Y. Times (Jan. 4, 2021), https://www.nytimes.com/2021/01/04/nyregion/addiction-treatment-coronavirus-new-york-new-jersey.html [https://perma.cc/CHK8-X2JD] (explaining that feelings of loneliness can exacerbate relapse risk in individuals suffering from addiction).
• 2Michael P. Botticelli & Howard K. Koh, Changing the Language of Addiction, 316 JAMA 1361, 1361 (2016) (explaining why terms such as “substance use disorder,” rather than “addiction,” are important in fighting stigmatization and encouraging treatment).
• 3See Jian-feng Liu & Jun-xu Li, Drug Addiction: A Curable Mental Disorder?, 39 Acta Pharmacologica Sinica 1823, 1823 (2018).
• 4Quan Qiu Wang et al., COVID-19 Risk and Outcomes in Patients with Substance Use Disorders: Analyses from Electronic Health Records in the United States, 26 Molecular Psychiatry 30, 35 (2020).
• 5Leslie Francis, Illegal Substance Abuse and Protection from Discrimination in Housing and Employment: Reversing the Exclusion of Illegal Substance Abuse as a Disability, 2019 Utah L. Rev. 891, 892 (2019) (noting that housing and employment are important factors in recovery for individuals with SUD).
• 6See generally Ashley Monzel, The Hydra Paradox of the Opioid Epidemic: Why Supply-Side Responses Will Fuel Rather Than Curb the Opioid Epidemic, 28 Elder L.J. 145, 163 (2020).
• 7Charise R. Frazier & Patricia Connelly, The Tide is Changing: Behavioral Health and Primary Care Integration Challenges with 42 CFR Part 2 Compliance, 22 J. Health Care Compliance 41, 41 (2020).
• 8See, e.g., Nicolas Terry, Perspectives on the Opioid Overdose Epidemic, 45 Hum. Rts. Mag. 22, 22 (2020).
• 9Pub. L. No. 116-136, 134 Stat. 281 (codified at 15 U.S.C. §§ 9001–9080) (2020).
• 10Frazier & Connelly, supra note  NOTEREF _Ref58940276 \h  \* MERGEFORMAT 708D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340030003200370036000000, at 42.
• 1142 C.F.R. §§ 2.1–2.67 (2017).
• 12“Part 2” is the commonly-used shorthand for the “42 C.F.R. §§ 2.1–2.67” regulations. Experts, legislators, and providers use the “Part 2” terminology when referencing the regulations. See, e.g., Substance Abuse Confidentiality Regulations, Substance Abuse & Mental Health Servs. Admin. (Sept. 18, 2020), https://www.samhsa.gov/about-us/who-we-are/laws-regulations‌/confidentiality-regulations-faqs [https://perma.cc/WG92-Y4H6].
• 13See 42 U.S.C. § 290dd-2(b)(1).
• 14See 42 U.S.C. § 290dd-2(i).
• 15Aimee N. C. Campbell et al., Interpretation and Integration of the Federal Substance Use Privacy Protection Rule in Integrated Health Systems: A Qualitative Analysis, 97 J. Substance Abuse Treatment 41, 43 (2019).
• 16See Botticelli & Koh, supra note  NOTEREF _Ref58940636 \h 208D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340030003600330036000000, at 1361.
• 17Monzel, supra note  NOTEREF _Ref59000817 \h  \* MERGEFORMAT 608D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003000300030003800310037000000, at 146. These deaths were not limited to prescription opioid use––heroin and other illicit opioids contributed to these deaths. Id.
• 18Melissa A. Soliz, Don’t Let Privacy Protections Be the Enemy of Good: How Privacy Laws Are Stymieing Efforts to Most Effectively Treat Substance Use Disorders and Combat the Opioid Epidemic, 21 J. Health Care Compliance 13, 13 (2019).
• 19Preventable Deaths: Odds of Dying, Nat’l Safety Council: Inj. Facts, https://injuryfacts.nsc.org/all-injuries/preventable-death-overview/odds-of-dying/ [https://perma.cc/JVS8-CRAZ] (last accessed Dec. 11, 2020).
• 20Jennifer D. Oliva, Policing Opioid Use Disorder in a Pandemic, U. Chi. L. Rev. Online 90, 91 (2020).
• 21Id.
• 22See generally Dennis McCarty et al., Treatment and Prevention of Opioid Use Disorder: Challenges and Opportunities, 39 Ann. Rev. Pub. Health 525 (2018).
• 23Am. Psychiatric Ass’n, Diagnostic and Statistical Manual of Mental Disorders (5th ed. 2013).
• 24Off. of the Surgeon Gen., U.S. Dep’t of Health & Hum. Servs., Facing Addiction in America: The Surgeon General’s Report on Alcohol, Drugs, and Health 1-16 (2016) (ebook).
• 25Id. at 1-6 to 1-16.
• 26Liu & Li, supra note  NOTEREF _Ref58940425 \h  \* MERGEFORMAT 308D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340030003400320035000000, at 1823–27 (suggesting pharmacological interventions, brain stimulation, and behavioral treatment methods as potential therapies for SUD).
• 27Id. at 1823.
• 28Botticelli & Koh, supra note  NOTEREF _Ref58940636 \h  \* MERGEFORMAT 208D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340030003600330036000000, at 1361.
• 29Off. of the Surgeon Gen., U.S. Dep’t of Health & Hum. Servs., supra note  NOTEREF _Ref59111373 \h  \* MERGEFORMAT 2408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003100310031003300370033000000, at 7-7, 7-8.
• 30Botticelli & Koh, supra note  NOTEREF _Ref58940636 \h  \* MERGEFORMAT 208D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340030003600330036000000, at 1361.
• 31Lipi Roy, Addiction Treatment Facilities: Are They Prepared for the COVID-19 Coronavirus Outbreak?, Forbes (Mar. 16, 2020), https://www.forbes.com/sites/lipiroy‌/2020/03/16‌/addiction-treatment-facilities-are-they-prepared-for-covid-19/?sh=3591453344ea [https://perma.cc/N92J-BSNL].
• 32Off. of the Surgeon Gen., U.S. Dep’t of Health & Hum, Servs., supra note  NOTEREF _Ref59111373 \h  \* MERGEFORMAT 2408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003100310031003300370033000000, at 1-8.
• 33Id. at 1-20.
• 34Id. at 4-3.
• 35Id. at 1-18.
• 36Id. at 1-19.
• 37See id.
• 38Id. at 1-20.
• 39See generally Elizabeth M. Stone et al., The Role of Stigma in U.S. Primary Care Physicians’ Treatment of Opioid Use Disorder, 221 Drug & Alcohol Dependence 1 (2021) (surveying primary care provider attitudes toward opioid use disorder and finding that higher stigmatizing attitudes among providers were correlated with a lower rates of prescribing medication-assisted treatment and lower levels of support for treatment access policies); Kathleen A. Crapanzano et al., The Association Between Perceived Stigma and Substance Use Disorder Treatment Outcomes: A Review, 10 Substance Abuse & Rehab. 1 (2019) (discussing the relationship between self-stigma, healthcare provider stigma, and perceived social stigma).
• 40Botticelli & Koh, supra note  NOTEREF _Ref58940636 \h  \* MERGEFORMAT 208D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340030003600330036000000, at 1362 (citing the Mental Health Parity and Addiction Equity Act of 2008 and Affordable Care Act as examples of recent efforts to promote treatment accessibility).
• 41See, e.g., Claire E. Blevins et al., Gaps in the Substance Use Disorder Treatment Referral Process: Provider Perceptions, 12 J. Addiction Med. 273, 279 (2018).
• 42Kimberly Goodyear et al., Opioid Use and Stigma: The Role of Gender, Language and Precipitating Events, 185 Drug & Alcohol Dependence 339, 441 (2018).
• 43Id.
• 44Off. of the Surgeon Gen., U.S. Dep’t of Health & Hum. Servs., supra note  NOTEREF _Ref59111373 \h  \* MERGEFORMAT 2408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003100310031003300370033000000, at 6-33.
• 45Id.
• 46Lauren Newman, Keep Your Friends Close and Your Medical Records Closer: Defining the Extent to Which a Constitutional Right to Informational Privacy Protects Medical Records, 32 J.L. & Health 1, 4 (2019). The Fourth Amendment protects against unreasonable search and seizures, which provides some privacy protection. See, e.g., Katz v. United States, 389 U.S. 347, 351 (1961) (“What a person knowingly exposes to the public . . . is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.” (internal citations omitted)). The Fourth Amendment, however, is not the constitutional provision that courts generally interpret to support a right to information privacy.
• 47Natalie M. Banta, Death and Privacy in the Digital Age, 94 N.C. L. Rev. 927, 939 (2016).
• 48381 U.S. 479 (1965).
• 49Id. at 484.
• 50See Roe v. Wade, 410 U.S. 113, 152 (1973).
• 51429 U.S. 589 (1977).
• 52Id.
• 53Id. at 591.
• 54Id. at 592. Prescription records included information such as the prescribing physician, dispensing pharmacy, drug, dosage, and patient name, address, and age. Id. at 593.
• 55Id. at 595.
• 56Id. at 596 n.16.
• 57Id.
• 58Id. at 594–95.
• 59Id. at 598.
• 60Id. at 602.
• 61Id.; see also id. at 602 n.29 (comparing the requirements to similar requirements in instances of venereal disease, child abuse, injuries by deadly weapons, and certifications of fetal death).
• 62See, e.g., Christopher R. Smith, Somebody’s Watching Me: Protecting Patient Privacy in Prescription Health Information, 36 Vt. L. Rev. 931, 953 (2012) (using Whalen as a scaffold to discuss modern discourse regarding privacy in healthcare).
• 63Whalen, 429 U.S. at 598–600. In particular, the Court determined that any such right to privacy would come from the “liberty interest” prong of the Fourteenth Amendment. Larry J. Pittman, The Elusive Constitutional Right to Informational Privacy, 19 Nev. L.J. 135, 150 (2018).
• 64See, e.g., Nat’l Aeronautics & Space Admin. v. Nelson, 562 U.S. 134, 156 (2011) (discussing Whalen and the similarities to the case at issue with regard to information privacy interests); see also Nixon v. Adm’r of Gen. Servs., 433 U.S. 425, 457 (1977) (discussing the “individual interest in avoiding disclosure of personal matters” (quoting Whalen, 429 U.S. at 599)).
• 65Smith, supra note  NOTEREF _Ref58941051 \h 6208D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340031003000350031000000, at 953.
• 66433 U.S. 425 (1977).
• 67Id. at 457–58.
• 68562 U.S. 134 (2011).
• 69See id. at 154.
• 70Jessica C. Wilson, Note, Protecting Privacy Absent a Constitutional Right: A Plausible Solution to Safeguarding Medical Records, 85 Wash. U. L. Rev. 653, 660 (2007).
• 71Am. Fed’n of Gov’t Emps. v. Dep’t of Hous. & Urb. Dev., 118 F.3d 786, 793 (D.C. Cir. 1997) (declining to “enter the fray” by concluding that the “supposed right” of information privacy exists”).
• 72Newman, supra note  NOTEREF _Ref59113640 \h  \* MERGEFORMAT 4608D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003100310033003600340030000000, at 5; see also, e.g., Kenny v. Bartman, No. 16-2152, 2017 WL 3613601, at *6 (6th Cir. May 19, 2017); Coons v. Lew, 762 F.3d 891, 900 (9th Cir. 2014); Chasensky v. Walker, 740 F.3d 1088, 1095–96 (7th Cir. 2014); Douglas v. Dobbs, 419 F.3d 1097, 1101 (10th Cir. 2005); Doe v. City of New York, 15 F.3d 264, 267 (2d Cir. 1994); Alexander v. Peffer, 993 F.2d 1348, 1349–50 (8th Cir. 1993); Walls v. City of Petersburg, 895 F.2d 188, 192 (4th Cir. 1990); Daury v. Smith, 842 F.2d 9, 13 (1st Cir. 1988); Hester v. Milledgeville, 777 F.2d 1492, 1497 (11th Cir. 1985); Fadjo v. Coon, 633 F.2d 1172, 1175 (5th Cir. 1981); United States v. Westinghouse Elec. Corp., 638 F.2d 570, 577 (3d Cir. 1980); cf. Dillard v. O’Kelley, 961 F.3d 1048, 1055 (8th Cir. 2020), cert. denied, No. 20-670, 2021 WL 78198 (U.S. Jan. 11, 2021) (emphasizing the “uncertain status of the right to informational privacy” and determining that “[i]f a right does not clearly exist, it cannot be clearly established”).
• 73Newman, supra note  NOTEREF _Ref59113640 \h  \* MERGEFORMAT 4608D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003100310033003600340030000000, at 5.
• 74Id. at 7.
• 75Michael J. Saks et al., Granular Patient Control of Personal Health Information: Federal and State Law Considerations, 58 Jurimetrics J. 411, 417 (2018) (discussing the “network of federal and state statutes and regulations” that have “added substantially to the protections against disclosure of patient health records”).
• 76Id.
• 77Joy L. Pritts, Altered States: State Health Privacy Laws and the Impact of the Federal Health Privacy Rule, 2 Yale J. Health Pol’y L. & Ethics 327, 327 (2002).
• 78Saks et al., supra note  NOTEREF _Ref78380533 \h 7508D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370038003300380030003500330033000000, at 416.
• 79Pritts, supra note  NOTEREF _Ref58950502 \h 7708D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900350030003500300032000000, at 330–31.
• 80Id. at 331.
• 81Grace-Marie Mowery, Comment, A Patient’s Right of Privacy in Computerized Pharmacy Records, 66 U. Cin. L. Rev. 697, 714 (1998).
• 82Id.
• 83Id. at 715.
• 84Jenna Phipps, State of Confusion: The HIPAA Privacy Rule and State Physician-Patient Privilege Laws in Federal Question Cases, 12 Suffolk J. Trial & App. Advoc. 159, 159 (2007).
• 85See id.
• 86Pub. L. No. 104-191, 110 Stat. 1936 (1996).
• 87Phipps, supra note  NOTEREF _Ref58941228 \h 8408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340031003200320038000000, at 161.
• 88Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462 (Dec. 28, 2000) (codified at 45 C.F.R. §§ 160, 164).
• 89Id.
• 90Frank Qin, The Debilitating Scope of Care Coordination Under HIPAA, 98 N.C. L. Rev. 1395, 1406 (2020).
• 9145 C.F.R. § 160.103 (2019).
• 92Qin, supra note  NOTEREF _Ref62678431 \h 9008D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600360032003600370038003400330031000000, at 1408.
• 93Id. at 1408–09.
• 94Elizabeth Schaper et al., Substance Use Disorder Patient Privacy and Comprehensive Care in Integrated Health Care Settings, 13 Psych. Servs. 105, 106 (2016).
• 95Saks et al., supra note  NOTEREF _Ref78380533 \h 7508D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370038003300380030003500330033000000, at 417.
• 96Pritts, supra note  NOTEREF _Ref58950502 \h 7708D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900350030003500300032000000, at 341.
• 97Id. at 343.
• 98Id. at 344.
• 99Qin, supra note  NOTEREF _Ref62678431 \h  \* MERGEFORMAT 9008D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600360032003600370038003400330031000000, at 1443.
• 100Pritts, supra note  NOTEREF _Ref77670263 \h 7908D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370037003600370030003200360033000000, at 344. Federal courts have also declined to interpret an implied private right of action in the absence of an explicit right. Jack Brill, Note, Giving HIPAA Enforcement Room to Grow: Why There Should Not (Yet) Be a Private Cause of Action, 83 Notre Dame L. Rev. 2105, 2120 (2008).
• 101Brill, supra note  NOTEREF _Ref59020400 \h 10008D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003000320030003400300030000000, at 2115–16.
• 102Id. at 2116.
• 103Id. at 2106.
• 104Id.
• 105Id. But see Roger Hsieh, Improving HIPAA Enforcement and Protecting Patient Privacy in a Digital Healthcare Environment, 46 Loy. U. Chi. L. J. 175, 215–218 (2014).
• 106Pritts, supra note  NOTEREF _Ref58950502 \h  \* MERGEFORMAT 7708D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900350030003500300032000000, at 344; see also Austin Rutherford, Byrne: Closing the Gap Between HIPAA and Patient Privacy, 53 San Diego L. Rev. 201, 210 (2016) (emphasizing that even when sanctions are imposed, individuals receive no portion of the penalty).
• 107See id. at 203–04.
• 108Evan M. Wooten, The State of Data-Breach Litigation and Enforcement: Before the 2013 Mega Breaches and Beyond, 24 Competition: J. Antitrust & Unfair Competition L. Section St. Bar Cal. 229, 239–40 (2015).
• 109Id. at 240.
• 110Rutherford, supra note  NOTEREF _Ref59020442 \h 10608D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003000320030003400340032000000, at 204.
• 111See, e.g., Phipps, supra note  NOTEREF _Ref58941228 \h 8408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340031003200320038000000, at 176.
• 112See Wendy K. Mariner, Reconsidering Constitutional Protection for Health Information Privacy, 18 U. Pa. J. Const. L. 975, 995 (2016) (“Statutory and common law protections for patient information remain patchy.”).
• 113Stacey A. Tovino, A Timely Right to Privacy, 104 Iowa L. Rev. 1361, 1369 (2019).
• 114Lawrence O. Gostin & James G. Hodge, Jr., Personal Privacy and Common Goods: A Framework for Balancing Under the National Health Information Privacy Rule, 86 Minn. L. Rev. 1439, 1441–47 (2002) (suggesting that, more often than not, policymakers attempt to reach a balance through ad hoc considerations).
• 115See Joshua D.W. Collins, Note, Toothless HIPAA: Searching for a Private Right of Action to Remedy Privacy Rule Violations, 60 Vand. L. Rev. 199, 233 (2007).
• 116Rutherford, supra note  NOTEREF _Ref59020442 \h 10608D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003000320030003400340032000000, at 216–17.
• 117Id.
• 118Off. of the Surgeon Gen., U.S. Dep’t of Health & Hum. Servs., supra note  NOTEREF _Ref59111373 \h 2408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003100310031003300370033000000, at 6-33; see also Schaper et al., supra note  NOTEREF _Ref77670465 \h  \* MERGEFORMAT 9408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370037003600370030003400360035000000, at 106. Part 2 predates HIPAA, which was enacted in 1996.
• 119Methadone is a drug that is used as part of treatment programs for addiction to heroin or opioids. See Methadone, WebMD, https://www.webmd.com/mental-health/addiction/what-is-methadone#1 [https://perma.cc/EAS2-YHS2] (last accessed Aug. 6, 2021).
• 120Off. of the Surgeon Gen., U.S. Dep’t of Health & Hum. Servs., supra note  NOTEREF _Ref59111373 \h  \* MERGEFORMAT 2408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003100310031003300370033000000, at 6-33.
• 121Id. at 6-34.
• 122Id.
• 123Off. of the Nat’l Coordinator for Health Info. Tech., Substance Abuse & Mental Health Servs. Admin., Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data?, https://www.samhsa.gov/sites/default/files/how-do-i-exchange-part2.pdf [https://perma.cc/YK4G-EQ8N] (last accessed Aug. 6, 2021); see also 42 U.S.C. § 290dd-2.
• 124Off. of the Nat’l Coordinator for Health Info. Tech., supra note  NOTEREF _Ref58945812 \h  \* MERGEFORMAT 12308D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340035003800310032000000; see also 42 U.S.C. § 290dd-2.
• 12542 U.S.C. § 290dd-2.
• 126Schaper et al., supra note  NOTEREF _Ref77670465 \h  \* MERGEFORMAT 9408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370037003600370030003400360035000000, at 106 (“Lawmakers wanted to ensure that individuals in need of SUD treatment would not avoid treatment for fear of arrest; loss of parental rights; employment discrimination; eviction from public housing; or denial of health, disability, or life insurance.”).
• 127Id.
• 128Id.
• 129See Soliz, supra note  NOTEREF _Ref74765691 \h 1808D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370034003700360035003600390031000000, at 14.
• 130See, e.g., Heather Baroni et al., Between a Rock and a Hard Place: Balancing 42 C.F.R. Part 2 with Daily Healthcare Operations, 31 Health L. 1, 3–4 (2018).
• 131See Nicolas Terry et al., COVID-19: Substance Use Disorder, Privacy, and the CARES Act, Health Affs. Blog (June 8, 2020), https://www.healthaffairs.org‌/do/10.1377‌/hblog20200605.571907/ [https://perma.cc/9DRL-UBQ3].
• 132See Campbell, supra note  NOTEREF _Ref58940392 \h  \* MERGEFORMAT 1508D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340030003300390032000000, at 42.
• 133Id.
• 134Id.
• 135Id. at 42–43.
• 136Schaper et al., supra note  NOTEREF _Ref77670465 \h 9408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370037003600370030003400360035000000, at 107.
• 137Id.
• 138Id.
• 139Id. (noting that, for example, if a provider is unaware that a patient is undergoing medication-assisted treatment, that physician may prescribe a medication that interacts with the opioid-dependence medication, increasing the risk of side effects).
• 140See, e.g., Caroline Carney, The Importance of Integrated Care in Fighting Opioid Use Disorder, AJMC (May 18, 2018), www.ajmc.com/contributor/caroline-carney/2018/05/the-importance-of-integrated-care-in-fighting-opioid-addiction [https://perma.cc/E82M-KAMA].
• 141Confidentiality of Substance Use Disorder Patient Records, 85 Fed. Reg. 42,986, 43,002 (July 15, 2020).
• 142SAMHSA is an agency within HHS that advances public health efforts to reduce the impact of substance use-related disorders and mental illness. See About Us, Substance Abuse & Mental Health Servs. Admin., https://www.samhsa.gov/about-us [https://perma.cc/LN2C-ARF9].
• 143Campbell, supra note  NOTEREF _Ref58940392 \h  \* MERGEFORMAT 1508D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340030003300390032000000, at 43.
• 144Id.
• 145See Confidentiality of Substance Use Disorder Patient Records, 85 Fed. Reg. 42,986, 42,987 (July 15, 2020).
• 146Campbell, supra note  NOTEREF _Ref58940392 \h  \* MERGEFORMAT 1508D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340030003300390032000000, at 43.
• 147See Jessica L. Roberts, Protecting Privacy to Prevent Discrimination, 56 Wm. & Mary L. Rev. 2097, 2097 (2015).
• 148Id.
• 149Off. for C.R., U.S. Dep’t of Health & Hum. Servs., Fact Sheet: Drug Addiction and Federal Disability Rights Laws (Oct. 25, 2018), https://www.hhs.gov/sites/default/files/drug-addiction-aand-federal-disability-rights-laws-fact-sheet.pdf [https://perma.cc/L6PU-859S].
• 15029 U.S.C. § 791 (1973).
• 15142 U.S.C. § 12101 (1992).
• 152Pub. L. No. 111-148, 124 Stat. 119 (2010) (codified as amended at 42 U.S.C. § 18001).
• 15342 U.S.C. § 3601 (1968).
• 154Off. for C.R., U.S. Dep’t of Health & Hum. Servs., supra note  NOTEREF _Ref58945926 \h 14908D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340035003900320036000000.
• 155Off. of the Surgeon Gen., U.S. Dep’t of Health & Hum. Servs., supra note  NOTEREF _Ref59111373 \h 2408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003100310031003300370033000000, at 6-34. But see Off. for C.R., U.S. Dep’t of Health & Hum. Servs., supra note  NOTEREF _Ref58945926 \h 14908D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340035003900320036000000 (noting that current illegal use of drugs is not grounds for denial of health services).
• 156U.S. Comm’n on C.R., Sharing the Dream: Is the ADA Accommodating All?, ch. 4 (Oct. 2000), https://www.usccr.gov/pubs/ada/main.htm [https://perma.cc/YM2M-H9DP] (ebook) (“There is insufficient law on the issue right now and it is causing great difficulty for employers to determine exactly when they may take discipline against an employee.” (internal quotation marks omitted)).
• 157See H.R. Rep. No. 101-596, at 64 (1990) (Conf. Rep.), as reprinted in 1990 U.S.C.C.A.N. 565, 573.
• 158See U.S. Comm’n on C.R., Sharing the Dream: Is the ADA Accommodating All?, supra note  NOTEREF _Ref58945862 \h 15608D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340035003800360032000000; see also Elie G. Aoun & Paul S. Appelbaum, Ten Years After the ADA Amendment Act (2008): The Relationship Between ADA Employment Discrimination and Substance Use Disorders, 70 Psychiatric Servs. 596, 601 (2019) (noting that some courts consider the “duration of abstinence, the potential impact of substance use on work performance, and the nature of the job”).
• 159See Off. for C.R., U.S. Dep’t of Health & Hum. Servs., supra note  NOTEREF _Ref58945926 \h 14908D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340035003900320036000000.
• 160See, e.g., 42 U.S.C. § 12113(b).
• 161Ctr. for Substance Abuse Treatment, Treatment Improvement Protocol Series 38, Integrating Substance Abuse Treatment and Vocational Services 121 (2000) (citation omitted).
• 162Id. (quotation mark and citation omitted).
• 163See Anne Robbins, Note, Employment Discrimination Against Substance Abusers: The Federal Response, 33 B.C. L. Rev. 155, 157 (1991) (“The ADA [ ] leaves unclear whether courts should hold substance abusers to the same, or to a different, standard than they hold individuals with other disabilities.”).
• 164Id. at 156.
• 165Id. at 163.
• 166Off. for C.R., U.S. Dep’t of Health & Hum. Servs., supra note  NOTEREF _Ref58945926 \h 14908D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340035003900320036000000.
• 167Francis, supra note  NOTEREF _Ref78299703 \h 508D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370038003200390039003700300033000000, at 907–08 (explaining, for example, that drug-free workplace policies such as no-tolerance, random drug testing expose individuals with SUD to adverse consequences at work).
• 168Robbins, supra note  NOTEREF _Ref58945652 \h 16308D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340035003600350032000000, at 156.
• 169See Michael S. Cecere & Philip B. Rosen, Legal Implications of Substance Abuse Testing in the Workplace, 62 Notre Dame L. Rev. 859, 861–65 (1987). Because courts have found substance use testing by public employers to be a search and seizure subject to Fourth Amendment balancing, this ability is not without limit. Id. at 861. But “[w]hat is unreasonable in a given case depends upon its facts,” and courts are likely to find government interference to be less objectionable where the government regulates for public safety. Id.
• 170See, e.g., McElrath v. Kemp, 714 F. Supp. 23, 27–28 (D.D.C. 1989) (determining that an employer did not offer a reasonable accommodation after the employer did not consider the possibility of offering leave without pay to undergo treatment); Lemere v. Burnley, 683 F. Supp. 275, 278 (D.D.C. 1988) (determining that a reasonable accommodation might include a leave of absence); Callicotte v. Carlucci, 698 F. Supp. 944, 949–50 (D.D.C. 1988) (determining that an employer did not offer a reasonable accommodation after the employer did not offer the employee a second opportunity for treatment when she relapsed).
• 171Pub. L. No. 116-136, 132 Stat. 281 (2020); see also Confidentiality of Substance Use Disorder Patient Records, 85 Fed. Reg. 42,986, 42,987 (July 15, 2020).
• 172Confidentiality of Substance Use Disorder Patient Records, 85 Fed. Reg. at 42,987.
• 173Id. As of April 9, 2021, SAMHSA began working with the HHS Office for Civil Rights on a Notice of Proposed Rulemaking to implement CARES Act Modifications in new regulations. Statement on 42 CFR Part 2 Amendments Process, Substance Abuse & Mental Health Servs. Admin. (Apr. 9, 2021), https://www.samhsa.gov/newsroom/statements/2021/42-cfr-part-2-amendments-process [https://perma.cc/R32N-XTA2].
• 174Confidentiality of Substance Use Disorder Patient Records, 85 Fed. Reg. at 42,987.
• 175Id.
• 176See Gina Bertolini et al., What Comes Next for Part 2? The CARES Act’s Surprising Overhaul of the Controversial Law Protecting the Confidentiality of Substance Use Disorder Records, JD Supra (Apr. 17, 2020), https://www.jdsupra.com/legalnews/what-comes-next-for-part-2-the-cares-70074/ [https://perma.cc/56YA-YVJW].
• 177Schaper et al., supra note  NOTEREF _Ref77670465 \h 9408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370037003600370030003400360035000000, at 106.
• 17842 U.S.C. § 290dd-2(b)(1)(C) (emphasis added). The regulations provide a mechanism for revoking consent at 42 C.F.R. § 290dd-2(b)(1)(c).
• 17942 C.F.R. § 2.36 (2020).
• 180PDMPs are state-based programs that track prescription patterns. Terry et al., supra note  NOTEREF _Ref64117419 \h 13108D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600360034003100310037003400310039000000. Practitioners, state medical and pharmacy boards, and others can access PDMP information about prescribing and patient behaviors and monitor signs of prescription diversion, misuse, and abuse. Michael C. Barnes & Daniel C. McClughen, Warm Handoffs: The Duty of and Legal Issues Surrounding Emergency Departments in Reducing the Risk of Subsequent Drug Overdoses, 48 U. Mem. L. Rev. 1099, 1150 (2018).
• 181Confidentiality of Substance Use Disorder Patient Records, 85 Fed. Reg. 42,986, 42,988 (July 15, 2020); see also Soliz, supra note  NOTEREF _Ref74765691 \h 1808D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370034003700360035003600390031000000, at 18 (“A critical component of identifying, understanding, and combatting the opioid epidemic has been access to information about . . . who is suffering, where, why, how they are being treated, and are those treatments successful.”).
• 182Confidentiality of Substance Use Disorder Patient Records, 85 Fed. Reg. at 43,003.
• 183Id.
• 184Leo Beletsky, Deploying Prescription Drug Monitoring to Address the Overdose Crisis: Ideology Meets Reality, 15 Ind. Health L. Rev. 139, 167–68 (2018).
• 185See Terry et al., supra note  NOTEREF _Ref64117419 \h 13108D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600360034003100310037003400310039000000.
• 186Beletsky, supra note  NOTEREF _Ref59047840 \h 18408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003000340037003800340030000000, at 167–179 (emphasizing that government surveillance systems can perpetuate biases and have a disproportionate impact on underprivileged citizens).
• 187See, e.g., Doe v. Broderick, 225 F.3d 440, 446–49 (4th Cir. 2000); Chapa v. Adams, 168 F.3d 1036, 1037–38 (7th Cir. 1999); Ellison v. Cocke County, 63 F.3d 467, 470 (6th Cir. 1995).
• 188Mitchell Berger, Confidentiality of Substance Use Disorder Patient Records Final Rule (42 CFR Part 2), RSAT Conf. (Aug. 2017), https://www.rsat-tta.com/Files/Confidentiality-Rules-and-Regulations_BERGER-(1) [https://perma.cc/V3UB-MYT4].
• 189See Alex Dworkowitz, The CARES Act Brings Key Changes to the SUD Confidentiality Statute, JD Supra (Apr. 22, 2020), https://www.jdsupra.com/legalnews/the-cares-act-brings-key-changes-to-the-55845/ [https://perma.cc/GP8G-KY6E]. It has been suggested that Part 2 was likely to be construed in favor of the violator, similar to other criminal statutes. Berger, supra note  NOTEREF _Ref59020635 \h  \* MERGEFORMAT 18808D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003000320030003600330035000000.
• 190Bertolini et al., supra note  NOTEREF _Ref59365739 \h  \* MERGEFORMAT 17608D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003300360035003700330039000000.
• 191Dworkowitz, supra note  NOTEREF _Ref59020657 \h  \* MERGEFORMAT 18908D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003000320030003600350037000000.
• 192Supra Part II.C.
• 193Schaper et al., supra note  NOTEREF _Ref77670465 \h  \* MERGEFORMAT 9408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370037003600370030003400360035000000, at 106.
• 194Id.
• 195See 42 U.S.C. § 290dd-2(i); Confidentiality of Substance Use Disorder Patient Records, 85 Fed. Reg. 42,986, 42,987, n.3 (July 15, 2020).
• 196See Adam J. Hepworth & Jennifer J. Hennessy, COVID-19: CARES Act Overhauls Federal Substance Use Disorder Privacy Law, Foley & Lardner (Mar. 26, 2020), https://www.foley.com/en/insights/publications/2020/03/covid19-cares-act-federal-substance-privacy-law [https://perma.cc/WN7C-STV8].
• 197Terry et al., supra note  NOTEREF _Ref64117419 \h  \* MERGEFORMAT 13108D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600360034003100310037003400310039000000.
• 198Id.
• 199Id.
• 200See, e.g., Sheila Limmroth, Influence of COVID-19 on a HIPAA Training and Education Program, 22 J. Health Care Compliance 49, 49 (2020).
• 201G. Caleb Alexander et al., An Epidemic in the Midst of a Pandemic: Opioid Use Disorder and COVID-19, 173 Annals Internal Med. 57, 57 (2020).
• 202See, e.g., Jeanne A. Schaefer et al., Continuity of Care Practices and Substance Use Disorder Patients’ Engagement in Continuing Care, 43 Med. Care 1234, 1239 (2005).
• 203Nora D. Volkow, Collision of the COVID-19 and Addiction Epidemics, 173 Annals Internal Med. 61 (2020). Syringe service programs are community-based programs that are intended to facilitate access to sterile syringes and other equipment to individuals suffering from SUD. Syringe Services Programs, NIDA, https://www.drugabuse.gov/drug-topics/syringe-services-programs [https://perma.cc/2YLX-R5HZ] (last accessed July 28, 2021). They are intended to reduce the spread of infectious diseases. Id.
• 204Volkow, supra note  NOTEREF _Ref79161805 \h 20308D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370039003100360031003800300035000000.
• 205Oliva, supra note  NOTEREF _Ref58946287 \h  \* MERGEFORMAT 2008D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340036003200380037000000.
• 206Thomas B. Ferrante & Sunny J. Levine, COVID-19: DEA Confirms Public Health Emergency Exception for Telemedicine Prescribing of Controlled Substances, Foley & Lardner LLP (Mar. 18, 2020), https://www.foley.com/en/insights/publications/2020/03/covid19-public-health-exception-telemedicine [https://perma.cc/L55R-FNLP].
• 207COVID-19 Public Health Emergency Response and 42 CFR Part 2 Guidance, Substance Abuse & Mental Health Servs. Admin. (Mar. 19, 2020), https://www.samhsa.gov‌/sites/default‌/files‌/covid-19-42-cfr-part-2-guidance-03192020.pdf [https://perma.cc/Z3TK-8G5P].
• 208Alexander et al., supra note  NOTEREF _Ref58946200 \h 20108D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340036003200300030000000, at 57.
• 209Id. at 57–58.
• 210Id. at 57.
• 211Oliva, supra note  NOTEREF _Ref58946287 \h  \* MERGEFORMAT 2008D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340036003200380037000000.
• 212Id.
• 213See, e.g., Elizabeth A. Samuels et al., Innovation During COVID-19: Improving Addiction Treatment Access, 14 J. Addiction Med. e8 (2020).
• 214Frazier & Connelly, supra note  NOTEREF _Ref58940276 \h  \* MERGEFORMAT 708D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340030003200370036000000, at 42.
• 215Beletsky, supra note  NOTEREF _Ref59047840 \h 18408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003000340037003800340030000000, at 167–68.
• 216Bertolini et al., supra note  NOTEREF _Ref59365739 \h 17608D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003300360035003700330039000000.
• 217Id.
• 218Confidentiality of Substance Use Disorder Patient Records, 85 Fed. Reg. 42,986, 42,986 (July 15, 2020).
• 219Supra Part II; see also Thomas B. Kearns, Note, Technology and the Right to Privacy: The Convergence of Surveillance and Information Privacy Concerns, 7 Wm. & Mary Bill Rts. J. 975, 999 (1999).
• 220See, e.g., Ira S. Rubinstein, Privacy Localism, 93 Wash. L. Rev. 1961, 1971 (2018).
• 221See Daniel J. Solove, A Taxonomy of Privacy, 154 U. Pa. L. Rev. 477, 479–80 (2006).
• 222Kearns, supra note  NOTEREF _Ref58946340 \h 21908D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350038003900340036003300340030000000, at 1000 (“If the mood of the day favors information dissemination over information privacy, common law legal protections in privacy interests can be decimated with one new law or court decision. Later, if public opinion again favors privacy, it may be difficult to recapture legal protection for those interests.”).
• 223Id. at 1002.
• 224Id.
• 225Id. (“If public sentiment swings against privacy, even briefly, facets of that right could be lost forever.”).
• 226Beletsky, supra note  NOTEREF _Ref59047840 \h  \* MERGEFORMAT 18408D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003000340037003800340030000000, at 177–78.
• 22742 C.F.R. § 290dd-2(b)(1)(c) (“It shall be permissible for a patient’s prior written consent to be given once for all such future uses or disclosures for purposes of treatment, payment, and health care operations, until such time as the patient revokes such consent in writing.”).
• 228See, e.g., Patricia L. Bellia, Federalization in Information Privacy Law, 118 Yale L.J. 868, 878–79 (2009).
• 229Francis S. Chlapowski, Note, The Constitutional Protection of Informational Privacy, 71 B.U. L. Rev. 133, 133–35 (1991).
• 230Id. at 134; see also Newman, supra note  NOTEREF _Ref59113640 \h 4608D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003100310033003600340030000000, at 20 (“By effectively excusing the government for wrongfully disseminating sensitive medical data simply because the information did not rise to the level of Constitutional protection, the government would have less of an incentive to implement safeguards to ensure that its agents were keeping records and the information therein secure.”).
• 231Chlapowski, supra note  NOTEREF _Ref53817241 \h 22908D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350033003800310037003200340031000000, at 134.
• 232Jennifer D. Oliva, Prescription-Drug Policing: The Right to Health-Information Privacy Pre- and Post-Carpenter, 69 Duke L.J. 775, 779 (2020).
• 233Id. at 780.
• 234Id. at 784–85.
• 235Id. at 793.
• 236Bellia, supra note  NOTEREF _Ref59212817 \h 22808D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350039003200310032003800310037000000, at 868 (“Courts can expose constitutional, statutory, and common law privacy gaps and identify the constitutional standards to which legislation must conform.”).
• 237See Todd Robert Coles, Comment, Does the Privacy Act of 1974 Protect Your Right to Privacy? An Examination of the Routine Use Exemption, 40 Am. U. L. Rev. 957, 962–64 (1991) (“[T]he Court has not detailed the requirements of a successful claim based on a constitional right to [information] privacy. Because the Court has neither consistently recognized a constitutional right to, nor articulated a working definition of [information] privacy, federal judidical protection has been marginal.” (internal citations omitted)).
• 238Russell T. Gorkin, The Constitutional Right to Informational Privacy: NASA v. Nelson, 6 Duke J. Const. L. & Pub. Pol’y Sidebar 1, 18 (2010).
• 239Supra Part II.B.1.
• 240Id.
• 241Id.
• 242David H. Flaherty, On the Utility of Constitutional Rights to Privacy and Data Protection, 41 Case W. Rsrv. L. Rev. 831, 833 (1991) (explaining that privacy rights “evolve on a case-by-case basis” and are typically evaluated using a balancing test that may be “customarily loaded in favor of values that compete with privacy”).
• 243See James G. Hodge et al., Legal Issues Concerning Electronic Health Information: Privacy, Quality, and Liability, 282 JAMA 1466, 1468 (1999).
• 244See Lior Jacob Strahilevitz, Reunifying Privacy Law, 98 Cal. L. Rev. 2007, 2048 (2010) (noting that, if the Court were to adopt a constitutional right to information privacy, it could “treat[ ] the constitutional right as a gap filler in those settings where a federal statutory of state law remedies are unavailable”).
• 245Wilson, supra note  NOTEREF _Ref62376915 \h 7008D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600360032003300370036003900310035000000, at 672.
• 246Laurence A. Benner, Diminishing Expectations of Privacy in the Rehnquist Court, 22 J. Marshall L. Rev. 825, 826 (1989) (“Because the interest of the government (representing the many) will almost always be seen to outweigh the interest of a solitary citizen so long as the governmental interest is legitimate, this balancing process is inherently skewed.”).
• 247Wilson, supra note  NOTEREF _Ref62376915 \h 7008D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600360032003300370036003900310035000000, at 672.
• 248Id.
• 249Jennifer Wogen & Maria Teresa Restrepo, Human Rights, Stigma, and Substance Use, 22 Health & Hum. Rts. J. 51, 56 (2020).
• 250Whalen v. Roe, 429 U.S. 589, 602 (1977).
• 251Id. at 599–600.
• 252Id. at 604.
• 253Id. at 603.
• 254Supra Part II.B.2.
• 255Morgan Leigh Tendam, Note, The HIPAA-Pota-Mess: How HIPAA’s Weak Enforcement Standards Have Led States to Create Confusing Medical Privacy Remedies, 79 Ohio St. L.J. 411, 430–31 (2018); see also, e.g., Byrne v. Avery Ctr. for Obstetrics & Gynecology, 102 A.2d 32, 42 (N.J. 2014).
• 256See, e.g., Ellison v. Cocke County, 63 F.3d 467, 470 (6th Cir. 1995).
• 257See, e.g., Fannon v. Johnston, 88 F. Supp. 2d 753, 758 (E.D. Mich. 2000) (analyzing the standards under which SUD records may be released after a showing of “good cause” under Part 2).
• 258Supra Part II.E.
• 259See Roberts, supra note  NOTEREF _Ref63057476 \h  \* MERGEFORMAT 14708D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600360033003000350037003400370036000000, at 2101 (noting that privacy and antidiscrimination law work “symbiotically rather than separately”).
• 260Id. at 2102.
• 261Id.
• 262Id.
• 263Id. at 2102–03.
• 264See, e.g., Natasha Singer & Choe Sang-Hun, As Coronavirus Surveillance Escalates, Personal Privacy Plummets, N.Y. Times (Apr. 17, 2020), https://www.nytimes.com‌/2020/03/23‌/technology‌/coronavirus-surveillance-tracking-privacy.html [https://perma.cc/NDK2-W82B] (explaining that the pandemic has led to weaker privacy protections across the board, with “[i]ncreased surveillance and health data disclosures . . . drastically erod[ing] people’s ability to keep their health status private”).
• 265See Roberts, supra note  NOTEREF _Ref63057476 \h 14708D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600360033003000350037003400370036000000, at 2147.
• 266Id. at 2148.
• 267Id. at 2149.
• 268See generally Mark C. Weber, Accidentally on Purpose: Intent in Disability Discrimination Law, 56 B.C. L. Rev. 1417 (2015).
• 269Id. at 1417.
• 270Id.
• 271Id. at 1441.
• 272See generally Franita Tolson, The Boundaries of Litigating Unconscious Discrimination: Firm-Based Remedies in Response to a Hostile Judiciary, 33 Del. J. Corp. L. 347 (2008).
• 273See generally Samantha A. Hill, The ADA’s Failure to Protect Drug Addicted Employees Who Want to Seek Help and Rehabilitation, 9 Bus. L. 973 (2007).
• 274See Francis, supra note  NOTEREF _Ref53815339 \h 16708D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600350033003800310035003300330039000000, at 893–94.
• 275Corinne Zucker, Note, Commonwealth v. Eldred: Denying a Medical Reality, 92 Temp. L. Rev. 673, 673 (2020) (emphasis added).
• 27642 U.S.C. § 290dd-2(i).
• 277Id. (emphasis added).
• 27842 U.S.C. § 290dd-2(a) (including records of the “identity, diagnosis, prognosis, or treatment of any patient”).
• 279See Kelly K. Dineen & Elizabeth Pendo, Substance Use Disorder, Discrimination and the CARES Act: Using Disability Law to Inform Part 2 Rulemaking, 52 Ariz. St. L.J. 1143, 1157–58 (2020).
• 280Id. at 1159.
• 281Id.
• 282Aoun & Appelbaum, supra note  NOTEREF _Ref77750645 \h 15808D0C9EA79F9BACE118C8200AA004BA90B02000000080000000D0000005F00520065006600370037003700350030003600340035000000, at 601.
• 283See MJ Egan, Comment, When Does “Currently” Using No Longer Apply? The Americans with Disabilities Act, the Opioid Crisis, and the Search for a Solution, 27 Geo. Mason L. Rev. 307, 339 (2019).
• 284See generally Alexandra M. Mellis et al., COVID-19-Related Treatment Service Disruptions Among People with Single- and Polysubstance Use Concerns, 121 J. Substance Abuse Treatment 1 (2021).