Balancing confidentiality and coordination: Legal and ethical challenges in SUD data sharing

Introduction:

Continuity of care for individuals with substance use disorders (SUD) is critically dependent on timely, accurate, and complete information exchange among providers, treatment programs, and referral networks. Yet, many behavioral-health organizations still rely on manual methods—fax, phone, email—to share data, creating fragmentation, delays, and confidentiality risks. This study situates these operational realities within the broader regulatory, ethical, and policy frameworks that govern SUD care.

Objective:

Our objective was to explore behavioral-health providers’ experiences with SUD data sharing and to identify the regulatory, ethical, technical, and organizational barriers and enablers to interoperability. Specifically, we examine how privacy regulations (e.g., 42 CFR Part 2, Health Insurance Portability and Accountability Act of 1996), consent practices, institutional policies, and data-sharing workflows intersect and impact patient care.

Methods:

Funded by NIH, we conducted 11 focus groups (n = 31) and five validation interviews (n = 5) with behavioral-health professionals from four SUD treatment organizations serving clients across 14 U.S. states. Participants included physicians, social workers, program directors, and health-IT staff. We applied thematic analysis and workflow modeling—creating Unified Modeling Language (UML) diagrams—to trace data-sharing processes, including consent capture, data interoperability workflows, referrals, mandatory controlled-substance queries, and discharge summaries. Workflows were mapped to four clinical quality measures relevant to SUD continuity of care.

Results:

Five interrelated themes emerged:

Patient reluctance to share: Stigma and lack of trust led many clients to decline or delay sharing behavioral-health/SUD records with other providers.

Limited data access and incomplete information: Organizations reported missing or delayed data during inter-institutional data exchanges, or when controlled-substance records lacked substance-use specifics and referral transcripts were absent.

Poor provider coordination and manual processes: Excessive reliance on faxed records, telephone follow?up, and email led to inconsistent and delayed communication, increasing administrative burden.

Regulatory and policy complexity: Providers indicated significant confusion about overlapping rules (HIPAA vs. 42 CFR Part 2), consent workflows, and responsibility for sharing data—especially when patients were involved in decriminalization or justice-involved care.

Ethical and policy implications for rights and equity: Participants emphasized the ethical imperative to respect patient privacy and autonomy, while also ensuring that incomplete data sharing undermines care continuity and may exacerbate disparities.

Providers recommended three strategic priorities: (a) embedding interoperable, consent-aware data-sharing platforms into EHRs that accommodate SUD−specific rules; (b) harmonizing privacy regulation language and institutional policy to reduce confusion and administrative burden; and (c) designing policy interventions that incentivize secure, timely data exchange while protecting patient rights.

Conclusion:

Fragmented, consent-dependent workflows pose substantial barriers to coordinated SUD care. As laws, ethics, and policy frameworks continue to evolve in the realm of addiction medicine, our findings highlight the urgent need for infrastructure and governance models that support both patient autonomy and effective care delivery. By aligning technology, workflow design, and policy reform, stakeholders can reduce administrative burden, enhance data completeness and timeliness, and promote equitable access to care for individuals with SUD.

Dr. Maria Adela Grando is a Professor of Biomedical Informatics at Arizona State University. Her research focuses on patient-centered data sharing, interoperability, and privacy-preserving clinical workflows. She leads an NIH-funded study exploring secure information exchange for substance use disorder care and the development of standards-based consent management tools. Dr. Grando’s interdisciplinary work bridges informatics, behavioral health, and health policy to improve continuity of care and patient trust in digital health systems.