Patient Privacy Protections

Overview

Digital Access to Medication (D-ATM) is a centralized database/information system in development under the sponsorship of the Center for Substance Abuse Treatment (CSAT), part of the Substance Abuse and Mental Health Services Administration (SAMHSA), a Federal agency in the Department of Health and Human Services.

D-ATM's purpose is to improve continuity of care for patients receiving treatment for opioid addiction in Opioid Treatment Programs (OTPs) when OTPs experience a disruption in their ability to provide services. During service disruptions, it is important that patients can obtain treatment at a guest OTP. The guest OTP must have access to limited, but specific, information about the patient's medication and dosage needed to provide safe and effective treatment.

Currently the project is in its pilot phase and is set for a limited rollout to clusters of OTPs located in 3 or 4 areas throughout the United States. Ultimately, information learned from this pilot will provide the foundation for a nationwide system should funding become available.

From the beginning, assuring the confidentiality of patient information has been one of the guiding principles of D-ATM. Since the project began, a paramount concern has been to maintain a centralized information source that multiple OTPs can access while protecting highly private and potentially powerful information. Accordingly, system development has incorporated the protection of personal information as an absolute core requirement.

On this page:

Participation in D-ATM
Patient Information in D-ATM
D-ATM Patient Identifier
Representing Patients' Interests and Overseeing D-ATM
More Information for Patients

Participation in D-ATM

Patient participation in D-ATM is voluntary. Before a patient can be enrolled in the system, the following must occur:

The Home OTP (the patient's usual dosing location and the program where the patient is enrolled) explains the purpose and benefits of D-ATM to the patient and provides the patient with printed material written expressly for patients.
The patient signs the D-ATM Consent and Release Form, which provides consent for the release of confidential personal medical and/or healthcare information. This consent allows the necessary access to medication records via the D-ATM system in instances of disaster or other circumstances of OTP service disruption.
If a patient needs to seek treatment from a Guest OTP (an OTP other than the patient's home OTP), the patient will again be asked to sign the D-ATM Consent and Release Form.

Patient Information in D-ATM

D-ATM is developed as an information source for use only by authorized OTP staff and to ensure patients are able to obtain needed medication in the event of disaster and/or other cause of service disruption. Only the minimum patient information necessary is collected and stored in D-ATM. The information collected includes the following:

The name of the patient's Home OTP
The type of medication, dosage amount, and the schedule for clinic and take-home doses contained in a Medicine Order
Record of the patient's most recent doses

Once stored in D-ATM, to be compliant with HIPAA, Code of Federal Regulations Title 42 Part 2, and all other related regulations and safeguards, no individual patient data can be retrieved from D-ATM. These regulations ensure the highest standards of patient confidentiality.

In the current pilot version, the patient data is stored in the system for only 90 days and is purged on an ongoing basis.

D-ATM Patient Identifier

Patient names, addresses, or other personal information will not be stored in D-ATM. Rather, a unique enrollment identifier (ID) is generated for each patient when the patient is first enrolled in D-ATM at the Home OTP. This ID is generated by scanning the patient's finger. When the finger is scanned, a patient-specific identification number is generated based on data points in the finger scan. Images of the finger scans will not be stored in D-ATM; the ID, not the finger scan, is linked to the patient's information as described in Patient Information in D-ATM.

If a patient has to seek treatment from a Guest OTP, the Guest OTP will scan the patient's finger to access the patient's information in D-ATM. D-ATM will first find the patient's ID based on the data points in the finger scan and then retrieve the patient's medicine order and dosage information.

When a patient is enrolled at the Home OTP, the patient also will be asked to select a personal identification number (PIN) as an alternative identifier in the event the finger scan fails to identify the patient's records. The PIN will be created in a manner that will ensure patients can recall it with the aid of prompts.

Representing Patients' Interests and Overseeing D-ATM

An important question for patients is: Who is representing patients' interests and overseeing changes and future development to D-ATM?

The D-ATM Steering Committee was formed during the early planning phases and has continued to provide important advice and oversight regarding D-ATM's design, system function, future system development, and data collection and retention.

The group's diverse composition promotes the opioid treatment community's range of interests. The Steering Committee includes individual members with community roles such as:

OTP and other healthcare-based administration and clinicians
Patient and patient advocacy group members

Any important changes to types of information stored in D-ATM, or how long the information is stored, must be approved by the D-ATM Steering Committee with the additional approval of SAMHSA.

More Information for Patients

The Patient Questions and Answers (Q&A) provide more information about D-ATM. Some questions include:

Why and when is D-ATM necessary?
If I refuse to participate, will this affect my treatment?
How do I know that the information stored will not be shared with the police or another agency?
Will my home clinic know if I obtain medication at a guest clinic?