Can an insurance company verify which Arkansas providers are registered users of the state's prescription drug monitoring program?

Plain-English summary

The State Health Officer asked the AG two questions about the Prescription Drug Monitoring Program (PDMP) Act, which sits at Ark. Code Ann. §§ 20-7-601 through -614. The first was whether an insurance company could check which of its in-network providers are registered users of the PDMP. The second was whether the Department of Health could provide prescriber information to public or private entities for statistical, research, or educational purposes.

The AG answered conditionally on both:

1. Insurer access depends on whether the verification information lives inside the controlled substances database created under the PDMP Act. Section 20-7-606 makes that database "privileged and confidential," "not a public record," and not subject to subpoena or discovery in a civil proceeding. Section 20-7-606(b)(2) lists who can access database information: law enforcement, regulatory bodies, the Department of Human Services, and the Arkansas State Police under specified circumstances. Insurance companies are not on that list. If the verification information is part of the database, the answer is no. If it lives somewhere else (a separate registration list, for instance), the answer might be different.

2. Research/statistical releases depend on deidentification. Section 20-7-607(d) authorizes release to public or private entities for statistical, research, or educational purposes only "after encrypting or removing" the patient's name, street address, patient ID number, month and day of birth, and prescriber information that could be used to identify individual patients or persons who received prescriptions. So if the prescriber information could be used to identify individuals, it cannot be released, even for research. The Department also has a separate duty under § 20-7-606(d) to establish and enforce policies and procedures protecting patient privacy.

The FOIA piece is straightforward: § 25-19-105(a)(1) opens public records "except as otherwise specifically provided ... by laws specifically enacted to provide otherwise." The PDMP Act is that other law. Once a record is part of the PDMP database, the custodian has no discretion to release it.

Currency note

This opinion was issued in 2016. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Who can lawfully access the PDMP database?
A: Under § 20-7-606(b)(2), the list includes law enforcement officers conducting active investigations, certain licensing and regulatory bodies, the Department of Human Services, and the Arkansas State Police under specified circumstances. The release rules at § 20-7-607(b) elaborate. Other entities, including most private parties, generally cannot get database information.

Q: Can an insurance company get prescriber information through a different channel?
A: Possibly, if the channel is not the PDMP database. Provider licensure information from the Arkansas Medical Board or the Arkansas State Board of Pharmacy is public. PDMP registration status might or might not be tied to those records. The AG declined to answer that factual question, leaving it to the Department of Health.

Q: Is research access ever allowed without deidentification?
A: No. The statute requires "encrypting or removing the patient's name, street name and number, patient identification number, month and day of birth, and prescriber information that could be used to identify individual patients or persons who received prescriptions from dispensers, or both." Deidentification is the gateway requirement.

Q: Is the PDMP database itself exempt from FOIA?
A: Yes. Section 20-7-606(a) says PDMP prescription information is "confidential and not subject to the Freedom of Information Act." Section 20-7-606(b)(1) further says the database "is privileged and confidential, is not a public record, and is not subject to subpoena or discovery in a civil proceeding." Arkansas FOIA itself recognizes this carveout under § 25-19-105(a)(1).

Q: Does the custodian have discretion to release confidential information anyway?
A: No. The leading FOIA commentary (Watkins & Peltz) and AG opinions agree that a custodian lacks discretion to disclose records that are exempt from disclosure, unless the exemption itself grants discretion.

Background and statutory framework

The Arkansas PDMP Act at §§ 20-7-601 through -614 creates a database of controlled-substance prescriptions. Dispensers (defined at § 20-7-603(3)) submit specified information about each dispensed prescription to the Arkansas Department of Health.

Section 20-7-606 contains the confidentiality wall. Subsection (a) puts prescription information outside FOIA. Subsection (b)(1) makes the database "privileged and confidential," not a public record, and immune from subpoena and discovery in civil proceedings. Subsection (b)(2) enumerates who can access the database. Subsection (d) requires the Department to "establish and enforce policies and procedures to ensure that the privacy and confidentiality of patients are maintained."

Section 20-7-607 covers releases. Subsection (b) addresses the release of PDMP information in general. Subsection (d) is the deidentification rule for statistical, research, or educational releases.

FOIA at § 25-19-105(a)(1) preserves the exemption: public records are open "except as otherwise specifically provided by this section or by laws specifically enacted to provide otherwise." The PDMP Act is one of those other laws.

Citations and references

Statutes:

• Ark. Code Ann. §§ 20-7-601 to -614 (PDMP Act)
• Ark. Code Ann. § 20-7-603(3) (dispenser definition)
• Ark. Code Ann. § 20-7-606 (confidentiality)
• Ark. Code Ann. § 20-7-607(b), (d) (releases)
• Ark. Code Ann. § 25-19-105(a)(1) (FOIA exemption clause)

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

Opinion No. 2016-082
November 2, 2016
STATE OF ARKANSAS
ATTORNEY GENERAL
LESLIE RUTLEDGE

Nathaniel W. Smith M.D., M.P.H.
Director and State Health Officer
Arkansas Department of Health
4815 West Markham
Little Rock, AR 72205-3867

Dear Dr. Smith:

You have requested my opinion on the following questions concerning the Prescription Drug Monitoring Program (PDMP) Act, which is codified at Ark. Code Ann. §§ 20-7-601 through -614 (Repl. 2014):

1. Can an insurance company have access to information that would verify if providers are in their networks and registered users of the PDMP?
2. Can the Department [of Health] provide prescriber information to public or private entities for statistical, research, or educational purposes?

RESPONSE

These questions cannot be answered with a simple "yes" or "no." The answers must instead be conditional. The answer to your first question depends upon whether the information that would provide verification regarding dispensers is part of the controlled substances database created under the PDMP Act. The answer to your second question depends upon whether the prescriber information could be used to identify individual patients or persons who received prescriptions from dispensers.

DISCUSSION

Question 1: Can an insurance company have access to information that would verify if providers are in their networks and registered users of the PDMP?

The controlled substances database created under the PDMP Act, and all information and records maintained as part of the database, are "privileged and confidential" and exempt from disclosure under the Arkansas Freedom of Information Act:

(a) Prescription information submitted to the Department of Health under this subchapter is confidential and not subject to the Freedom of Information Act of 1967, § 25-19-101 et seq.
(b)(1) The controlled substances database created in this subchapter and all information contained in the controlled substances database and any records maintained by the Department of Health or by an entity contracting with the Department of Health that is submitted to, maintained, or stored as a part of the controlled substances database is privileged and confidential, is not a public record, and is not subject to subpoena or discovery in a civil proceeding.

This statute clearly calls for the nondisclosure of information contained in the controlled substances database and records maintained by the Department of Health "that [are] submitted to, maintained, or stored" as part of the database. In stating that the database "is not a public record," the statute expresses the legislature's intention that the database be closed to the public. Indeed, the statute further specifies who may have access to information in the database. (The list includes law enforcement, regulatory bodies, the Department of Human Services, and the Arkansas State Police under certain specified circumstances. See also Ark. Code Ann. § 20-7-607(b) (further addressing the release of PDMP information).)

The Arkansas Freedom of Information Act (FOIA) incorporates this nondisclosure provision by stating that all public records are open to public inspection "[e]xcept as otherwise specifically provided by this section or by laws specifically enacted to provide otherwise." Consequently, the custodian of the database does not have discretion to disclose information and records that are part of the database.

It is therefore my opinion that the answer to the above question depends upon whether the information that would provide verification with regard to dispensers is part of the controlled substances database created under the PDMP Act. If the information is part of the database, then the answer to your question is "no."

Question 2: Can the Department [of Health] provide prescriber information to public or private entities for statistical, research, or educational purposes?

The answer to this question depends upon whether the prescriber information "could be used to identify individual patients or persons who received prescriptions from dispensers":

The department may provide information to public or private entities for statistical, research, or educational purposes after encrypting or removing the patient's name, street name and number, patient identification number, month and day of birth, and prescriber information that could be used to identify individual patients or persons who received prescriptions from dispensers, or both.

The answer to your question is therefore "no" if the prescriber information could be used to identify patients or those who received prescriptions. The particular concern with protecting patient information is also reflected in the requirement that the Department "establish and enforce policies and procedures to ensure that the privacy and confidentiality of patients are maintained ...." Ark. Code Ann. § 20-7-606(d).

Sincerely,

LESLIE RUTLEDGE
Attorney General