Can an insurance company verify which Arkansas providers are registered users of the state's prescription drug monitoring program?

Plain-English summary

Arkansas's State Health Officer asked whether an insurer could obtain information verifying that its providers were registered users of the Prescription Drug Monitoring Program (PDMP). He also asked whether the Department of Health could provide prescriber information to public or private entities for statistical, research, or educational purposes. Attorney General Leslie Rutledge gave conditional answers to both questions.

The controlled substances database and records maintained as part of it are confidential and closed to public disclosure. If the verification information an insurer wants is part of that database, the AG said the answer is no: the custodian cannot release it. The opinion does not determine whether any such information exists outside the database or whether another source provides it.

For statistical, research, or educational use, the opinion quotes a rule allowing information to be supplied only after specified patient details and prescriber information capable of identifying patients or prescription recipients have been encrypted or removed. If the prescriber information could identify those people, the AG said it could not be provided in the manner asked about.

Currency note

This opinion was issued in 2016. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

What this means for you

Insurers

This opinion bars access when the verification data sought is part of the PDMP database. The AG did not find whether the requested verification information was stored there, so the answer to the insurer's particular request depends on that fact.

Department of Health staff and researchers

For statistical, research, or educational releases, apply the quoted rule requiring encryption or removal of patient identifiers and prescriber information that could identify patients or prescription recipients. The opinion also points to the Department's duty to maintain policies protecting patient privacy and confidentiality.

Common questions

Q: Can an insurer get provider registration information from the PDMP database?
A: No, if the information is part of the confidential controlled substances database. The AG made the answer turn on where the information is maintained.

Q: Did the AG identify another public source for that information?
A: No. The opinion does not discuss provider licensing boards or other alternative channels.

Q: Can prescriber information be supplied for research?
A: The opinion says information may be supplied for statistical, research, or educational purposes after identifiers capable of revealing patients or prescription recipients have been encrypted or removed. It answers no if the prescriber information could identify them.

Background and statutory framework

The AG describes the PDMP Act as creating a controlled substances database. She quotes its confidentiality provision, which says the database and records maintained as part of it are not public records and are not subject to civil subpoena or discovery. The opinion says the FOIA recognizes specific statutory nondisclosure rules and that the database custodian lacks discretion to disclose information covered by this one.

Citations and references

Statutes: Ark. Code Ann. §§ 20-7-601 through -614 (Repl. 2014); Ark. Code Ann. § 20-7-607(b); Ark. Code Ann. § 20-7-606(d).

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

Opinion No. 2016-082
November 2, 2016
STATE OF ARKANSAS
ATTORNEY GENERAL
LESLIE RUTLEDGE

Nathaniel W. Smith M.D., M.P.H.
Director and State Health Officer
Arkansas Department of Health
4815 West Markham
Little Rock, AR 72205-3867

Dear Dr. Smith:

You have requested my opinion on the following questions concerning the Prescription Drug Monitoring Program (PDMP) Act, which is codified at Ark. Code Ann. §§ 20-7-601 through -614 (Repl. 2014):

1. Can an insurance company have access to information that would verify if providers are in their networks and registered users of the PDMP?
2. Can the Department [of Health] provide prescriber information to public or private entities for statistical, research, or educational purposes?

RESPONSE

These questions cannot be answered with a simple "yes" or "no." The answers must instead be conditional. The answer to your first question depends upon whether the information that would provide verification regarding dispensers is part of the controlled substances database created under the PDMP Act. The answer to your second question depends upon whether the prescriber information could be used to identify individual patients or persons who received prescriptions from dispensers.

DISCUSSION

Question 1: Can an insurance company have access to information that would verify if providers are in their networks and registered users of the PDMP?

The controlled substances database created under the PDMP Act, and all information and records maintained as part of the database, are "privileged and confidential" and exempt from disclosure under the Arkansas Freedom of Information Act:

(a) Prescription information submitted to the Department of Health under this subchapter is confidential and not subject to the Freedom of Information Act of 1967, § 25-19-101 et seq.
(b)(1) The controlled substances database created in this subchapter and all information contained in the controlled substances database and any records maintained by the Department of Health or by an entity contracting with the Department of Health that is submitted to, maintained, or stored as a part of the controlled substances database is privileged and confidential, is not a public record, and is not subject to subpoena or discovery in a civil proceeding.

This statute clearly calls for the nondisclosure of information contained in the controlled substances database and records maintained by the Department of Health "that [are] submitted to, maintained, or stored" as part of the database. In stating that the database "is not a public record," the statute expresses the legislature's intention that the database be closed to the public. Indeed, the statute further specifies who may have access to information in the database. (The list includes law enforcement, regulatory bodies, the Department of Human Services, and the Arkansas State Police under certain specified circumstances. See also Ark. Code Ann. § 20-7-607(b) (further addressing the release of PDMP information).)

The Arkansas Freedom of Information Act (FOIA) incorporates this nondisclosure provision by stating that all public records are open to public inspection "[e]xcept as otherwise specifically provided by this section or by laws specifically enacted to provide otherwise." Consequently, the custodian of the database does not have discretion to disclose information and records that are part of the database.

It is therefore my opinion that the answer to the above question depends upon whether the information that would provide verification with regard to dispensers is part of the controlled substances database created under the PDMP Act. If the information is part of the database, then the answer to your question is "no."

Question 2: Can the Department [of Health] provide prescriber information to public or private entities for statistical, research, or educational purposes?

The answer to this question depends upon whether the prescriber information "could be used to identify individual patients or persons who received prescriptions from dispensers":

The department may provide information to public or private entities for statistical, research, or educational purposes after encrypting or removing the patient's name, street name and number, patient identification number, month and day of birth, and prescriber information that could be used to identify individual patients or persons who received prescriptions from dispensers, or both.

The answer to your question is therefore "no" if the prescriber information could be used to identify patients or those who received prescriptions. The particular concern with protecting patient information is also reflected in the requirement that the Department "establish and enforce policies and procedures to ensure that the privacy and confidentiality of patients are maintained ...." Ark. Code Ann. § 20-7-606(d).

Sincerely,

LESLIE RUTLEDGE
Attorney General