When the use of marijuana is prescribed or discussed by a healthcare provider, the information is protected under HIPAA.
When is marijuana legal in the US?
According to a study from Epilepsy & Behavior, “Since the 1996 enactment of the first state law allowing the medical use of cannabis, 25 states and the District of Columbia have enacted such laws; another 17 allow products that are high in cannabidiol (CBD) and low in THC (tetrahydrocannabinol).” Marijuana legality varies in the US. While it is illegal on a federal level, multiple state laws have legalized its use medicinally and recreationally. This means it can be used and distributed in these states. The fact that it is illegal at a federal level means that despite state legalization, policy shifts, and the 2009 memo from the Obama Administration, federal authorities retain the discretion to prosecute marijuana related offenses.
The impact of legislation
Marijuana is legal for medical use in 38 states and for recreational use in 23 states. Each state has its laws and regulations governing the growth sale and use of marijuana. Despite state level legalization, the substance is still illegal at a federal level under the Controlled Substances Act (CSA), The Act classifies it as a Schedule I substance due to its addictive properties. The federal prohibition means that marijuana use, possession, and distribution are illegal under federal law.
The states that permit the medicinal use include:
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- Florida
- Hawaii
- Illinois
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Rhode Island
- South Dakota
- Texas
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
How HIPAA applies to medical marijuana
A 2020 study from the Medical Marijuana Registries provides that, “The courts have not directly addressed the question of whether HIPAA applies to medical marijuana information in state registries.”
It should however be noted that when healthcare providers prescribe and discuss marijuana use with patients, the information may be a part of the patients' broader medical record. The information would be considered protected health information (PHI). This means that HIPAA would apply to the protection of marijuana use as a part of the patient's medical records in the same way their other diagnostic and treatment information is protected.
The classification of dispensaries
The study mentioned above also provides that, “...one might argue that a dispensary that gains access to information on a customer’s status as a medical marijuana cardholder should be considered a covered entity under HIPAA…”
Dispensaries do not typically fall under the classification of being covered entities as they are not considered healthcare providers, health plans, or healthcare clearinghouses. There is an exception to this if a dispensary is part of a larger organization that qualifies as a covered entity or contracts with a covered entity in a way that involves handling PHI (in this case it would be considered a business associate).
When can information relating to marijuana use be disclosed?
As mentioned above, medical marijuana related information would be considered PHI if handled by a covered entity or a dispensary that meets the requirements to fall under HIPAA. This means that the Privacy Rule requirements for the disclosure and use of PHI would apply including:
- When the patient provides written authorization.
- The disclosures are required by federal or state law.
- For disease reporting, public health investigation, and monitoring.
- In response to a court order, subpoena, or legal process.
- For research purposes when requirements like deidentification are met.
- For compliance with workers' compensation laws.
- For the prevention or control of disease, injury, or disability.
- For organ donation procurement.
Patients' rights relating to their medical marijuana information are considered PHI
- Patients can access their medical records including information about medical marijuana use.
- They can request copies of their records.
- They can ask for corrections to their records.
- They can control who has access to their information by granting or revoking authorization.
- They should receive a notice explaining how their information is used and disclosed.
- They can file complaints if they believe their privacy rights are violated.
The stigma surrounding marijuana use
Over the years a negative perception has been created by anti drug campaigns centered around the reduction of cannabis use resulting in generalized views of those using cannabis and associated products.
According to a Harm Reduction Journal article, “...people who are perceived by others to deviate physically and behaviourally from social norms and values are subject to disapproval, and marginalization, and often experience discrimination and loss of status…”
As a result, those using marijuana have been subject to negative perceptions. Recent studies however have revealed that cannabis has a function in a healthcare setting in the treatment of a range of diseases. The combination of age old stigmas and medical advancements has left legislation around cannabis use a complex area in the legislative systems of multiple countries including the US.
Related: HIPAA Compliant Email: The Definitive Guide
FAQs
What is PHI?
Protected health information includes personal health data that can identify an individual.
What is a covered entity?
An organization like a healthcare provider, health plan, or healthcare clearinghouse that must comply with HIPAA.
What is the difference between THC and Cannabis?
Cannabis is a plant with various compounds including THC. THV is the psychoactive ingredient that causes the feeling of being high.
Kirsten Peremore
