When the use of marijuana is prescribed or discussed by a healthcare provider, the information is protected under HIPAA.
According to a study from Epilepsy & Behavior, “Since the 1996 enactment of the first state law allowing the medical use of cannabis, 25 states and the District of Columbia have enacted such laws; another 17 allow products that are high in cannabidiol (CBD) and low in THC (tetrahydrocannabinol).” Marijuana legality varies in the US. While it is illegal on a federal level, multiple state laws have legalized its use medicinally and recreationally. This means it can be used and distributed in these states. The fact that it is illegal at a federal level means that despite state legalization, policy shifts, and the 2009 memo from the Obama Administration, federal authorities retain the discretion to prosecute marijuana related offenses.
Marijuana is legal for medical use in 38 states and for recreational use in 23 states. Each state has its laws and regulations governing the growth sale and use of marijuana. Despite state level legalization, the substance is still illegal at a federal level under the Controlled Substances Act (CSA), The Act classifies it as a Schedule I substance due to its addictive properties. The federal prohibition means that marijuana use, possession, and distribution are illegal under federal law.
The states that permit the medicinal use include:
A 2020 study from the Medical Marijuana Registries provides that, “The courts have not directly addressed the question of whether HIPAA applies to medical marijuana information in state registries.”
It should however be noted that when healthcare providers prescribe and discuss marijuana use with patients, the information may be a part of the patients' broader medical record. The information would be considered protected health information (PHI). This means that HIPAA would apply to the protection of marijuana use as a part of the patient's medical records in the same way their other diagnostic and treatment information is protected.
The study mentioned above also provides that, “...one might argue that a dispensary that gains access to information on a customer’s status as a medical marijuana cardholder should be considered a covered entity under HIPAA…”
Dispensaries do not typically fall under the classification of being covered entities as they are not considered healthcare providers, health plans, or healthcare clearinghouses. There is an exception to this if a dispensary is part of a larger organization that qualifies as a covered entity or contracts with a covered entity in a way that involves handling PHI (in this case it would be considered a business associate).
As mentioned above, medical marijuana related information would be considered PHI if handled by a covered entity or a dispensary that meets the requirements to fall under HIPAA. This means that the Privacy Rule requirements for the disclosure and use of PHI would apply including:
Over the years a negative perception has been created by anti drug campaigns centered around the reduction of cannabis use resulting in generalized views of those using cannabis and associated products.
According to a Harm Reduction Journal article, “...people who are perceived by others to deviate physically and behaviourally from social norms and values are subject to disapproval, and marginalization, and often experience discrimination and loss of status…”
As a result, those using marijuana have been subject to negative perceptions. Recent studies however have revealed that cannabis has a function in a healthcare setting in the treatment of a range of diseases. The combination of age old stigmas and medical advancements has left legislation around cannabis use a complex area in the legislative systems of multiple countries including the US.
Related: HIPAA Compliant Email: The Definitive Guide
Protected health information includes personal health data that can identify an individual.
An organization like a healthcare provider, health plan, or healthcare clearinghouse that must comply with HIPAA.
Cannabis is a plant with various compounds including THC. THV is the psychoactive ingredient that causes the feeling of being high.