Usually, it is the healthcare provider, they require drug testing (urinalysis) and require patients to waive patient privacy. The details may vary by state or a

Usually, it is the healthcare provider, they require drug testing (urinalysis) and require patients to waive patient privacy. The details may vary by state or among providers. And, I believe some healthcare providers require patient privacy waivers that are broader than specifically required by the locality. This might be an effort to avoid having to update the patient waivers as local law change. For example, a healthcare provider in Seattle, WA (UW Physicians') uses a controlled substance privacy waiver that can be read to allow any state or local agency access to a patient's medical record for any reason. https://www.washingtonpost.com/national/health-science/states-require-doctors-to-use-prescription-drug-monitoring-systems-for-patients/2018/01/12/c76807b8-f009-11e7-97bf-bba379b809ab_story.html https://www.washingtonpost.com/national/health-science/state...