April 15, DOI: These provisions represent a compromise between competing viewpoints about the importance of parental access to minors' health information and the availability of confidential adolescent health care services.
For example, half of single, sexually active females younger than 18 years surveyed in family planning clinics in Wisconsin reported that they would stop using the clinics if parental notification for prescription contraceptives were mandatory; another one in 10 reported that they would delay or discontinue use of specific services, such as services for STDs.
The vast majority of health care professionals who provide care to adolescents are required to comply. Under the HIPAA privacy rule, adolescents who legally are adults aged 18 or older and emancipated minors can exercise the rights of individuals; specific provisions address the protected health information of adolescents who are younger than 18 and not emancipated.
As personal representatives, parents generally have access to their children's protected health information. In specific circumstances, however, parents may not be the personal representatives of their minor children. Minors Acting as Individuals A minor is considered "the individual" who can exercise rights under the rule in one of three circumstances. The first situation—and the one that is likely to occur most often—is when the minor has the right to consent to health care and has consented, such as when a minor has consented to treatment of an STD under a state minor consent law.
The second situation is when the minor may legally receive the care without parental consent, and the minor or another individual or a court has consented to the care, such as when a minor has requested and received court approval to have an abortion without parental consent or notification.
The third situation is when a parent has assented to an agreement of confidentiality between the health care provider and the minor, which occurs most often when an adolescent is seen by a physician who knows the family.
In each of these circumstances, the parent is not the personal representative of the minor and does not automatically have the right of access to health information specific to the situation, unless the minor requests that the parent act as the personal representative and have access.
Parents' Access to Information A minor who is considered "the individual" may exercise most of the same rights as an adult under the regulation, with one important exception.
Provisions that are specific to unemancipated minors determine whether a parent who is not the minor's personal representative under the rule may have access to the minor's protected health information. If a state or other law explicitly permits, but does not require, information to be disclosed to a parent, the rule allows a provider to exercise discretion to disclose or not. If a state or other law prohibits disclosure of information or records to a parent without the minor's consent, the rule does not allow a provider to disclose without the minor's permission.
If state or other law is silent on the question of parents' access, a provider or health plan has discretion to determine whether to grant access to a parent who requests it.
Although some comments on the proposed rule suggested that this decision should be made by the treating provider, the rule does not require this. In most situations of direct clinical care, it would be desirable for the treating provider to make determinations about access to a minor's protected health information.
Where this is not feasible or appropriate, such as when health plans receive requests for records, the rule stipulates that at a minimum the determination must be made by a licensed health care professional exercising professional judgment.
Special Privacy Protections Two important provisions of the HIPAA privacy rule allow minors who are treated as "individuals" to request special privacy protections. First, these minors may request that health care providers and health plans communicate with them in a confidential manner: These requests may be particularly important when a minor believes that disclosure of information would result in specific danger. The provider or plan must also decide that it is not in the minor's best interest to treat the parent as the personal representative.
It gives minors somewhat less control over parents' access to their health information than the original version did, and gives providers and health plans greater discretion regarding parental access to minors' health information, particularly when state or other law is silent or unclear.
However, on the question of parents' access to information that has traditionally been considered confidential when minors themselves consented to the services, the Department of Health and Human Services the federal agency that promulgated the rule deferred to state or other law, and to "professional practice with respect to adolescent health care.
The compromise struck in the HIPAA privacy rule on minors' rights leaves health care providers and health plans with a series of important questions regarding the relationship between the rule and the "state and other appli-cable laws" to which it refers.
Many such laws are critically important to determining how the rule will be implemented. State Minor Consent Laws Every state has laws that allow minors to give their own consent for some kinds of health care—including emergency, general health, contraceptive, pregnancy-related, HIV or other STD, substance abuse and mental health care.
Every state also has some laws that allow minors to consent for care if they are emancipated, mature, living apart from their parents, pregnant, parents, high school graduates or older than a certain age. Many of these laws have been in place for several decades.
The language of the statutes themselves sometimes supports this understanding. Many minor consent laws contain explicit provisions regarding the disclosure of information to parents. Some do not allow disclosure without the minor's permission. Others leave the decision about disclosure to the physician's discretion. Very few mandate disclosure.
In those cases, unless state or other law addresses parents' access, the HIPAA rule gives discretion to the provider or health plan to decide whether a parent who requests access should have it; the decision must be made by a licensed health care professional. Other State Law For adults, the HIPAA privacy rule defers to state laws that provide stronger privacy protections than the federal rule, but if state laws provide weaker protection, the federal rule controls.
For minors, on the question of parental access to information, the rule defers to state laws unless they are silent or unclear. Many states have enacted laws concerning privacy of health information and medical records, although not all address disclosure of information to parents when minors have consented to the care. Most often, however, information that is in the records of a school-based health center, where adolescents often turn with an expectation of confidentiality, is not part of a student's education record.
Constitutional Law Numerous decisions of the U. Supreme Court and other courts recognize that the constitutional right of privacy protects minors as well as adults. These decisions support minors' right to receive contraception without parental consent, even in a state that does not have a law explicitly allowing them to do so, and even if they are not Medicaid beneficiaries or patients at Title X-funded clinics.
Dozens of state statutes most of which are being enforced require parental consent or notification when a minor seeks an abortion, usually with a "judicial bypass" alternative that allows her to obtain an abortion without parental knowledge or consent. In a state requiring parental consent, if the minor does not use the bypass and allows consent to be obtained from her parents, she will not be considered the individual under the HIPAA rule.
If she uses the bypass option, or is in a state that requires parental notification but not consent, the minor will be considered "the individual. The rule provides that in such situations, the minor generally assumes the rights to control access to information and records of the care subject to state and other laws' provisions about parents' access. If the information becomes part of a student's education record, it is likely covered by FERPA, which gives parents access to the record.
Clinicians providing abortions should make sure that minors understand that obtaining parental consent or seeking a judicial bypass will affect their ability to control abortion-related health information. The privacy rule does not address many practical issues that affect clinicians' ability to provide confidential care for adolescents. Clinicians still must determine minors' capacity to give informed consent.
Clinicians still need to screen for situations that will limit minors' ability to receive confidential care, such as physical or sexual abuse, and risk of homicide or suicide. Clinicians still face challenges concerning how to maintain their records when the parent has rights to obtain some of their adolescent's health information.
Such challenges may arise less frequently in specialized settings, such as STD or family planning clinics, than in clinical settings where comprehensive health services are provided, such as private physicians' offices. Electronic medical records, over which physicians may have little control, add complexity to this issue. Third-party reimbursement also creates challenges. Many adolescents are covered by public or private insurance, but some are unwilling or unable to use their coverage for contraceptive services, STD diagnosis and treatment, or other sensitive issues, because they worry that their parents will find out through the billing and insurance claims process.
Although the HIPAA privacy rule provides a legal basis for a minor to request that providers and health plans restrict disclosure of their protected health information or that they communicate with the minor in a confidential manner, 38 the effective implementation of these provisions requires the willing and active cooperation of both health care providers and third-party payers. Finally, clinicians continue to face the challenge of conveying the protections and limitations of confidentiality to adolescent patients and their parents.
They also still face the challenge of encouraging communication between adolescent patients and their parents in a way that is respectful of adolescents' need for privacy and the support that parents can provide.
Many are minors, are competent to give informed consent for health care and deny being at risk of physical or sexual abuse. Private Practice Settings Often an adolescent is seen at a private physician's office for routine health care which should include testing for chlamydial infection if she is sexually experienced , concerns about STD symptoms or family planning services.
If she is a minor, the STD screening is a service that she would be able to give her own consent for in every state, although the age limit varies. Title X, state law or constitutional principles also would permit her to give her own consent for family planning services. Moreover, her parent may have agreed to her receiving confidential care from the physician.
If the laws clearly prohibit disclosure without the minor's permission or give physicians discretion, they control. If the laws are silent or unclear, the rule gives physicians and other covered entities discretion on whether parents should have access to the medical records. The most challenging issues in a private physician's office arise with respect to billing and third-party reimbursement. If the office has routinely sent bills home for the minor's care, some diligence will be required to ensure that information on the bill does not inadvertently disclose confidential information to the parents.
Moreover, if the minor has health insurance coverage and wishes to use it to pay for the care, additional risks exist that disclosure will take place through the insurance claims process, when explanations of benefits are sent to the policyholder, usually a parent. The rule may minimize these risks if minors use the option of requesting restrictions on disclosure or confidential communications. Ultimately, however, effective implementation of confidential care for minors in a private physician's office depends on cooperation of the minor, the physician, and any health plan or insurer that is involved.
School-Based Health Centers All school-based health centers require some form of consent from parents before a student who is a minor receives care. Often the parent need only sign a general consent form at the beginning of the school year. Many of these forms specify the services offered at the center, and many specify that services are confidential. However, in general, school-based health centers work hard to involve parents whenever that is possible and appropriate.
Many school-based health centers offer family planning services and STD screening, and often students want and expect that care to be confidential. In every state, minors can legally consent for STD screening; the same is usually true for family planning. As a result, information about STD screening and family planning is in a different category from information about general health care—which the minor may not have the legal right to consent for under state law.
Thus, if information about the minor's health and services received at the center is requested either by a parent or by other school personnel, the school-based health center must pay special attention to ensuring that information about family planning and STD screening is not unintentionally disclosed along with other medical records. This is also true if the student's parent has authorized disclosure of health information or medical records to others, such as a new school or a camp.
To the extent that confidentiality concerns arise with respect to billing and third-party reimbursement linked to school-based clinics, the same general considerations apply as in a private physician's office. This will rarely be true, as long as school-based health centers or their sponsoring agencies meet the privacy rule's definition of a "covered entity" and center staff are careful to enter protected information only into the health center's record and not into a student's general education records, where it would be accessible to parents under FERPA.
Nevertheless, schools and school-based health centers need procedures for determining which records are governed by the requirements of which law and what those requirements mean for how the information can be used with the school. Information about family planning or STD screening in a school-based health center will almost never be accessible to the school, and will be accessible to parents only under specific provisions of state law.
Specialized Clinic Settings Every day, adolescents seek family planning or STD services in clinics specifically designed to provide such care. The application of the HIPAA privacy rule in these settings may differ markedly from its application in private physician offices or school-based health centers. At Title X-funded family planning clinics, the confidentiality protections of Title X apply; thus, if a minor receives contraceptive or STD care, the services are confidential and the minor's permission is required for information to be disclosed to her parent.
The issues may be slightly more complex in family planning or STD clinics not receiving Title X funds. If the minor is a Medicaid recipient, he or she is also entitled to receive confidential family planning services if the services are billed to Medicaid. The same is true in other Medicaid provider sites, including private physician offices and school-based health centers.
However, once again, the variation in practice among Medicaid managed care plans and state Medicaid agencies with respect to the handling of confidential services on claim forms and benefit statements poses challenges.
Questions of overriding importance include the following: This question can be answered only in part by reference to law, and will be greatly informed by sound standards of ethics and clinical practice. This question will have to be answered largely in the context of protocol development and systems review within provider sites and health plans. Answers to this question will depend on extensive discussion and planning among clinicians, health plans, health insurance companies, Medicaid agencies and others.
To the degree that willing providers and health plans address these questions in good faith with the desire to provide high-quality ethical care, to be flexible about their procedures and to honor adolescents' need for confidentiality, the HIPAA privacy rule provides an excellent basis for them to do so. Overall, the HIPAA privacy rule requires some sweeping changes by entire health care systems in the handling of individuals' health information.