The HIPAA privacy rule and adolescents: legal questions and clinical challenges

Perspectives on Sexual and Reproductive Health, March-April, 2004 by Abigail English, Carol A. Ford

In August 2002, a new federal rule took effect that protects the privacy of individuals' health information and medical records. (1) The rule, which is based on requirements contained in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), embodies important protections for minors, along with a significant degree of deference to other laws (both state and federal) and to the judgment of health care providers. These provisions represent a compromise between competing viewpoints about the importance of parental access to minors' health information and the availability of confidential adolescent health care services.

CONFIDENTIALITY FOR ADOLESCENTS

Over the past several decades, adolescents have gained many opportunities to receive confidential health care services, particularly for concerns related to sexual activity, pregnancy, HIV and other sexually transmitted diseases (STDs), substance abuse and mental health. (2) From both a clinical and a public policy perspective, protection of confidentiality for adolescents has been based on recognition that some minors would not seek needed health care if they could not receive it confidentially, and that their forgoing care would have negative health implications for them as well as society. (3)

Concerns about privacy can prevent adolescents from seeking care. (4) In two large nationally representative surveys, approximately a quarter of middle and high school students reported having forgone health care they needed. (5) In one of these, a third of students who did not seek care reported that one of their reasons was "not wanting to tell their parents." (6) The impact of privacy concerns when adolescents require specific services to address sensitive health issues is likely much higher. For example, half of single, sexually active females younger than 18 years surveyed in family planning clinics in Wisconsin reported that they would stop using the clinics if parental notification for prescription contraceptives were mandatory; another one in l0 reported that they would delay or discontinue use of specific services, such as services for STDs. (7) Furthermore, only 1% of adolescent girls who indicated they would stop using family planning services reported that they would also stop having intercourse; the vast majority reported that they would continue to have sex, but use less effective contraceptive methods or none at a 11. (8)

Privacy concerns also influence where adolescents go for health care, (9) can deter them from communicating openly with providers, (10) and can make them reluctant to accept services such as pelvic examinations and testing for STDs. (11)

Confidentiality protections for adolescent health care are reflected in the policies and ethical guidelines of a wide range of medical and health care professional organizations. (12) They also are embodied in numerous state and federal laws that have great significance for the application of the HIPAA privacy rule to adolescents' health information.

PROVISIONS OF THE RULE

The HIPAA privacy rule * creates new rights for individuals to have access to their health information and medical records (referred to as "protected health information"), to obtain copies and to request corrections. (13) It also specifies when an individual's authorization is required for disclosure of protected health information; authorization is generally not required for the use of the information and its disclosure for the purpose of treatment, payment or health care operations. (14) The rule applies to health plans, health care providers and health care clearinghouses (which are all "covered entities"). The vast majority of health care professionals who provide care to adolescents are required to comply.

Under the HIPAA privacy rule, adolescents who legally are adults (aged 18 or older) and emancipated minors can exercise the rights of individuals; specific provisions address the protected health information of adolescents who are younger than 18 and not emancipated. (15) Parents (including guardians and persons acting in loco parentis) are considered to be the "personal representatives" of their un-emancipated minor children if they have the right to make health care decisions for them. As personal representatives, parents generally have access to their children's protected health information. In specific circumstances, however, parents may not be the personal representatives of their minor children.

Minors Acting as Individuals

A minor is considered "the individual" who can exercise rights under the rule in one of three circumstances. The first situation--and the one that is likely to occur most often--is when the minor has the right to consent to health care and has consented, such as when a minor has consented to treatment of an STD under a state minor consent law. The second situation is when the minor may legally receive the care without parental consent, and the minor or another individual or a court has consented to the care, such as when a minor has requested and received court approval to have an abortion without parental consent or notification. The third situation is when a parent has assented to an agreement of confidentiality between the health care provider and the minor, which occurs most often when an adolescent is seen by a physician who knows the family. In each of these circumstances, the parent is not the personal representative of the minor and does not automatically have the right of access to health information specific to the situation, unless the minor requests that the parent act as the personal representative and have access.