The HIPAA privacy rule and adolescents: legal questions and clinical challenges

Perspectives on Sexual and Reproductive Health, March-April, 2004 by Abigail English, Carol A. Ford

Dozens of state statutes (most of which are being enforced) require parental consent or notification when a minor seeks an abortion, usually with a "judicial bypass" alternative that allows her to obtain an abortion without parental knowledge or consent. In a state requiring parental consent, if the minor does not use the bypass and allows consent to be obtained from her parents, she will not be considered the individual under the HIPAA rule. If she uses the bypass option, or is in a state that requires parental notification but not consent, the minor will be considered "the individual." (35)

CLINICAL PRACTICE

Clinicians providing adolescent health care must implement the changes required by the HIPAA privacy rule in all settings. (36) They also must be aware of the aspects of the rule that apply to unemancipated minors and must understand how to provide health care within this context. (37) This requires the following:

* Health care professionals must be knowledgeable about state minor consent laws, including any provisions regarding disclosure of information to parents.

* Health care professionals must be knowledgeable about any state laws regarding privacy of health information and medical records, including provisions pertaining to disclosure of information to parents, particularly when minors may legally give their own consent for care.

* When state and other laws are silent or unclear, health care professionals must be prepared to exercise professional judgment and grant or deny parents' requests for information about care for which minors may legally consent.

* Health care professionals must be aware that the HIPAA privacy rule grants legal significance to agreements with parents that favor their adolescents' receiving at least some health care on a confidential basis. The rule provides that in such situations, the minor generally assumes the rights to control access to information and records of the care (subject to state and other laws' provisions about parents' access).

* Health care professionals must clarify the location of health information obtained during delivery of care in school-based health centers. If the information becomes part of a student's education record, it is likely covered by FERPA, which gives parents access to the record.

* Health care professionals must understand the requirements of Title X and Medicaid, which protect adolescents' access to confidential family planning services.

* Health care professionals must understand the constitutional privacy rights that protect minors' access to contraception and abortion. Clinicians providing abortions should make sure that minors understand that obtaining parental consent or seeking a judicial bypass will affect their ability to control abortion-related health information.

The privacy rule does not address many practical issues that affect clinicians' ability to provide confidential care for adolescents. Clinicians still must determine minors' capacity to give informed consent. Clinicians still need to screen for situations that will limit minors' ability to receive confidential care, such as physical or sexual abuse, and risk of homicide or suicide. Clinicians still face challenges concerning how to maintain their records when the parent has rights to obtain some of their adolescent's health information. Such challenges may arise less frequently in specialized settings, such as STD or family planning clinics, than in clinical settings where comprehensive health services are provided, such as private physicians' offices. Electronic medical records, over which physicians may have little control, add complexity to this issue.