Health Information Compliance Alert

What’s the matter with kids these days? Or more accurately, what will be the matter with kids and their protected health information once the privacy standards of the Health Insurance Portability and Accountability Act become enforceable this April?

Covered health care providers who aren’t sure what regulations to follow when handling the PHI of their minor patients must be sure to consult state law as well as HIPAA’s privacy rule, stresses Joy Pritts, assistant research professor at Georgetown University’s Institute for Health Care Research and Policy in Washington.

“HIPAA has pretty much punted to the states” on the issue of minors’ rights to control access to their PHI, states Pritts. The very definition or understanding of “whether somebody even is a minor is established under state law,” she adds.

To help determine whether HIPAA requires a minor’s PHI to be disclosed to or withheld from a parent, entities should look to state or other applicable laws to verify the conditions under which a minor has the right to consent to the health care service, recommends Kristen Rosati, an attorney with Coppersmith Gordon Schermer Owens & Nelson in Phoenix.

“A good general rule of thumb is if a minor has a right to consent to the underlying health care, they also have a right to control the information about that health care,” says Rosati. This is particularly relevant for health care services such as mental health treatment, abortion services, alcohol and drug abuse treatment, or testing for sexually transmitted diseases. For example, she notes, states that give minors the right to receive alcohol or drug abuse treatment without parental permission also will likely give minors the right to control any health information pertaining to that treatment.

Rosati believes that “it’s been a long-standing practice at most health care providers that where minors have the right to consent to care,” parents will not receive any information related to that care unless the minor has given the provider permission to do so.

In general, Rosati predicts that “a lot of providers will end up just doing what they always have,” adding, “I don’t think the privacy rules were intended to change the existing ways of handling
minors’ health care at all.”

When the State Goes Silent

Not everyone, however, is so optimistic about the status of minors and their PHI under HIPAA’s privacy regs. Robyn Meinhardt, an attorney with Foley & Lardner in Denver, contends that HIPAA’s current  language on minors’ rights to control their PHI access reflects Republican changes to a rule originally drafted by a Democratic administration. The Democrats, she maintains, intended “to protect the rights of  minors more strongly than what the Republican administration has ended up doing in the proposed rules in March, and as they actually came to be in the Aug. 14 modifications.”

In particular, Meinhardt points out a section of the privacy rule that discusses the right to access an unemancipated minor’s PHI if state law happens to be silent on the matter. Under such a circumstance,
“a covered entity may provide or deny access… to a parent, guardian, or other person acting in loco parentis, if such action is consistent with State or other applicable law, provided that such decision must be made by a licensed health care professional, in the exercise of professional judgment,” the rule states.

Essentially, then, if state law is silent on the issue of access, HIPAA gives the provider the option of providing or denying access to the parent, reports Meinhardt.

“It’s astounding,” she remarks, because even while many states allow a minor to consent to health treatment, “most states don’t have explicit statements” which place the rights to PHI access in the hands of minors. As an example, Meinhardt points to her own state of Colorado, where regulations do not specifically grant access rights to the minor. 

“There’s a tremendous potential fallout” if state legislators fail to amend these provisions, insists Meinhardt. “Health care providers are very disturbed about a provision that, if minors knew about, would result in minors not seeking care that they need because their parents would get access” to medical records, she explains.

“The concern is that if kids understand that the doctor can tell their parents about their substance abuse treatment, then that might impinge on the child’s willingness to seek treatment,” she says.