HIPAA Compliance Strategies

Protecting the HIPAA PHI of Minors Is Complicated and Critical

Reprinted from the March 2006 issue of REPORT ON PATIENT PRIVACY, the industry's most practical source of news on HIPAA patient privacy provisions.

Gila River Health Care Corp. takes no chances that its minor patients' family planning protected health information (PHI) will fall into the wrong hands. So the Arizona health system keeps a "shadow" copy of family planning medical records in the family planning clinic. No family planning PHI appears at all in the minor's central chart in the health system's main medical records department. Instead, the main chart has a tab telling doctors that additional medical records can be found in the family planning clinic. "They are physically separate," says Privacy Officer Frank Ruelas. That way, when parents request a copy of their child's medical records, there's no risk that patient encounters related to birth control, sexually transmitted diseases (STDs), pregnancy, etc. can mistakenly be included in the photocopy presented to the parents, since they are not even physically located in the main chart.

That's one of the ways that Gila River ensures minors' rights to privacy for certain sensitive medical conditions. States have granted minors the right to consent for treatment and/or control access to medical records regarding STDs, pregnancy, substance abuse treatment, mental health treatment, HIV and other sensitive conditions. If the parents signed the consent-for-treatment form, they have rights to the minor child's medical records. If the minor child signs the consent-for-treatment form (under the circumstances permitted by state law), then medical records can only be disclosed to the parent with the minor's signed authorization.

The entire minor medical records business gets tricky for several reasons. For one thing, parents are entitled to the lion's share of their minor children's general medical records without the minor's permission, which presents a logistical challenge. Providers must be ultra careful when copying minors' medical records. No sensitive material must be inadvertently disclosed without the minor's permission, so the medical records department must redact it first — without the redacting itself tipping off the parents to the minor's private medical business.

And the rights of minors are not absolute. In most states, physicians can use their discretion to reveal sensitive conditions to parents. It also has been a productive strategy in some cases, privacy officers say, to immediately ask minors and parents both to consent to get the results of tests, for example, to eliminate the struggle to maintain secrecy and enable the minors, if they're comfortable, to be open with their parents.

Besides paper records related to family planning, Gila River has another method for ensuring the medical records department doesn't inadvertently disclose sensitive PHI to parents (e.g., for mental health treatment). The notes pertaining to encounters that minors are permitted to maintain control over are kept between pink sheets in the patient's chart. The first pink sheet has a reminder printed on it: "The following information cannot be disclosed without the specific authorization of the patient." Ruelas says medical records staff "will not miss those pink cover sheets. You can literally see them when you get the medical records. They stick out."

EMRs Require Different Tactics

A whole different strategy is necessary for protecting minors' electronic medical records (EMRs). There is an electronic stop sign that can't be passed by the user if there is a portion that requires a HIPAA authorization. "You can't really run the stop sign," Ruelas says. And the parent won't even know there are records they can't access. EMRs are not numbered like book pages, he says; they're more like a diary. Each patient encounter represents an incident, so the reader can't spot a missing encounter (e.g., the minor was treated for an STD).

Evergreen Hospital Medical Center in Kirkland, Wash., experiences unintended consequences from the fine line it walks when it deals with parents of minors who want their child's medical records. Because the hospital is located in Washington state, minors aged 13 to 18 can give consent for treatment for sensitive conditions like STDs and pregnancy, which means they also have the right to restrict access, says Privacy Officer Kathy Gilles. As a result, the hospital has to tell the parent it needs the child's authorization before releasing his or her medical records to the parent.

"That creates problems," Gilles says. "As soon as you tell parents you are not going to release information, they want to know why. We try to dance around that and not inadvertently release information when you have that conversation." A limited number of employees at the hospital work on the release of medical records, and they are trained to handle this situation. "What we try to say is, 'because your child falls in this age group, they have to consent [to release their records]' and not say 'because your child has a sensitive diagnosis, they have to consent [to release their records].'"

But unfortunately, the net effect sometimes is the hospital loses money. When the children have declined to tell their parents about a sensitive diagnosis for which they are permitted under state law to consent to treatment, parents are not legally responsible for that bill, Gilles says. "So we may get left holding the bag," she says.

The hospital still bills the parents — putting generic items on the bill (e.g., lab test instead of pregnancy test). If the parent calls and inquires about the reason for a bill for an emergency room visit, "at that point, we basically say 'I am not able to release any information.' If the parent demands to know what the child was in the ER for and refuses to pay the bill until he or she gets the information, "then we just write off the bill rather than reveal what the child was in for," Gilles says. "Then we call the child and tell them what has happened and ask them whether they're willing to sign an authorization so their parents can have the records. Usually they say 'no.'"

At Piedmont Healthcare in Atlanta, compliance officer Debi Hinson says that when parents request their minor children's records, the medical records department can redact sensitive PHI relative to any treatment that the minor "consented" for based on state law.

But it's a misconception to assume the medical records department has to automatically redact all sensitive information, such as that pertaining to substance abuse, mental health, STDs and pregnancy. If the parent is the one who signed the consent to treat and/or the parent has authorization, redaction is superfluous. The parent can have the entire medical record. So first the medical record staff reviews who signed the consent. "You find out who consented for that treatment. If the minor signed, then parents must have an authorization signed by the minor to obtain records related to the treatment consented for by the minor," she says.

Good Training Is Essential

Hinson notes that it's essential in the area of minors' rights for medical records staff to be well-trained and privacy officers to be well-versed in the details of their state laws in areas like age of consent for minors for particular medical conditions. For example, in some states, a minor is automatically emancipated when she gives birth to her own baby. Emancipated minors are the legal equivalent of adults. When they become emancipated through childbirth, they don't have to petition the court for emancipation. Hinson says the significance is that when parents request a copy of their minor child's medical records, medical records staff should try to check whether the minor has given birth because automatically that would render moot any attempt by the parent to get the medical records without the child's authorization.

Also, she notes that minors' rights are not absolute. For example, all 50 states let most minors consent for testing and treatment for STDs, including HIV infection, according to the Guttmacher Institute. "Many states, however, allow physicians to inform parents that the minor is seeking or receiving STD services when they deem it in the best interests of the minor," the Guttmacher Institute says. Doctors can't give parents the medical records, however, Hinson adds, without the minor's authorization.

Similarly, 34 states allow some minors to consent to prenatal care, with the same exception for doctors to tell parents when it's in the best interests of the minor, the institute says.

Asking Children for Permission Upfront

Children's Health System in Birmingham, Ala., tries to achieve openness from the start. "You always want to do right by all parties involved — protect the child's privacy but also be sensitive to parents who usually want to take care of their child and have their best interests at heart," says Roxanne Womack, director of medical information services.

For example, when a child is getting a venereal disease test, before the results come in, Womack asks the child if it's OK for both the child and the parents to sign in advance the release of information form. "If we ask for both signatures on the release form in advance [of test results coming in], then the child knows the parent may get a copy of results," and if the child says 'yes,' he or she is OK with the parent learning the results. "We are opening that dialogue. The parent or child has to communicate about getting that form. That gives us an extra level of comfort if we have the parent's and minor child's."

Children's always takes its time reviewing requests for medical records regarding minors. "This is not a cut-and-dried issue," she says. It's governed by state law and is affected by so many variables — the intricacies of your particular state law, the nature of the condition, the age of the minor, whether the minor is emancipated.

And a routine medical event can get tricky. Suppose a 15-year-old is in a car wreck and brought to the ER. The parents go to file an insurance claim, so they request emergency room records, but they come back restricted because a pregnancy test was part of the ER visit and the teenager requested a restriction. All of a sudden, the parents can't get the records they need to file the claim, and now they know something is up with their child. "Both the parents and the minor child need to sign a release," Womack says.

Another privacy officer, who asked not to be identified, says he thinks privacy officers need to be better educated in their state laws and how they govern release of information regarding minors. He also thinks that compliance with rules regarding minors and other HIPAA issues would be improved if privacy officers spent more time understanding the details of the medical records department and how it operates. Otherwise, he says, there is too much of a disconnect between HIPAA policies and procedures and the way they intersect with the real world, especially in complex areas like minors, where HIPAA defers to state law.

"I really dug into state and federal laws in areas like minors where there are additional laws that protect this kind of thing," the privacy officer says. "There are reasons you have 30 days" to comply with patients' requests for copies of their medical records. Patients want the equivalent of a McDonald's drive-in window for their medical records, but the privacy officer says it's critical to run the request through a couple of checks before handing them over. If a minor is asking for results of a test, the doctor is the right person to sit down with the patient and discuss the test results and inform the minor of treatment options. If the doctor recognizes an incongruous result, before the patient does something dangerous in response to what he or she thinks is a bad result, the doctor can order a new test to determine whether it's a false positive.

The privacy officer's advice: It is important to understand state and federal laws and to check with inside or outside counsel when gray areas arise. And when it comes to minors, dig deeply into the medical record to track the sometimes intricate story of a minor. Sometimes you may have to bend over backwards. For example, suppose a minor comes for an ER visit with her mother, and the mother signs the consent form. But the ER treatment reveals the minor is pregnant. Now the minor patient invokes her right to consent to treatment and restrict disclosures to her mother. "Nothing changes until the patient invokes her rights," the privacy officer says. But once she does, then her mother is no longer entitled to her medical records.

Visit the Guttmacher Institute at www.guttmacher.org.

Advertise With AIS

Privacy

Site Map