NASPAG/SAHM Statement: The 21st Century Cures Act & Adolescent Confidentiality

Created by Jennifer Carlson MD, Rachel Goldstein MD, Kim Hoover, MD, Nichole Tyson MD

Expert reviewers: Elizabeth Alderman MD, Abigail English JD

 In 2020 the Office of the National Coordinator for Heath Information Technology (ONC) issued a Final Rule to implement specific requirements of the 21st Century Cures Act. The goal of the Final Rule is to increase access, use, and exchange of electronic health information. The North American Society for Pediatric and Adolescent Gynecology (NASPAG) and the Society for Adolescent Health and Medicine (SAHM) agree that sharing health information with patients and families allows for improved medical care. We believe it is equally important to recognize the right of adolescent minors to access confidential care, which is protected to some degree in every U.S. state.[1, 2] As experts in the care of adolescents, NASPAG and SAHM are in a unique position to inform institutional policies around release of information for this population.

ONC 21st Century Cures Act Final Rule Defined:

The Final Rule includes a broad range of complex provisions related to health information technology. One of its key aims is to ensure that the healthcare industry adopts standardized policies and technology which give patients and their families access to their medical information electronically. This regulation applies to health care providers, health information technology developers, health information networks, and health information exchanges. The comments in the preamble to the regulation offer eight pediatric specific recommendations to support the care of children, several of which are pertinent to the care of adolescents, including a call for segmented access to information within the electronic health record (EHR).[3] A key component to implementation of the Final Rule is the prohibition of information blocking with some exceptions. Information blocking is defined as a practice that interferes with access, exchange or use of electronic health information except as allowed by law or covered by an exception.[4] The Final Rule requires specific types of health information be shared during the first two years of implementation with the ultimate goal of complete medical record accessibility by year 2022 (with the exception of documentation related to psychotherapy).[5] The Final Rule contains eight exceptions that specify when actions that would otherwise be considered information blocking are permitted. These exceptions include an “Infeasibility Exception” as well as two others that are particularly important in the care of adolescents and the management of their health information: the “Preventing Harm Exception” and the “Privacy Exception”.[6]

 Adolescent Confidentiality Background:

The confidentiality of adolescents’ health information is protected by a combination of state and federal laws.[7] Though laws vary by state, in each state adolescent minors have the right to consent to some health care services; also some adolescent minors are allowed to consent for all or most of their own care.[8] For example, with regard to sexual and reproductive healthcare, all states allow minors to have access to screening and treatment for sexually transmitted infections without parent or guardian consent. Many states also allow minors to consent for family planning, pregnancy care, care related to substance use, and outpatient mental health services.

Some states allow specific groups of adolescent minors, such as those who are parents or who are living apart from their parents, to consent for all of their health care. When minors are allowed to consent for their own care, the confidentiality of information related to that care may also be protected under state or federal law. For example, when minors are allowed to consent under state law, the HIPAA Privacy Rule treats them as individuals and provides privacy protection; and the federal substance abuse confidentiality rules also protect adolescent minors who are allowed to consent for their own care.[9,10] Designing policies that provide appropriate protection for adolescents’ information has been a longstanding challenge as health care institutions have implemented EHRs. Understanding specific state minor consent laws as well as state and federal confidentiality laws is essential both for implementation of the Privacy Exception in the Final Rule and for the development of institutional policies that protect adolescents’ confidential information within the EHR.

Approach to Information Release:

Not only is it critical to determine what information will be shared, but also with whom it will be shared. Understanding state laws and institutional policy will be important for developing this process. While the Final Rule focuses on information blocking, it also provides the opportunity to maximize information sharing for both adolescent and their proxies (typically, parents/guardians). For example, proxy access to non-protected, medical information is crucial to optimize the management of adolescents with complex health issues. If proxies are able to use a proxy account within the EHR to access this information, then there is less reason for a proxy to access, with or without coercion, an adolescent’s own web portal account.

Requirements for Implementation:

In order to appropriately release information to adolescents and/or their proxies, two key elements of the EHR are essential to have in place. First, having both adolescent minor and proxy access to the EHR is necessary if the goal is to share all information, even if it is in a segmented way. As different types of information are released to adolescents and their proxies, it is critical to ensure that the account is accurately linked to the correct user. While it can be challenging to develop and maintain the two different levels of access, it is key for enabling differential information release. Second, having a way to reliably parse out protected information from general clinical information is critical. Many institutions have a confidential note-type for this purpose; advocating at the institutional level for a method to allow certain notes to be held as confidential will be key to having appropriate, and secure, documentation that can be filtered from general note release, either electronically or by Medical Records.

Even with accurate clinician documentation, there are multiple avenues through which protected information may be able to enter a clinical note or patient portal (e.g., medication lists, laboratory values, problem lists, or after visit summaries that may reveal a protected health issue). While clinicians need to be educated about appropriate documentation, systemic “guardrails” should also be in place to reduce the burden on the individual clinician. Many of these granular filters will need to be provided at the EHR vendor level, and many are in development phases; however, this infrastructure is neither complete nor readily available at this time. Until the system functionality exists to reliably exclude protected information from being shared, institutions should advocate for methods to release information (e.g., through Medical Records or other means) that preserve the confidentiality of adolescents’ health information.

Recommendations to Advocate for Appropriate Health Care Privacy for Adolescents: NASPAG and SAHM recommend the following steps to protect adolescent privacy in the implementation of the Cures Act Final Rule:

• Know your state minor consent laws and state and federal confidentiality laws that protect adolescent minors
• Serve as a leader in providing institutional and provider education regarding confidentiality rights for minors in your state (e.g., online modules, lectures, tip-sheets)
• Meet with the Health Informatics team and legal counsel at your institution to understand their plan to ensure adolescent confidentiality and its compliance with state and federal laws (e.g., 21^st Century Cures Act and Health Insurance Portability and Acountability Act)
• Advocate for information access and record release policies that incorporate adolescent confidentiality protections
• Consider separate and differential portal account access for the adolescent minor and proxy
• Advocate for a confidential note type or ability to designate notes as confidential in order to allow segmented access to health information within the EHR
• Create educational materials for patients and families about adolescent confidentiality and information access within the EHR
• Develop a practice workflow for all staff to ensure confidentiality is maintained for minor adolescent patients

References

1. Thompson LA, Martinko T, Budd P, et al. Meaningful use of confidential adolescent patient portal. J Adolesc Health 2016;58(2):134-140.
2. Guttmacher Institute. Overview of consent to reproductive services by young people.
   Available at: https://www.guttmacher.org/state-policy/explore/overview-minors-consent-law. Accessed September 1, 2020.
3. Federal Register.21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program. Available at: https://www.federalregister.gov/documents/2020/05/01/2020-07419/21st-century-cures-act-interoperability-information-blocking-and-the-onc-health-it-certification#h-141.    Accessed on October 4, 2020.
4. The Office of the National Coordinator for Health Information Technology. ONC’s Cures Act Final Rule: Information Blocking. Available at: https://www.healthit.gov/curesrule/final-rule-policy/information-blocking. Accessed October 4, 2020.
5. The Office of the National Coordinator for Health Information Technology. The ONC Cures Act Final Rule: Highlighted Regulatory Dates. Available at: https://www.healthit.gov/cures/sites/default/files/cures/2020-03/HighlightedRegulatoryDates.pdf   Accessed October 4, 2020.
6. The Office of the National Coordinator for Health Information Technology. The ONC Cures Act Final Rule: Information Blocking Exceptions. Available at: https://www.healthit.gov/sites/default/files/cures/2020-03/InformationBlockingExceptions.pdf   Accessed on October 4, 2020.
7. Ford C, English A, Sigman G. Confidential health for adolescents: position paper of the Society for Adolescent Medicine. J of Adolesc Health 2004.35(2):160-167.
8. American College of Obstetrics and Gynecology Committee Opinion No. 803. Confidentiality in adolescent healthcare. Obstet Gynecol 2020;135:e171-177. Obstet Gynecol 2020;135:e171–7.
9. English A, Ford C. The HIPAA privacy rule and adolescents: legal questions and clinical challenges. Perspectives on Sexual and Reproductive Health 2004;36(2):80-86.
10. 42 CFR Part 2.

Additional Resources:

American College of Obstetricians and Gynecologists’ Committee on Adolescent Health Care in collaboration with committee member Kimberly Hoover, MD and liaison member Stephanie Crewe, MD, MHS. (2020, April) Confidentiality in Adolescent Health care. American College of OB/GYN. Retrieved from https://www.acog.org/clinical/clinical-guidance/committee- opinion/articles/2020/04/confidentiality-in-adolescent-health-care

Federal Rules Mandating Open Notes (2020, September 9) Open Notes. Retrieved from https://www.opennotes.org/onc-federal-rule-interoperabilty-information-blocking-and-open- notes/

Everyone on the Same Page (n.d) Open Notes. Retrieved from https://www.opennotes.org/

An Overview of Consent to Reproductive Health Services by Young People. (2020, October 1) Guttmacher Institute. Retrieved from https://www.guttmacher.org/state-policy/explore/overview- minors-consent-law#

Committee On Adolescence. Achieving Quality Health Services for Adolescents. (2016, August) Pediatrics. Retrieved from https://pediatrics.aappublications.org/content/138/2/e20161347#sec-7

MyOpenNotes. (2017) Join the OpenNotes Movement! Available at: https://www.youtube.com/watch?v=_aFjt1ZPIV0&feature=youtu.be (Accessed: 10/4/2020).

Pediatric Health Information Technology: Developer Informational Resource. (2020, June) Office of the National Coordinator for Health Information Technology (ONC). Retrieved from  https://www.healthit.gov/sites/default/files/page/2020-06/Pediatric-Health-IT-Developer-IR- 06102020.pdf