Rationale:
As currently written, the Privacy Rule
strikes a careful balance between the need for parents to have access to
their children's health information and the need for adolescents to feel
secure that their health information will be kept private in certain
limited circumstances. Thus, under the Privacy Rule, parents are generally
treated as the personal representatives of their unemancipated minor
children and given control over and access to their children's health
information. Based upon significant research and standard medical
practice, however, the Privacy Rule contains narrow exceptions to this
general rule.
One of these exceptions gives a minor control over and access to
information related to health services that the minor lawfully obtains
based on his or her own consent. See § 164.502(g)(3)(i). Numerous studies
have found that confidentiality is one of the prime determinants of
whether an adolescent seeks and obtains timely health care related to
sensitive topics such as mental health, substance abuse, and sexuality.
For example, studies show that somewhere between eight and thirty-one
percent of teens delay or entirely forego health care because of concerns
that their private information will be revealed to parents or
others.1 In addition, research confirms that teens who believe
that their health care provider will maintain their confidentiality are
more likely to discuss sensitive health topics, such as sexually
transmitted diseases, pregnancy prevention, and substance abuse, with
their provider. In recognition of these facts and in pursuit of the
lifesaving goal of ensuring that minors get the health care they need, the
overwhelming majority of States have enacted laws that allow minors to
consent on their own to specific services such as prenatal care, family
planning services, testing and treatment for sexually transmitted
diseases, mental health counseling, and treatment for alcohol and/or drug
abuse.
Because laws allowing minors to self-consent to certain services were
enacted precisely to ensure that confidentiality concerns did not keep
adolescents from obtaining critical care, the Privacy Rule wisely linked
the right to consent to a service to the right to control the information
related to that service. Thus, under the existing Privacy Rule, in those
limited circumstances where a minor lawfully obtains a service without a
parent's consent, the minor (and not the parent) exercises the rights of
control over and access to the information related to that service.
The proposed modifications to the Privacy Rule would sever the
fundamental link between the minor's right to consent to a health service
and the minor's need for confidentiality. Under the proposed
modifications, a minor who lawfully obtains a service based on his or her
own consent would no longer have a right to deny his or her parent access
to the information related to that service. Rather, the proposed
modifications would give the covered entity discretion to decide, within
the bounds of State and other applicable law, whether or not to provide
the minor's parent access to the information. See proposed §
164.502(g)(3)(iii).2
By failing to guarantee minors' confidentiality, the proposed
modifications undermine the goal of the minors' consent laws - to
encourage minors to get critical health care they would otherwise forego
because of confidentiality concerns. Because the proposed modifications
would deter adolescents from seeking essential health care, we urge the
Department to retain the current version of section 164.502(g)(3).
What we believe was an oversight in the language of the proposed
modifications to section 164.502(g)(3)(iii) makes this broad discretion
over minors' health information even more problematic. Although the
preamble speaks in terms of a "provider" exercising this discretion (see
67 Fed. Reg. 14792), the text of the proposed modifications does not limit
the individuals who may exercise this discretion to the minor's treating
provider. Rather, it confers upon all covered entities the discretion to
decide whether to give a parent access to a minor's health information (so
long as the decision is consistent with State and other applicable law).
Thus, not only would physicians, nurses, and counselors who know the minor
(and in some instances the parent) be vested with such discretion, but so
would a wide range of others, including employees of health insurance
plans and hospital records rooms who have never met the minor. We believe
this to be an unintended consequence of the proposed modifications. We
urge the Department to narrow the scope of individuals who are given such
discretion to licensed health care professionals who have provided the
health care service to the minor. To accomplish this goal, we recommend
replacing "covered entity" in proposed section 164.502(g)(3)(iii) with the
phrase "covered health care provider who is a licensed, treating health
care professional."
The proposed modifications also restate and reinforce the Privacy
Rule's inappropriate deference to State law in determining who shall have
access to protected health information about minors. Under the proposed
modifications, even in those limited circumstances where the minor is
authorized to act as the individual, section 164.502(g)(3)(ii)(A) would
permit a covered entity to disclose protected health information about the
minor to a parent if State law expressly required or permitted such
disclosure.
We continue to object to deference to State laws that are less
protective of an individual's privacy than is the Privacy Rule. The
Privacy Rule generally preempts State laws that are contrary to the
regulation and less protective of an individual's privacy, but lets stand
those State laws that provide more protections. This rule not only makes
good sense but is also required by HIPAA. See 42 U.S.C. § 1320d-7. Yet
minors' health information is subject to a special rule of non-preemption
that allows all State laws regarding disclosures to parents - even those
that are contrary to the Privacy Rule and provide less protection for
privacy - to stand. This approach is misguided. A State law authorizing,
or worse, mandating disclosure of protected health information about a
minor to a parent in a case where the minor has lawfully obtained health
care services on his or her own is contrary to the policy that underlies
the Privacy Rule and provides less protection for a minor's privacy. Such
a State law should be preempted.
Thank you for considering our comments. Please feel free to contact CRLP for additional
information.
Sincerely,
Jody Ratner
NAPIL Fellowship Attorney
1 See, e.g., Jeannie S. Thrall, et al.,
Confidentiality and Adolescents' Use of Providers for Health
Information and Pelvic Examinations, 154 ARCH. OF PEDIATR. &
ADOLESC. MED. 885 (2000); Carol A. Ford, et al., Foregone Health
Care Among Adolescents, 282 JAMA 2227 (1999); T.L. Cheng, et al.,
Confidentiality in Health Care: A Survey of Knowledge, Perceptions, and
Attitudes Among High School Students, 269 JAMA 1404 (1993); Laurie S.
Zabin, et al., Reasons for Delay in Contraceptive Clinic Utilization:
Adolescent Clinic and Nonclinic Populations Compared, 12 J. ADOLESC.
MED. 225 (1991).
2 Because another section of the proposed
modifications (§ 164.502(g)(3)(ii)) deals with State and other applicable
law that explicitly requires, permits, or forbids disclosure of a minor's
protected health information to a parent, section 164.502(g)(3)(iii)
pertains only to a covered entity's decision whether to allow a parent
access to such information when State or other applicable law is silent or
ambiguous.
