Home

  • Home
    • » e-Newsletters

Clear up the confusion surrounding minors' privacy

HIPAA Training Advisor, June 14, 2007

Sift through HIPAA, state laws
Minors' privacy rights are a confusing aspect of HIPAA because they involve a tangle of state and federal regulations that each covered entity must sort out individually.

"It's one of the murkiest areas of HIPAA," says James M. Barclay, Esq., a Tallahassee healthcare attorney. "It's a combination of federal laws and state laws, and the state laws are going to vary from state to state."

A good understanding of the privacy rule and state law should help you craft a sensible policy to deal with the issue, experts agree. The first step is having a good understanding of your state laws because, in many cases, they will be the prevailing factors. For example, it's state law that will determine which minors are emancipated and, therefore, which ones you can treat as adults under HIPAA.

Unemancipated minors
In general, when dealing with unemancipated minors, the privacy rule requires their parents' or guardians' authorization to release records and allows parents or guardians to access the medical records of their children. This generally includes natural or adopted parents or a court-appointed legal guardian. State law will usually determine the parent or guardian and who has a right to see the records, says Chicago-based healthcare attorney William Roach Jr., Esq.

"The privacy rule, as a general matter, requires a covered entity to recognize the authority of a person given that authority under state law to govern access to a minor's records," says Roach. "It's driven by state law."

But the situation can be difficult. Warring divorced parents may want a covered entity to deny each other's access to records. But unless one parent has lost his or her parental rights, HIPAA does not permit the covered entity to deny access to the records-unless state law has provisions as such.

Also ask to see the custody order in such cases to find out whether there are any limitations on a parent's rights, Roach adds. You also should check any court orders granting guardianship, in case there are limits to the guardian's rights that might prevent him or her from obtaining the minor's records.

However, you aren't obligated to ask for the paperwork if you have no reason to suspect a problem, Roach says. You can rely on what the parent or guardian tells you when they bring the child in. If the existing legal papers don't settle the question, you can go to court-if there's time-to decide how to handle the matter, says Barclay.

Sometimes parents send their children in for care under a babysitter's supervision because they're working or unavailable. Without a parent's specific authorization to release information to the sitter, you must release to him or her only the minimum information necessary for the child's care. So a doctor can tell a babysitter that the child needs an aspirin but cannot go into detail about the child's condition, Roach says.

Also keep in mind that just because a child is covered by a parent or guardian's insurance, that doesn't mean that the parent or guardian is automatically entitled to have access to the minor's PHI. So if a minor books an appointment on his or her own and the parent sees it on an insurance statement and calls for information, you should check to make sure that the parent is entitled to that information, he says.

Exceptions to the rule
There are three exceptions to the general rule that parents are entitled to access to their children's health records:

  1. If a state law allows a minor to receive a particular service-such as an abortion-without a parent's consent, and the minor consents to the service, then the minor controls who has access to those records. The parent can't access the PHI without the minor's authorization.
  2. If a court appoints a guardian to make treatment decisions for the minor, the guardian determines who can access the minor's records. The guardian can deny the parents access to the records if he or she thinks it's in the best interest of the child.
  3. If the parent or guardian agrees to a confidential relationship between the healthcare provider and the child concerning a healthcare service, then the child controls access to the records.

However, these three exceptions are not hard and fast. HIPAA allows you to disclose the information covered by these exceptions if state law permits-though HIPAA does not require the covered entity to do so, says Roach. A licensed healthcare professional exercising professional judgment must decide whether to disclose.

This stance is because some states have passed laws allowing minors to consent to certain controversial treatments without a parent's consent (e.g., drug treatment or birth control) as a public health measure, but other states have passed blanket parental-access laws that give parents the right to see everything.

"It's a good example of the government not wanting to deal with a topic and then obscuring the issue," Roach says. What all this means in practice is that the final say is that you must create your own policy, taking into account both HIPAA and your state's laws. Your policy will also have to consider that more protective state laws preempt HIPAA-so your attorney may need to weigh in, Roach says.

Most Popular