On August 14th, 2002, under the guise of protecting patient privacy, the U.S. Department of Health and Human Services published final modifications to the Privacy Rule that will in fact erode the medical privacy of young people. The final modifications sever the fundamental link between a minors’ right to consent to health services and the minor’s need for confidentiality, which will deter minors from obtaining critical health services, such as testing and treatment for sexually transmitted diseases (STDs), pregnancy testing, prenatal care and contraceptives.

The modifications fail to guarantee minors’ confidentiality by giving broad discretion to health care providers to disclose medical information to a minor’s parent, so long as disclosure does not violate state law. As a recent article in the Journal of the American Medical Association found, without an assurance of confidentiality, young people will be less likely to use sexual health care services, which may increase teen pregnancies and the spread of STDs. See Reddy, et al., Effect of Mandatory Parental Notification on Adolescent Girls’ Use of Sexual Health Care Services, 288 JAMA 710 (2002). Except for one clarification, the modifications did not incorporate the Center’s suggestions submitted to the Department on April 25, 2002. (see more.) The final modifications, which were published in the Federal Register on August 14, 2002, will take effect on April 14, 2003.

The Impact of Proposed Modifications to the Federal Standards for Medical Privacy

The Center for Reproductive Rights opposes the proposed modifications to the Privacy Rule because they would deter minors from obtaining critical health services, such as testing and treatment for sexually transmitted diseases, pregnancy testing, prenatal care, and contraceptives. The proposed modifications fail to guarantee minors’ confidentiality by granting to a wide range of individuals discretion to decide whether or not to disclose information to a parent, unless state or other law explicitly prohibited such disclosure.

April 25, 2002

U.S. Department of Health and Human Services
Office for Civil Rights
Attention: Privacy 2
Hubert H. Humphrey Building
Room 425A
200 Independence Avenue, S.W.
Washington, DC 20201

COMMENTS ON PROPOSED MODIFICATIONS TO THE FEDERAL STANDARDS FOR PRIVACY OF INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION

The Center for Reproductive Rights, a legal advocacy organization dedicated to protecting and defending women's reproductive rights, is pleased to comment on the proposed modifications to certain standards in the federal regulation for privacy of individually identifiable health information ("Privacy Rule"). As an organization dedicated to ensuring that all women have access to reproductive health services, improving access to high quality health care is an integral part of our mission and the privacy of medical information is an essential component of such care. Medical privacy is especially important to women because they are the highest users of health care and consumer services and because of their need for sensitive, confidential services involving their reproductive health.

Without confidence that private information will remain just that -- private -- women are reluctant to share information with their health care professionals -- to the detriment of their own health. Fear that medical information is not kept confidential also discourages women from obtaining health care services or forces them to go outside their health plan and incur significant out-of-pocket expenses.

The Department of Health and Human Services has requested comments on the proposed modifications. The Center endorses and has signed on to the comments filed separately by the Health Privacy Project, Institute for Health Care Research and Policy at Georgetown University. In addition, we highlight in the following comments one area of particular concern to young women.

Proposed Modifications to Sec. 164.502(g)(3):
The Department proposes to modify the Privacy Rule's approach to balancing the rights of minors and parents by permitting covered entities to decide when to disclose protected health information about a minor to a parent in cases where State or other applicable law is silent or unclear.

Center for Reproductive Rights Recommendation:
The Center opposes the proposed modifications because they would deter minors from obtaining critical health services, such as testing and treatment for sexually transmitted diseases, pregnancy testing, prenatal care, and contraceptives. We recommend that the Department retain the approach in the current Privacy Rule, except its approach to non-preemption of State laws that are less protective of a minor's privacy. Specifically, we recommend that the Department apply the same preemption rules to State laws pertaining to minors and disclosures to parents that the Department applies to other State laws, as HIPAA requires.

Rationale:
As currently written, the Privacy Rule strikes a careful balance between the need for parents to have access to their children's health information and the need for adolescents to feel secure that their health information will be kept private in certain limited circumstances. Thus, under the Privacy Rule, parents are generally treated as the personal representatives of their unemancipated minor children and given control over and access to their children's health information. Based upon significant research and standard medical practice, however, the Privacy Rule contains narrow exceptions to this general rule.

One of these exceptions gives a minor control over and access to information related to health services that the minor lawfully obtains based on his or her own consent. See § 164.502(g)(3)(i). Numerous studies have found that confidentiality is one of the prime determinants of whether an adolescent seeks and obtains timely health care related to sensitive topics such as mental health, substance abuse, and sexuality. For example, studies show that somewhere between eight and thirty-one percent of teens delay or entirely forego health care because of concerns that their private information will be revealed to parents or others.¹ In addition, research confirms that teens who believe that their health care provider will maintain their confidentiality are more likely to discuss sensitive health topics, such as sexually transmitted diseases, pregnancy prevention, and substance abuse, with their provider. In recognition of these facts and in pursuit of the lifesaving goal of ensuring that minors get the health care they need, the overwhelming majority of States have enacted laws that allow minors to consent on their own to specific services such as prenatal care, family planning services, testing and treatment for sexually transmitted diseases, mental health counseling, and treatment for alcohol and/or drug abuse.

Because laws allowing minors to self-consent to certain services were enacted precisely to ensure that confidentiality concerns did not keep adolescents from obtaining critical care, the Privacy Rule wisely linked the right to consent to a service to the right to control the information related to that service. Thus, under the existing Privacy Rule, in those limited circumstances where a minor lawfully obtains a service without a parent's consent, the minor (and not the parent) exercises the rights of control over and access to the information related to that service.

The proposed modifications to the Privacy Rule would sever the fundamental link between the minor's right to consent to a health service and the minor's need for confidentiality. Under the proposed modifications, a minor who lawfully obtains a service based on his or her own consent would no longer have a right to deny his or her parent access to the information related to that service. Rather, the proposed modifications would give the covered entity discretion to decide, within the bounds of State and other applicable law, whether or not to provide the minor's parent access to the information. See proposed § 164.502(g)(3)(iii).²

By failing to guarantee minors' confidentiality, the proposed modifications undermine the goal of the minors' consent laws - to encourage minors to get critical health care they would otherwise forego because of confidentiality concerns. Because the proposed modifications would deter adolescents from seeking essential health care, we urge the Department to retain the current version of section 164.502(g)(3).

What we believe was an oversight in the language of the proposed modifications to section 164.502(g)(3)(iii) makes this broad discretion over minors' health information even more problematic. Although the preamble speaks in terms of a "provider" exercising this discretion (see 67 Fed. Reg. 14792), the text of the proposed modifications does not limit the individuals who may exercise this discretion to the minor's treating provider. Rather, it confers upon all covered entities the discretion to decide whether to give a parent access to a minor's health information (so long as the decision is consistent with State and other applicable law). Thus, not only would physicians, nurses, and counselors who know the minor (and in some instances the parent) be vested with such discretion, but so would a wide range of others, including employees of health insurance plans and hospital records rooms who have never met the minor. We believe this to be an unintended consequence of the proposed modifications. We urge the Department to narrow the scope of individuals who are given such discretion to licensed health care professionals who have provided the health care service to the minor. To accomplish this goal, we recommend replacing "covered entity" in proposed section 164.502(g)(3)(iii) with the phrase "covered health care provider who is a licensed, treating health care professional."

The proposed modifications also restate and reinforce the Privacy Rule's inappropriate deference to State law in determining who shall have access to protected health information about minors. Under the proposed modifications, even in those limited circumstances where the minor is authorized to act as the individual, section 164.502(g)(3)(ii)(A) would permit a covered entity to disclose protected health information about the minor to a parent if State law expressly required or permitted such disclosure.

We continue to object to deference to State laws that are less protective of an individual's privacy than is the Privacy Rule. The Privacy Rule generally preempts State laws that are contrary to the regulation and less protective of an individual's privacy, but lets stand those State laws that provide more protections. This rule not only makes good sense but is also required by HIPAA. See 42 U.S.C. § 1320d-7. Yet minors' health information is subject to a special rule of non-preemption that allows all State laws regarding disclosures to parents - even those that are contrary to the Privacy Rule and provide less protection for privacy - to stand. This approach is misguided. A State law authorizing, or worse, mandating disclosure of protected health information about a minor to a parent in a case where the minor has lawfully obtained health care services on his or her own is contrary to the policy that underlies the Privacy Rule and provides less protection for a minor's privacy. Such a State law should be preempted.

Thank you for considering our comments. Please feel free to contact us for additional information.

Sincerely,


Jody Ratner
NAPIL Fellowship Attorney

1 See, e.g., Jeannie S. Thrall, et al., Confidentiality and Adolescents' Use of Providers for Health Information and Pelvic Examinations, 154 ARCH. OF PEDIATR. & ADOLESC. MED. 885 (2000); Carol A. Ford, et al., Foregone Health Care Among Adolescents, 282 JAMA 2227 (1999); T.L. Cheng, et al., Confidentiality in Health Care: A Survey of Knowledge, Perceptions, and Attitudes Among High School Students, 269 JAMA 1404 (1993); Laurie S. Zabin, et al., Reasons for Delay in Contraceptive Clinic Utilization: Adolescent Clinic and Nonclinic Populations Compared, 12 J. ADOLESC. MED. 225 (1991).
2 Because another section of the proposed modifications (§ 164.502(g)(3)(ii)) deals with State and other applicable law that explicitly requires, permits, or forbids disclosure of a minor's protected health information to a parent, section 164.502(g)(3)(iii) pertains only to a covered entity's decision whether to allow a parent access to such information when State or other applicable law is silent or ambiguous.