February 12, 2019

Roger Severino, Director
Office for Civil Rights
Department of Health and Human Services
Attention: HHS-OCR-0945-AA00
Hubert H. Humphrey Building, Room 509F
200 Independence Avenue, SW
Washington, DC 20201

RE: Request for Information on Modifying HIPAA Rules to Improve Coordinated Care HHS-OCR-0945-AA00
Submitted electronically at http://www.regulations.gov

Dear Director Severino,

The Society for Adolescent Health and Medicine appreciates the opportunity to respond to this HHS Office for Civil Rights request for information (RFI) on “Modifying HIPAA Rules to Improve Coordinated Care.” For health care professionals and their patients, the HIPAA Privacy Rule has provided a strong foundation of privacy protection. The protections afforded by the Rule are essential to assuring that adolescents and young adults will seek the health care they need.

Founded in 1968, the Society for Adolescent Health and Medicine (SAHM) is a multidisciplinary organization committed to improving the physical and psychosocial health and well-being of all adolescents and young adults through advocacy, clinical care, health promotion, health service delivery, professional development, and research.

SAHM recognizes that coordinated care is an essential element in the provision of high-quality health care that meets the needs of all patients, including adolescents and young adults. Improvements are needed in care coordination and communication within the health care system. This task becomes more challenging as health information about patients and their care expands and is increasingly digitized and shared via a plethora of devices on multiple platforms. While federal laws governing portability and privacy have not kept up, the HIPAA Privacy Rule remains a critically important foundation for protecting patients’ health information. The essential protections the Rule provides for the health information of adolescents and young adults must be preserved.

To ensure protection of patient privacy while improvements in care coordination are sought, SAHM offers the following responses to selected questions in the OCR RFI.
Question 18 & 19: Should OCR modify the Privacy Rule to clarify the scope of covered entities' ability to disclose PHI to social services agencies and community-based support programs where necessary to facilitate treatment and coordination of care with the provision of other services to the individual? Should OCR expressly permit disclosures of PHI to multi-disciplinary/multi-agency teams tasked with ensuring that individuals in need in a particular jurisdiction can access the full spectrum of available health and social services?

SAHM recognizes the importance of social determinants of health in shaping health outcomes for adolescents and young adults and contributing to the obstacles they encounter in obtaining health care or other services to address their health-related concerns. In particular, health care providers increasingly recognize that they cannot meet their patients’ medical needs without also addressing their complex social and behavioral needs. Many health care providers are tackling these issues by partnering with social service providers to improve access to healthy food, safe housing, transportation, education, job training, and more. However, because of misconceptions and misinterpretations of the Privacy Rule, many others are not.

SAHM believes providing holistic care and addressing adverse social determinants of health requires health care and social service providers to share information, but this should not come at the expense of patient privacy. Fortunately, HIPAA already allows the exchange of patient information while also ensuring that this information remains protected and private. However, there continue to be perceived barriers and inconsistent interpretations by health care providers. Overcoming these perceived barriers is critical to increasing the willingness of partners to share data and provide more holistic, patient-centered care.

SAHM does not believe it is necessary to modify the Privacy Rule or add express regulatory permission for covered entities to disclose protected health information (PHI) to social service agencies or community-based support programs when doing so is necessary to further a patient’s health or mental health care because this disclosure is already permitted. However, SAHM encourages OCR to provide additional clarifying guidance to: respond to the uncertainty that exists among covered entities about what is and what is not permitted; facilitate greater and improved education to health care providers and to patients and their caregivers, as well as to social service providers who are not “covered entities,” regarding the provisions of HIPAA that permit uses and disclosures of PHI; and disseminate best practices— such as how to obtain patients’ authorization for release of information or to create effective memoranda of understanding—to provide examples of how to share information in compliance with HIPAA.

Special concerns arise in connection with adolescents in the child welfare system. SAHM urges preservation of privacy protection for the PHI of young people involved in child welfare—including both adolescents who are minors and those who become adults while remaining in the system beyond age 18—and the continued requirement of HIPAA consent for the sharing of their health information in this context. While circumstances exist in which it may be important for those serving in a parental role for a minor adolescent in foster care to have access to their PHI, this should occur consistent with existing privacy protections and security measures. It is also important to protect against the further sharing of this information outside of contexts in which it is specifically relevant to an adolescent’s health care.

SAHM urges that OCR not expressly permit disclosure of PHI to multi-disciplinary teams outside of physical and mental health treatment settings, or contracted providers who provide out-of-home care services. The sharing of PHI in this context should require consent and should not provide open access to all of an adolescent’s PHI. Special concerns arise with respect to sharing information with law enforcement and permission to do so should not be expanded beyond what the Privacy Rule currently allows.

Question 20: Would increased public outreach and education on existing provisions of the HIPAA Privacy Rule that permit uses and disclosures of PHI for care coordination and/or case management, without regulatory change, be sufficient to effectively facilitate these activities? If so, what form should such outreach and education take and to what audience(s) should it be directed?

Although, HIPAA is often perceived as a barrier to information sharing and exchange, SAHM believes the current regulations allow for appropriate information sharing. The regulatory framework of HIPAA is effective, but properly resourced outreach and education can help alleviate the perceived burden while protecting patients’ informed consent, privacy, and confidentiality. Outreach and education must be directed at multiple audiences, including providers, caregivers, and, importantly, patients themselves. Outreach and education should also include a focus on how state and other federal laws interact with HIPAA, including situations where the Privacy Rule defers to state and other federal laws that include even stronger privacy protections. Regulatory change is not necessary to achieve the benefits that could result from increased outreach and education efforts.

Question 22: What changes can be made to the Privacy Rule to help address the opioid epidemic? What risks are associated with these changes? For example, is there concern that encouraging more sharing of PHI in these circumstances may discourage individuals from seeking needed health care services? Also is there concern that encouraging more sharing of PHI may interfere with individuals' ability to direct and manage their own care? How should OCR balance the risk and the benefit?

SAHM appreciates efforts to better address the multifaceted impacts of the opioid epidemic, and the goal of improving and better coordinating care for individuals experiencing substance use disorder (SUD) is laudable. Coordination of care across settings permits service integration that is centered on the comprehensive needs of the patient and family, leading to decreased health care costs, reduction in fragmented care, and improvement in the patient/family experience of care. Policies that limit the ability of medical and psychiatric providers to access information regarding behavioral health problems, including both mental health and SUD, and prevent the sharing of information between providers significantly limit the ability to ensure continuity and care coordination. This applies as a broad principle, and there is nothing specific to the opioid epidemic per se that would require a unique carve-out or deviation from general medical practices. As such, SAHM encourages the adoption of policies and practices that enable information sharing and facilitate effective care coordination in ways that are consistent with patient-centered care and patients’ ability to direct their care and the use and disclosure of their health information. Although HIPAA is often perceived as an impediment to sharing of information between health care providers, in reality the Privacy Rule allows such sharing for treatment purposes and thus the Rule does not need to be changed to do so.

SAHM, along with other medical societies, affirms the value of parental involvement in decision-making by adolescents and the importance of productive family communication in general. Health care providers, guided by their expertise, training, and experience, as well as extensive practice standards and recommendations, already assist adolescents to involve their families in decisions about health care matters when realistic and appropriate. Additionally, health care providers commonly consider the age of the patient and the patient’s competence in making medical decisions. If the patient is deemed not competent to make a decision, then a health care provider will contact a parent or guardian, after informing the patient.

Nevertheless, maintaining confidentiality is critical for patients—including adolescents and young adults—seeking treatment for SUD and other sensitive health care services. Confidentiality protections are grounded in law and ethics and supported by research.i Young adults have the right to make medical decisions for themselves and to confidentiality protection for their health information; adolescents who are minors also often have these rights. State laws allow many minors to consent for their health care either on the basis of their status (e.g., as an emancipated or mature minor or a homeless youth living apart from parents) or on the basis of the services they seek (e.g., substance use counseling/treatment and mental health care). Many state laws also provide confidentiality protection for minors who can consent to their own care. If young people cannot trust that their health information will be both private and secure, they may not seek essential health services, delay in doing so, or withhold essential information from their health care provider. ii,iii,iv,v,vi,vii In specific situations, allowing families access to health care and treatment information can jeopardize the safety and well-being of adolescents or young adults who may face vindictive actions, violence, or other adverse consequences based on information obtained by family members. The Privacy Rule recognizes this and allows providers to refrain from treating parents as personal representatives or withhold information from them when they are responsible for abuse or neglect. At the same time, health care providers already have the ability to break confidentiality when a patient’s life is in immediate danger. Family members should not be granted additional access to PHI if a patient has not consented to such disclosures, as this may have the unintended effect of causing that individual to avoid necessary and life-saving treatment. As such, any proposed changes to the HIPAA Privacy Rule should be limited solely to provider-provider communication. 

Question 23: How can OCR amend the HIPAA Rules to address serious mental illness? For example, are there changes that would facilitate treatment and care coordination for individuals with SMI, or ensure that family members and other caregivers can be involved in an individual's care? What are the perceived barriers to facilitating this treatment and care coordination? Would encouraging more sharing in the context of SMI create concerns similar to any concerns raised in relation to the previous question on the opioid epidemic? If so, how could such concerns be mitigated?

As stated above, SAHM is supportive of efforts to effectively coordinate care and recognizes the benefits to patients when information can be shared among providers to better achieve this goal. However, privacy protections for individuals with serious mental illness (SMI) are critically important. Similar to the criteria outlined with regard to individuals experiencing SUD, efforts to improve care coordination should be limited to sharing of information between health care providers for treatment purposes, as the Privacy Rule already allows, and should not automatically allow access to sensitive health care information by family members or other caregivers. For some people with SMI, family involvement is detrimental or dangerous, especially for a vulnerable adolescent or young adult. Individual patients should always be able to designate who may have access to their information; and there should not be a blanket assumption that a family member is supportive or should have access to PHI, particularly in cases where abuse or neglect has occurred. Individuals with SMI or SUD should not lose their right to confidential care solely based on their disorder. While family members are often supportive and therefore their involvement is often desirable, the Privacy Rule must continue to protect those who do not have the benefit of positive family support and protection.

Question 25: Could changes to the Privacy Rule help ensure that parents are able to obtain the treatment information of their minor children, especially where the child has substance use disorder (including opioid use disorder) or mental health issues, or are existing permissions adequate? If the Privacy Rule is modified, what limitations on parental access should apply to respect any privacy interests of the minor child? (a) Currently, the Privacy Rule generally defers to state law with respect to whether a parent or guardian is the personal representative of an unemancipated minor child and, thus, whether such parent or guardian could obtain PHI about the child as his/her personal representative; if someone other than the parent or guardian can or does provide consent for particular health care services, the parent or guardian is generally not the child's personal representative with respect to such health care services. Should these standards be reconsidered generally, or specifically where the child has substance use disorder or mental health issues? (b) Should any changes be made to specifically allow parents or spouses greater access to the treatment information of their children or spouses who have reached the age of majority? If the Privacy Rule is changed to encourage parental and spousal involvement, what limitations should apply to respect the privacy interests of the individual receiving treatment?

Changes should not be made to the HIPAA Privacy Rule to give parents or caregivers greater access to the PHI of adolescent minors or young adults, either generally or specifically with respect to substance use disorder or mental health issues. As mentioned above, these young people may not seek access to health care services, including for substance use or mental health concerns, if they cannot trust that their health information will be both private and secure. This is true for both minor adolescents and young adults who have attained the legal age of majority. Maintaining strong confidentiality protections for adolescents and young adults is critical to assuring the well-being of young people who may face negative consequences in the event that family members have access to their health care information. This extends to adolescents and young adults experiencing SUD or SMI, and the presence of these conditions does not justify weakening confidentiality and privacy protections.

The Privacy Rule strikes the appropriate balance in determining when parents have the right to access their unemancipated minor child’s PHI. The Rule recognizes that some minors are allowed to consent for their own care. In those circumstances, the Rule appropriately defers to state or other applicable law regarding when a parent may have access to the minor’s PHI. Additionally, it is appropriate to continue to defer to state law with respect to whether a parent or guardian is the personal representative of an unemancipated minor child and is able to access a child’s PHI on that basis, as well as to grant discretion to a health care provider not to treat a parent as a personal representative in specific situations involving abuse, neglect, or endangerment, or where it would not be in the minor’s best interest. SAHM also does not believe that changes are appropriate that would allow parents to have increased access to the treatment information of their adult children. The Privacy Rule already allows such access with permission of the patient or if the patient does not object. Likewise, we do not believe that OCR should make changes to the Privacy Rule to make it easier for spouses to obtain each other’s treatment information. The limitations already in place are an important protection in the case of a spouse seeking sensitive health services and/or in cases of intimate partner violence. Maintaining confidentiality for survivors of intimate partner violence is paramount to preserving the safety, privacy, and trust of those seeking services.

Question 26: The Privacy Rule currently defers to state or other applicable law to determine the authority of a person, such as a parent or spouse, to act as a personal representative of an individual in making decisions related to their health care. How should OCR reconcile any changes to a personal representative's authority under HIPAA with state laws that define the scope of parental or spousal authority for state law purposes?

SAHM urges HHS to continue to defer to state or other applicable law to determine the authority of a person, such as a parent or spouse, to act as a personal representative of an individual in making health care decisions. Access to PHI by family members or spouses that is not desired by a patient can present a threat to the safety and well-being of all individuals, particularly in situations involving child or spousal abuse. It is critical that health care decisions be made between patient and provider, incorporating additional decision-makers such as family members as appropriate based on the counsel of the health care provider and the desires of the patient. Therefore, HIPAA regulations should not include a blanket presumption that there are instances in which third parties are appropriate decision-makers, but rather should continue to defer to the judgment of state or other law. The Society for Adolescent Health and Medicine urges OCR to maintain the protections in the HIPAA Privacy Rule that are essential to health care access and provision of quality health care for adolescents and young adults, while it seeks ways to improve care coordination.

Sincerely,

Deborah Christie, PhD, FSAHM
President, Society for Adolescent Health and Medicine

i Ford C, English A, Sigman G. Confidential health care for adolescents: Position paper of the Society for Adolescent Medicine. J Adolesc Health. 2004;35(2):160-167. doi:10.1016/j.jadohealth.2004.03.00.
ii Cheng TL, Savageau JA, Sattler AL, DeWitt TG. Confidentiality in health care: A survey of knowledge, perceptions, and attitudes among high school students. JAMA. 1993;269(11):1404-1407. doi:10.1001/jama.1993.03500110072038.
iii Ford CA, Millstein SG, Halpern-Felsher BL, Irwin CE Jr. Influence of physician confidentiality assurances on adolescents’ willingness to disclose information and seek future health care. A randomized controlled trial. JAMA. 1997;278(12):1029– 1034pmid:9307357
iv Klein JD, McNulty M, Flatau CN. Adolescents’ access to care: teenagers’ self-reported use of services and perceived access to confidential care. Arch Pediatr Adolesc Med. 1998;152(7):676–682pmid:9667540
v Ford CA, Bearman PS, Moody J. Foregone health care among adolescents. JAMA. 1999;282(23):2227-2234. doi:10.1001/jama.282.23.2227.
vi Weddle M, Kokotailo P. Adolescent substance abuse: Confidentiality and consent. Pediatr Clin N Am. 2002;49(2):301-315. vii Britto MT, Tivorsak TL, Slap GB. Adolescents’ needs for health care privacy. Pediatrics. 2010;126(6).

More in this Section