Protecting Survivors of Intimate Partner Violence Under the Cures Act

Introduction

Survivors of intimate partner violence (IPV) and their children often seek care in emergency departments (EDs) after IPV exposure.¹ Abusers may interfere with healthcare by accessing the electronic health records (EHRs) of victims legally, as a proxy or guardian, or duplicitously.² Discovery of IPV disclosure through EHRs may subject victims to healthcare access restrictions and escalated violence.²

In April 2021, the 21st Century Cures Act federally mandated the release of clinician notes to patients without charge or delay.³ Reported benefits of the Cures Act include improved understanding of treatment plans and satisfaction with healthcare encounters.^{3, 4} However, providers have raised safety concerns for IPV victims given increases in technology-facilitated violence.^{2, 4} Although the act incorporates exceptions to note-sharing (e.g. harm prevention),^{3, 5} no existing guidelines address appropriate application in IPV encounters. This is the first study to describe note-sharing and discussions about EHR safety in ED encounters for IPV since implementation of the Cures Act.⁵

Methods

We conducted a chart review of encounters at one pediatric and three general EDs for IPV-related care between February 1, 2021, when our institution implemented the Cures Act, and June 14, 2022 (Supplemental Methods). The study sites were academic and community EDs within one healthcare system with annual volumes between 25,000–100,000 encounters. Encounters for medical, psychological, or safety concerns directly related to IPV, defined as violence against a current or former intimate partner, were included.

Social work (SW) consults were routinely offered, although patients could decline. Medical clinician notes were immediately and automatically released upon signing. Although clinicians could specify a reason for unsharing a note, no protocol existed for documenting related decision-making or patient discussions. In contrast, SW notes, which contained a built-in screener about abuser EHR access, were not shared.

This study was exempt by the study sites’ Institutional Review Board. Data are summarized descriptively (SPSS v28).

Results

5,596 charts were identified by International Classification of Diseases, Tenth Revision (ICD-10-CM) codes; 190 met inclusion criteria (Supplemental Figure 1). Agreement on inclusion was 98.2% (kappa=0.72, 95%CI 0.57–0.89). Median age was 34 years for adult and 6 years for pediatric encounters (Table 1).

Table 1.

Patient demographics and encounter characteristics.

	Adult encounters 2003 (n=165)	Pediatrica encounters (n=25)
Median age, years (IQR)	34 (25–43)	6.0 (0.5–13)
Sex, n (%)
Female	146 (88)	15 (60)
Gender, n (%)b
Female	86 (52)	6 (24)
Race/Ethnicity, n (%)
White	55 (33)	5 (20)
Black	54 (33)	4 (16)
Hispanic/Latino	49 (30)	15 (60)
Other	7 (4)	1 (4)
Language preference, n (%)
English	151 (92)	24 (96)
Spanish	13 (8)	1 (4)
Other	1 (0.6)	0 (0)
Private insurance, n (%)	52 (32)	9 (36)
Type of IPV involvementc, n (%)
Direct	165 (100)	9 (36)
Exposure	0 (0)	16 (64)
Type of chief complaint, n (%)
Trauma	101 (61)	15 (60)
Medical	34 (21)	7 (28)
Psychiatric	30 (18)	3 (12)
Social work involvement, n (%)	136 (82)	18 (72)
EHRd discussed with patient, n (%)	99 (60)	7 (28)
By ED clinician	1 (0.6)	0 (0)
By social worker	98 (59)	7 (28)
Note-sharing statusf, n (%)
Shared	156 (95)	21 (84)
Note viewed by patient	29 (18)	2 (8)
Note viewed by proxye	0 (0)	5 (25)
Unshared	4 (2)	4 (5)

^aPediatric was defined as <18 years old based on age limit of guardian proxy access to a child’s patient portal.

^bGender was not recorded for all patients.

^cDirect intimate partner violence (IPV) involvement was defined as abuse involving an intimate partner, regardless of age. For example, an adolescent patient who was abused by a boyfriend was classified as direct involvement. Exposure was defined as a child evaluated after identified IPV between two adult individuals.

^dElectronic health record.

^eAt our institution, guardians have proxy access to their children’s patient portal until the child turns 18 years old, with access restrictions beginning at age 13.

^fNo value was recorded for five notes.

EHR safety discussions were documented in 60% of adult and 28% of pediatric encounters; 99% of these documentations were in the SW note. Four adult (2%) and four pediatric (5%) notes were unshared (Table 1). Five notes provided reasons for unsharing, citing harm prevention and patient request. Three notes were shared despite patient disclosure to the SW of concerns about abuser EHR access (Table 2).

Table 2.

Encounters with shared notes despite patient concerns about abuser EHR access.

Case summary	Reported safety concerns
27-year-old female initially reported head and foot injury after falling out of a car. She later disclosed that she was being physically abused by her boyfriend.	Patient reported being unsafe to return home where she resides with her boyfriend. Upon social work screening, she reported concerns regarding his access to her portal account.
37-year-old female presented after physical assault by her boyfriend when he choked her and punched her in the head.	Patient reported that her abuser has access to her portal account and that he has broken into her family members’ homes previously.
64-year-old female presented for lower extremity pain. She later disclosed that her husband repeatedly verbally abused and threatened her while intoxicated.	Patient reported that she felt unsafe returning home. Upon social work screening, she reported concerns regarding his access to her portal account.

Discussion

In this first study examining EHR safety for patients presenting to EDs for IPV-related care since implementation of the Cures Act, discussions about EHR safety were documented infrequently and mostly by SW. Additionally, clinician notes were rarely unshared and three notes were shared despite patient disclosure to SW of concern about abuser access.

Our study has at least four limitations. Information in ED notes may be incomplete. For example, discussions or sensitive material may have been omitted due to patient request. The small sample from a single healthcare system limits generalizability of results and examination of potential contributing factors. Ongoing educational efforts about the Cures Act may have improved awareness about EHR safety since data collection ended. Lastly, some IPV encounters may not have been captured by our list of ICD-10-CM codes.

In discussions about EHR safety, providers can use shared decision-making to identify patients’ preferences for accessing medical records.^{2, 4, 5} When available, SW can help overcome barriers in IPV-related care, including time constraints, to facilitate these discussions.⁶ At our institution, SW findings are not automatically conveyed to clinicians, which may have contributed to notes being shared despite patient concerns. Our findings underscore the necessity of streamlined coordination between SW and clinicians to improve safety.⁶

Changes driven by institutions may further optimize patient safety while minimizing clinician burden. Examples include the development of guidelines for IPV-related documentation and implementation of automated functions, such as alerts to clinicians about SW findings, selective unsharing of notes, or separation of IPV-related documentation from the main encounter.^{2, 4} As patient access to medical records increases, healthcare systems, medicolegal counsel, clinicians, SW, and patient representatives must come together to optimize EHR safety for families living with IPV.