I Thought You Said This Was Confidential? Challenges to protecting privacy for teens and young adults

Abstract

A 19-year-old woman on immunomodulatory therapy presents to her provider for a routine physical. She is diagnosed with chlamydia trachomatis during screening for sexually transmitted infections (STIs) and returns to the clinic for directly observed treatment with azithromycin. She later calls the practice to express dismay that her parents questioned her about her sexual activity after they received an explanation of benefits for services rendered.

While such situations are not necessarily unique to adolescents/young adults (AYA), they will become increasingly common if the dependent coverage expansion provision of the Affordable Care Act (ACA) persists. Recent estimates suggest that nearly 7 million uninsured AYA have gained health insurance since 2010, approximately half due to the ACA’s dependent coverage expansion;¹ millions more will maintain their dependent coverage for longer periods as a result of this policy.² This influx of patients is accompanied by complex legal and ethical issues surrounding privacy that affect AYA generally, but particularly affect young adults covered as dependents whose legal status makes privacy violations unlawful. Our current system is ill-equipped to protect sensitive information while simultaneously delivering high-quality, affordable care for this population and adhering to legal requirements that differ by age. Pediatricians must educate themselves on these challenges as many care for patients until age 18, 21, or beyond.

A pressing threat to confidentiality stems from billing and claims processes, as insurance companies routinely send explanation of benefits forms (EOBs) to policyholders when care is provided to a dependent; many states require that EOBs be sent to policyholders.³ These forms detail who received care, where they received care, and what type of care was received, and can thus violate confidentiality for anyone insured as a dependent. The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule permits the use of protected health information to secure payments. HIPPA has two special protections that allow patients to request (1) restrictions on disclosure (e.g., request withholding an EOB) or (2) communications by alternate means or at alternative locations to safeguard against potential disclosures (see 45 C.F.R. §§ 164.522(a)(1); 164.502(h); 164.522(b)(1)). However, patients must initiate these requests and providers and payers are only required to comply with the former when the service has been paid fully out-of-pocket; providers must comply in the latter case given reasonable requests but payers are only required to comply when there is a claim of endangerment. A growing number of states are addressing this issue by building on HIPAA to strengthen privacy protections,⁴ current approaches vary widely across states. Furthermore, insurance companies often communicate only with the policyholder, preventing dependents from privately submitting a claim on their own behalf, receiving reimbursement, or inquiring about benefits or cost-sharing. These confidentiality concerns could be addressed by establishing policies that limit payers’ communications when sensitive services are provided to dependents or facilitate direct communication between dependents and payers, and by informing AYA about the potential for inadvertent disclosure during billing.⁵

Absent clear procedures that protect AYA privacy during billing for sensitive services, providers face an ethical dilemma: bill for services accurately and risk exposing the nature of the visit to a parent; bill such that reasons for the visit are not easy to ascertain; or not perform/bill for the needed services. In an effort to skirt disclosures during the provision/billing of sensitive health services, providers may recommend self-pay out-of-pocket (OOP) or refer to community health centers or nonprofits like Planned Parenthood.⁶ However, OOP costs for many services may be prohibitive for the average AYA (e.g., receiving three HPV shots may cost ≥$500 OOP). Even smaller amounts, such as $50–75 for over-the-counter emergency contraception, likely constitute a non-trivial financial burden since labor force participation and median earnings are substantially lower for AYA compared to older adults. There are societal costs as well: referring gainfully insured AYA to points of care designed to serve vulnerable populations strains already limited resources – which may be particularly concerning if sustaining funding streams (e.g., Medicaid or Title X for family planning and preventive services) are reduced or eliminated. Even if free or discounted care at another site is available, it may require an unreasonable amount of time and/or transportation to access. Regrettably, practitioners often aren’t aware of OOP costs for services they provide or accessible, alternative sources of care, which can prevent a productive discussion about these options with their patients.

Privacy concerns also arise with unintentional disclosure through conveniences such as pharmacy refill reminders or online health portals. Although well-intentioned, modifications to HIPAA that facilitate direct access to lab results without provider release means that many labs can be accessed directly by both patients and anyone else knowledgeable of a few key identifiers. Health systems should strive to build EHRs and patient portals that facilitate locked access to sensitive personal health information. Similarly, many pharmacies facilitate prescription medication management for multiple patients through a single account, but these systems could restrict/partition access to individual information or flag sensitive medications for separate authorization/notifications sent only to the individual. Avoiding breaches of privacy from such electronic and/or automated systems is achievable but incentivizing these modifications may require various policy levers; several states have taken affirmative steps to address this with both new policies and by building on existing regulations.⁴

Discussions of the importance of delivering confidential care to AYA should also include a nuanced examination of the need for parents/caregivers to be active participants in their child’s care. Many AYA with special health care needs (SHCN), like the patient in the example case, may choose to involve their parent/caregiver in health care decisions and care coordination after they are legal adults. These situations require patients and providers to differentiate and balance the need for caregiver-assistance for some types of care (e.g., pediatric-onset chronic conditions) but not others (e.g., sexual/reproductive health); indeed, AYA’s concerns about privacy for sexual health information reduces STI screening.⁷ Providers should be aware of these needs and prepared to document their discussions with AYA about what information is appropriate to disclose, when, and to whom. Ultimately, these conversations may encourage AYA with SHCN to take a more active role in their care, an important step for transitioning to an adult-centered medical home.

The federal dependent coverage expansion has had a measurable impact on both insurance coverage and health outcomes for AYA.⁸ Although the future of the ACA is presently uncertain,⁹ privacy issues are likely to remain. Providers, payers, and related entities can proactively address privacy issues for AYA, both by working within existing laws and by collaborating to devise and implement new solutions, including specifying new protections at the state level. Providers can circumvent many potential privacy violations by asking AYA about their coverage source and notifying patients when disclosure may occur. Practices and payers should be informed about both state and federal statutes that affect disclosure of confidential information and implement procedures that make disclosures less likely. Without such coordinated efforts, inadvertent and unlawful violations of AYA privacy will continue to occur, and AYA may choose to forgo needed healthcare as a result.

Abbreviations:

ACA

(Patient Protection and) Affordable Care Act

AYA

Adolescents and Young Adults

HIPAA

Health Insurance Portability Accountability Act

OOP

Out-of-Pocket

SHCN

Special Health Care Needs

STI

Sexually Transmitted Infections