Confidentiality in the Care of Adolescents: Policy Statement

The right of an individual to have their health information kept confidential is a basic tenet of health care that has been codified in both federal and state laws, as well as professional guidelines and ethical standards. A competent adult has ultimate control of the sharing of their health data, and a child relies on a parent or guardian (hereafter referred to collectively as “parents”) to determine when and how information may be shared. The adolescent patient is in a continual process of developing autonomy and decision-making capacity, and increasing evidence suggests that adolescents are capable of making health-related decisions in many circumstances.¹  Until the age of majority (often at 18 years of age), this presents a unique challenge for pediatricians and other pediatric health care professionals, who must navigate the statutes that determine confidentiality protections and practices (which vary across jurisdictions and settings) and meet obligations to both adolescent patients and their parents. Some of these issues also affect the care of young adults 18 years and older who remain as dependents on insurance policies or need supported decision-making arrangements because of limitations in their decision-making capacity.² 

Although privacy pertains to individuals broadly, confidentiality refers to the handling of information from clinical encounters. Given that confidentiality protections are not absolute, defining their scope and limitations and ensuring consistent implementation across settings and circumstances is critical. Although the American Academy of Pediatrics (AAP) Bright Futures: Guidelines for Health Supervision of Infants, Children, and Adolescents, fourth edition, defines adolescence as ages 11 to 21 years,³  this policy statement defines “minor adolescence” as 13 years of age until the 18^th birthday. Importantly, several recommendations apply to young adults 18 years and older as well.

The accompanying technical report⁴  examines key aspects of clinical practice and health care systems and structures in which confidentiality issues come into play and discusses the profound complexities that pediatricians and adolescent and young adult (AYA) patients face; this policy statement makes recommendations based on the rights, needs, and responsibilities of the adolescent patient, which should be used to develop actionable and consistent policies and practices for handling their protected health information (PHI) to ensure high-quality health services and positive outcomes. This policy statement complements several existing AAP policy statements that provide insights and recommendations related to specific aspects of adolescent care, including recently updated policy related to confidentiality when considering abortion.^5 –13 

Federal laws, such as the Health Insurance Portability and Accountability Act (HIPAA)¹⁴  Privacy Rule, the confidentiality regulations for substance use disorder programs (42 CFR Part 2),¹⁵  and the Title X Family Planning Program,¹⁶  provide a foundation for adolescent confidentiality protections. The Family Educational Rights and Privacy Act¹⁷  and the 21st Century Cures Act¹⁸  are additional federal laws with profound implications for adolescent confidentiality. At the state level, as minor adolescents develop autonomy and the ability to participate in health care decision-making, they are typically granted the right to consent to care related to specific health issues. These may include reproductive health, substance use, and often mental health, although the ages at which this right is granted and other limits and stipulations (such as parental notification) vary from state to state.^19 –22  Minor adolescents may also consent to emergency care in many jurisdictions; however, except under certain well-defined circumstances (such as emancipation), they are not granted the right to consent for nonemergent, nonsensitive, routine health care services, with that right being reserved for parents. Notably, New York state has recently granted the right to consent to all services to runaway and homeless youth receiving services from programs approved by the Office of Children and Family Services.²³  The right to consent to care often determines the right to control information resulting from that care, although there may be discordance between the two in certain circumstances, such as when state laws require or allow parental notification of minor adolescents seeking certain types of care.

Pediatricians generally are cognizant of the fact that in any encounter with an AYA patient, the patient and parents may each have separate interests in the health information associated with that encounter. The patient may have an interest in keeping information private, even from parents, whereas parents have certain rights and responsibilities to care for their minor adolescent, the exercise of which may require access to their minor adolescent’s health information. Encouraging the AYA to share information with parents, even when not legally required, enables the pediatrician to foster better communication among the AYA, parents, and pediatrician, potentially improving relationships and clinical care and outcomes. Pediatricians are also typically aware of the potential impacts of breaking confidentiality on the pediatrician-patient relationship, including the undermining of the patient’s trust of the pediatrician, which may affect the patient’s future care-seeking behaviors.^24 ,25  This concern underscores the importance of proactively discussing with the adolescent the need to break confidentiality in certain circumstances to mitigate any such negative impacts.

Once data on the AYA patient have been entered into the health record, many other stakeholders will have an interest in utilizing the data for reasons related to further treatment (eg, consultants, health information exchanges), payment (eg, public and private insurers), and health care operations (eg, quality assessment and improvement), known collectively as the treatment, payment, and operations provisions of the HIPAA Privacy Rule.²⁶  The exchange of information among these stakeholders, much of which is permitted without consent under the treatment, payment, and operations provisions to HIPAA, creates multiple points at which confidential information may “leak” and violate the AYA patient’s expectations of confidentiality. This leakage may also occur when PHI is subpoenaed by a court or required to be disclosed to law enforcement or other government agencies with statutory access to otherwise confidential information. Understanding the varied perspectives and interests of relevant stakeholders is critical for pediatricians, who are often at the nexus of key interactions and exchanges of information, as well as for policy makers, who are in a position to improve systems and structures to optimize care. Notwithstanding the competing interests of stakeholders, the care and well-being of the adolescent patient will ideally be the primary drivers of health care practices and policies.

Navigating the interests of stakeholders and prioritizing the health and safety of youth have grown in complexity as technological advancements, such as electronic health records (EHRs), patient portals, and clinician-patient messaging, have transformed the storage and exchange of PHI.^27 –30  The rapid expansion of telehealth^31 ,32  and new and evolving applications of artificial intelligence in health care delivery in recent years have further complicated the landscape.³³  As these technologies have advanced, gaps in confidentiality protections have persisted, leaving pediatricians and patients scrambling to preserve confidentiality in the contemporary health care context. Further, long-standing issues related to billing and claims have remained, with only limited innovations implemented to address these critical gaps.^34 –36 

Finally, as the care of AYA patients has advanced overall, the unique needs of particular subgroups of youth and the risks they face without sufficient protections have become clearer, highlighting the need for more nuanced, situation-specific confidentiality protections. Specifically, adolescents who are pregnant or parenting; are in foster care; are involved in the justice system; have complex chronic conditions including neurodevelopmental disabilities and complex mental illness; are immigrants or refugees; are victims of trafficking or physical or sexual abuse; or are gender-diverse require special consideration as confidentiality practices and the systems and structures that support them evolve.

Confidentiality is an essential component of high-quality adolescent care that is developmentally appropriate and has profound implications for health care access and utilization, outcomes, and safety. Several long-standing as well as contemporary issues make the seamless protection of confidentiality challenging for pediatricians, adolescents, and young adults. These challenges create inordinate burdens for young people but also represent invaluable opportunities for collaboration and concerted action among pediatricians, allied health professionals, health care administrators, technology vendors, policy makers, and adolescents, young adults, and families themselves. In view of the risks as well as the opportunities in the current state, the AAP offers these recommendations.

1. Respect the AYA patient’s request for confidentiality when legally required or permitted.

2. Prioritize the health and well-being of the AYA patient, understanding that doing so may necessitate breaking confidentiality when legally required or permitted to safeguard the minor adolescent and/or comply with legally mandated reporting requirements, such as in the case of suspected abuse or other acute safety compromise or in the case of AYA patients in foster care, involved in the justice system, or in the jurisdiction of immigration services.

3. Encourage the minor adolescent to share important health information with their parents, to the extent that the adolescent deems acceptable, even though it may not always be legally and/or clinically required.

4. Support adolescents and parents in understanding the psychosocial development of the adolescent, recognizing normative changes in autonomy and decision-making as youth transition from dependent childhood to independent adulthood, and discuss the need for confidential care, when appropriate. Consistent inclusion of time alone with the adolescent during each encounter is developmentally appropriate and may facilitate progress toward independence.

5. Promote alignment with parents centered on the well-being of the adolescent, balancing the primary interests of the youth with parental needs and priorities. Explore relevant cultural perspectives, traditions, and religious beliefs held by the patient and family to help facilitate alignment as well as clear communication among parents, adolescents, and pediatricians regarding the importance of confidentiality practices.

6. Maintain awareness that systemic racism and historical discrimination and marginalization of groups of AYA patients, including youth involved in the justice system, youth in foster care, indigenous youth, refugee and immigrant youth, youth with intellectual disabilities, and LGBTQIA+ youth, have impeded access to care for many members of these groups and that these individuals may be particularly concerned about ensuring confidentiality of their health information.

7. Be familiar with federal and state laws that may apply at the time and in the place where care is rendered and that govern confidential care and the limits of confidentiality. Education about legal requirements is important for both pediatricians and parents and can begin in the preadolescent period. This information also applies to young adult patients, if covered by insurance as dependents, who need to know that, depending on federal and state law, their health information may be disclosed to the policyholder (parent) via explanations of benefits and other communications from the insurer.

1. Pediatricians should be strong advocates for implementation of treatment, payment, and operations practices that support confidentiality and partner with clinical teams and systems to promote full compliance with applicable consent and confidentiality laws.

2. Develop robust practice policies and operations to protect confidentiality in the care of AYA patients, which can in turn promote their trust and engagement. These operations include consistent provision of opportunities for minor adolescents to engage health care professionals privately as well as policies and practices that include guidance on breaching confidentiality only when absolutely necessary to preserve the safety of the minor adolescent, comply with legal requirements, or otherwise ensure beneficent practice.

3. In accordance with the HIPAA Privacy Rule, practices are required to develop and provide patients or their parents a Notice of Privacy Practices that meets legal requirements. In addition, practices should provide complementary explanatory materials that are developmentally appropriate and take into consideration the health literacy and language proficiency of both the adolescent and their parents. Further, such materials should be specific to the jurisdiction in which care is rendered.

1. Health systems should ensure full implementation of all relevant laws governing AYA confidentiality and eliminate variability in practice across settings within the same system.

2. EHR developers should recognize that not all PHI in a patient’s record is of the same level of sensitivity and that maintaining AYA confidentiality is a complex process. Capabilities are needed within EHRs to segment data into confidential and shareable parts and to require that confidential information only be released with consent from the appropriate party. This need for segmentation also applies to information release functions within patient portals.

3. Health care institutions should develop processes to further refine data segmentation within their entity, in addition to the native functionalities provided by the EHR developer. Development of these processes requires direct input from health care professionals well-versed in adolescent care to optimize automated handling of sensitive data and minimize clinician burden for data management and protection at the point-of-care.

4. Health care systems should develop and implement rules with health care professional input for the maintenance of confidentiality flags when health information is transferred between entities both within and outside of the system. This includes information transfer to other health care professionals within the system as well as regional data repositories, registries, and analytics organizations.

5. Configuration of patient portals to maintain confidentiality when data are released through the portal is an extension of confidentiality functions within the EHR. Any information resulting from minor-consented services cannot be released through the portal without assurance that access to that portal account is appropriately controlled to maintain the confidentiality of the adolescent.

6. Portal access should be configured so that it can be controlled and modified as needed by the patient and health care professional.

7. Age- and developmentally appropriate education of patients about the purpose and use of patient portals, including the ramifications of sharing portal access with parents and others, can be provided at both routine care encounters and those where confidential data are developed.

8. Confidentiality protections should be prioritized as applications of AI are developed and deployed in the care of AYA.

1. High-quality and accessible educational resources regarding confidentiality provisions and practices, including those specific to EHRs, are needed for adolescents, young adults, parents, and all members of the health care team to ensure a shared understanding and close partnership in protecting confidentiality for patients.

2. Education and training in confidentiality regulations and practices specifically designed for clinical team members as well as support of continuous quality assurance and practice improvement in the protection of confidentiality are needed for all individuals involved in AYA health care-related services. These individuals include primary and specialty care professionals, nurses, pharmacists, radiology service providers, and other allied health professionals as well as administrative staff.

3. Education and training should include circumstances when confidentiality cannot be ensured and best practices in how any disclosures of health information are made.

4. All employees who access PHI in any setting should understand best practices to maintain confidentiality when using the EHR and other technologies to render care and document and exchange health information.

1. Pharmacies should develop procedures to safeguard information exchange around medications prescribed confidentially. Ideally, any such prescription will come with an indicator reflecting confidentiality; these indicators must be respected and preserved in pharmacy systems. Automated notifications that prescriptions are ready or due for a refill should only be sent to the individual who consented to the care that resulted in the original prescription.

2. Radiology and clinical laboratories and other service providers should be aware of the sensitive nature of certain services and should have policies in place to maintain confidentiality accordingly.

3. Additional research is needed to understand the impacts of confidentiality practices in specialty care settings as well as in emergency and inpatient care settings.

1. Services for which a minor consents should be billed with indicators denoting confidentiality, and payers should develop processes to prevent leakage of confidential information during the payment process. These same protections should apply to adults who are covered as dependents.

2. Payers should develop policies and processes to modify all routine payer communications (eg, explanations of benefits, requests for further information) with health insurance policy holders when family members access sensitive health services to prevent disclosure of confidential information and confidential health data to persons who are not authorized to receive that information. These processes should function automatically, based on diagnosis and treatment information and should not require specific action by the patient or the health care professional to implement the protections.

3. Payers should educate insurance purchasers (ie, adult policyholders) and EHR developers regarding the confidentiality needs of dependents, including young adults, and delineate billing and claims processes that ensure confidentiality.

1. Pediatricians should serve as advocates in their workplaces and local communities to educate the public and health care team members about the confidentiality needs of AYA patients and their impacts on the health and safety of youth. Resources to support such activities are available from AAP State Advocacy (E-mail: [email protected]).

2. Continued legislative advocacy is essential to evolve policies around mature and emancipated minor statuses, consent for sensitive services, and reporting requirements around physical and sexual assault, among other relevant issues, to improve confidentiality protections and prioritize the health and safety of minor adolescents.

1. Recognize that health care information held in school records may be handled differently, based on whether the information is in a school-based health clinic’s record that is governed by HIPAA protections or in a student’s education record that is governed by the Family Educational Rights and Privacy Act, which allows broader release to parents and other education-related entities.

2. The development of clear guidelines and robust safeguards can help to maintain confidentiality when non-HIPAA-compliant communication modalities, such as mobile devices without sufficient access controls to authenticate users, are used (at the request and with the consent of the patient) to support communication and engagement of AYA patients.

3. Development of best practices, training of health care professionals and other care team members, and continuous quality improvement efforts are needed to ensure optimal use of telehealth technologies to meet adolescent health needs without compromising confidentiality.

4. Consistent guidance from national professional organizations regarding consent, confidentiality, power of attorney, guardianship, and supported decision-making arrangements can simplify the work of health care professionals and help to ensure the health and safety of AYA patients with intellectual and/or developmental disabilities. Such guidance can also support parents of youth with intellectual and/or developmental disabilities in retaining sufficient access to health information to support ongoing care, even after the age of majority.

5. Although practice- and clinician-level solutions are important, systemic structural changes are needed to strengthen confidentiality protections across settings and circumstances. For example, advancements in EHR functionalities beyond individual institutions or improvements in payer processes are likely to have broader and more consistent positive impacts on confidentiality than solutions developed and deployed in individual care settings.

6. Further research is needed to understand the impacts of confidentiality protections across settings and circumstances and throughout adolescence and young adulthood. This research can address the distinct impacts of health care professional and team member behaviors, the EHR and related technologies, billing and payment processes, and the broader regulatory environment.

Richard J. Chung, MD, FSAHM, FAAP

Janet B. Lee, MD, FAAP

Jesse M. Hackell, MD, FAAP

Elizabeth M. Alderman, MD, FSAHM, FAAP

Elizabeth M. Alderman, MD, FSAHM, FAAP, Chairperson

Elise D. Berlan, MD, MPH, FAAP

Richard J. Chung, MD, FSAHM, FAAP

Michael Colburn, MD, MEd, FAAP

Janet Lee, MD, FAAP

Maria Monge, MD, FAAP

Taraneh Shafii, MD, FAAP

Laura K. Grubb, MD, FAAP

Stephenie B. Wallace, MD, MSPH, FAAP

Anne-Marie Amies, MD – American College of Obstetricians and Gynecologists

Laura K. Grubb, MD, MPH, FAAP – Society for Adolescent Health and Medicine

Liwei L. Hua, MD, PhD – American Academy of Child and Adolescent Psychiatry

Seema Menon, MD – North American Society for Pediatric and Adolescent Gynecology

Maria H. Rahmandar, MD, FAAP – Section on Adolescent Health

Ellie Vyver, MD – Canadian Pediatric Society

Lauren Zapata, PhD, MSPH – Centers for Disease Control and Prevention

Karen S. Smith

James Baumberger, MPP

Jesse Hackell, MD, FAAP, Chairperson

Yvette Marie Almendarez, MD, FAAP

Abeba Mebrahtu Berhane, MD, FAAP

Patricia E. Cantrell, MD, FAAP

Lisa Michele Kafer, MD, FAAP

Tomitra Latimer, MD, FAAP

Robin Warner, MD, FAAP

Robert H. Wiskind, MD, FAAP

Alisa Skatrud – Family Liaison

Seth Kaplan, MD, FAAP – AAP Section on Administration and Practice Management

Abigail English, JD – Center for Adolescent Health and the Law

Mackenzie Magnus

Elisha Ferguson

AAP

American Academy of Pediatrics

AYA

adolescent and young adult

EHR

electronic health record

HIPAA

Health Insurance Portability and Accountability Act

PHI

protected health information