State-by-State Variability in Adolescent Privacy Laws

We used a variety of sources to construct Table 1, which provides a summary of state-by-state minor consent policies for the following services: general medical care, immunizations, dental care, sexual assault evaluation, STI testing and treatment, human immunodeficiency viruses (HIV) testing and treatment, contraceptive care, prenatal care, substance abuse treatment, and mental health care.

We consulted Minor Consent to Medical Treatment Laws published by the National District Attorneys Association,³⁶  Consent Laws: A Summary, third Edition¹³  authored by Abigail English, and additional resources specific to each state to identify relevant codes and statutes. Then we consulted the current state statutes and codes listed in Table 2 to include the most up to date consent policies. We also validated our interpretations of current laws and regulations through the following regularly updated resources: Guttmacher Institute Web site,^37–39  SchoolHouse Connection’s Minor Consent for Routine Medical Consent,⁴⁰ VAXTEEN Consent Laws by State,⁴¹  and Kaiser Family Foundation.⁴²  Using these resources, we were able to put together a comprehensive table of current policies regarding minor consent and privacy.

Using guidelines and policy papers developed by the AAP, we explored whether evidence-based standards of care were consistent with state policies.^31–33,43 

Table 1 includes summary information of state laws for consent and privacy around each of the study topics (see Table 2 for sources). The regulations regarding consent for health services varied and were, at times, complex and unclear. At times, consent polices were not specified and needed to be inferred from general medical care laws. We found that limited numbers of states had explicit policies that allowed routine minor consent for the services in our table (Fig 1). There was a wide diversity in laws and regulations, with variability in the minimum age of consent, the types of minors that may consent, and the contexts within which consent is permitted. No 2 states had the same consent regulations for all the services. Parameters that influenced the ability to consent included marriage, divorce, pregnancy, minors living apart from their parents and managing their own financial affairs, incarceration, military service, treatment circumstances, services provided, and type of infections.

Almost all states set the age of maturity at 18 years; however, 2 states (Alabama and Nebraska) set it at 19 years. Eighteen states allowed adolescents to consent for immunizations; however, all had specifications related to the age of the patient, status of the minor, or type of immunizations provided (Fig 2). Many states lacked a clear policy on the ability to consent for routine dental care (n = 19).

Generally, sensitive health services, such as substance abuse, mental health, STI, and reproductive services, can be independently consented to by minors.¹³  However, we found that specifics surrounding these policies varied and, at times, were unclear. Most states allowed minors to consent for substance abuse treatment; however, 2 states left this unclear, and 15 had minimum age requirements. For mental health treatment, many states had no explicit laws for minor consent (n = 19), and the existent laws varied in the ages of consent. For sexual assault evaluations, about half had no explicit policy or did not permit minors to consent (n = 26). While all states had some provisions allowing for management of STIs, many had limitations: for example, 12 had minimum age requirements, 5 allowed minors to consent for testing only, and 1 required any positive results to be reported to the parent for patients under 12 (Fig 3). There was variability in whether STI services included HIV: slightly more than half (n = 27) allowed minors to consent for testing and treatment, while several allowed for testing alone (n = 5). For contraceptive care, almost half of the states allowed only specific categories of minors to consent (n = 24), and 4 had no explicit laws regarding consent for this type of care. Most states allowed minors to consent for prenatal care; however, 12 lacked explicit policies.

In addition to variability in the ability to consent, states with laws pertaining to sensitive health care also demonstrated variability in privacy protection. Twenty states permitted providers to share information on access to STI services with the parent or guardian, 8 permitted the disclosure of information related to contraceptive services, 14 for prenatal care, 19 for substance abuse treatment, and 9 for mental health treatment.

As Table 1 demonstrates, there is substantial variability in state privacy and consent laws that govern adolescent healthcare. This variability prevents guidance on consistent high-quality adolescent health care that abides by all state consent laws and regulations. While sensitive healthcare services can generally be consented to by minors, there is variability in the details of these policies that precludes standardization of guidance. This has ramifications on the provision of care that is consistent and confidential for adolescent patients who are known to be at high-risk for sensitive medical issues. Health care that is provided in states with more restrictive consent and privacy policies may not be consistent with clinically acceptable health care standards.

State policies may differ on the ability to share sensitive health information with the parent or guardian. This creates a scenario in which an adolescent patient may consent to private, confidential care in 1 state and then cross state lines and find that this information is no longer confidential and may be shared with the parent. Inconsistency in privacy protection creates inequitable care and could result in breaches of privacy that place the patient in potentially unsafe situations. We have developed a use case to illustrate the challenges inherent in providing clinical care in the context of varying state laws and regulations (see Use Case below).

Diana is 15 years old and identifies as female. Her parents are divorced; she lives with her mother and visits her father, who has a history of domestic violence. Diana has recently become sexually active. In her home state, she may consent to confidential contraceptive care and has a pediatrician who has prescribed oral contraceptive pills (OCPs).

While visiting her father in a different state, Diana develops painful urination and realizes she has forgotten her OCPs. She tells her father she doesn’t feel well, and he takes her to the local clinic. Through an application programming interface, the electronic health information is now shared with the new EHR, including information about her OCPs. Since the laws of this state allow health care providers to disclose information to parents, the pediatrician may inform Diana’s father of her OCP use. However, the pediatrician chooses not to share this information at this time.

Diana privately discloses her symptoms and the need to refill her OCPs. The pediatrician informs Diana that she can consent to testing and treatment of an STI; however, she would need to go to a federally funded Title X clinic to consent for confidential contraceptive care. Diana is afraid to tell her father this, so she decides to forego the OCP refill, and consents to STI testing, which comes back positive.

Information about Diana’s OCP use is now accessible in her patient portal. Through a proxy account, Diana’s father learns about Diana’s OCP use and new STI medication. Information about laboratory testing is also included in the after-visit summary and the billing explanation of benefits. Diana’s father becomes very angry, and Diana is now fearful for her safety.

As seen in this use case, despite the pediatrician’s efforts to protect Diana’s privacy, the electronic information exchange system included privacy pitfalls. Differing state laws can create confusion for the patient, her family, the health care provider, EHR developers, and the medical center policy makers. Variability in privacy laws creates challenges in developing EHR systems and electronic health information (EHI) exchange that promotes the exchange of information while maintaining a priority on protecting privacy.

Complexities in the interactions among differing state laws, the Health Insurance Portability and Accountability Act (HIPAA) regulations, and the 21st Century Cures Act can provide conflicting oversight, resulting in inconsistencies in care.^9,13,44–47  Without clear guidance, there are compliance challenges for pediatric health care providers, EHR developers, and medical center policymakers. Increased interoperability and exchange of health information in the setting of state-by-state variability in laws creates challenges in sharing protected health information in a way that remains legally compliant. This creates a major gap in the ability to scale EHI and data exchange in a meaningful way. Since the health system is still limited by EHR technological capabilities and reliable granular filters, it can be difficult to comply with regulations while avoiding breaches of privacy. Furthermore, complexities in interpretation of conflicting regulations, challenges in legal and ethical compliance, and limited resources to navigate state-by-state variability can translate into limitations in access for patients to their health data. Medical centers that lack the bandwidth to adequately address these issues may simply block access as a necessary alternative.

The HIPAA Privacy Rule creates rights for individuals to access their own personal health information and to control access to that information. When a minor has consented to medical care, the parent does not necessarily have the right to access the personal health information related to that care. However, as we have demonstrated, some state laws permit or require disclosure of personal health information of an adolescent to a parent or guardian.^13,44,45  This contradiction could lead to difficulties for providers who need to abide by state laws, even when personal health information is sensitive, and its disclosure could be emotionally upsetting or result in a risk to personal safety.

The 21st Century Cures Act has catalyzed research such as this. With this act, patients and their caregivers now have unprecedented access to EHI. However, variations in state laws may influence how successful the Cures Act is on reducing information blocking among adolescent patients and operationalizing a consistent and equitable care experience. Gaining access to health information empowers adolescent patients and improves patient care; however, harmful consequences can arise when parents or guardians inappropriately access certain personal health information.⁴⁸  Appropriate implementation of the privacy exceptions in the Final Rule requires an understanding of the state and federal protection rights of the adolescents within the EHR.⁴⁹  Faced with conflicting laws, health care organizations may choose to take no action, which is likely not supportive of high quality care that ensures privacy protection.

The AAP has recommended adolescent confidentiality protections through its evidence-based guidance. According to AAP policy, “Patient-provider confidentiality related to (sensitive) care is a delicate issue, especially when supporting parental involvement. If an adolescent patient is entitled to confidential care, a health care professional generally needs the adolescent’s permission to discuss her case with her parents.” According to the AAP Red Book, “Although parental involvement in adolescent health care is always desirable, consent of the adolescent should be sufficient to provide testing and treatment for HIV infection or STIs.”^31–33  The AAP’s commitment to protecting privacy is further demonstrated in Bright Futures: Guidelines for Health Supervision of Infants, Children, and Adolescents,³³  which states that pediatricians should “receive training on how to maintain the clinical setting as a 'safe space,' particularly in terms of confidentiality.”³³  This resource defines adolescence as 11 to 21 years of age and recommends that these patients be screened for STIs, making “every effort to preserve confidentiality of the adolescent.”

However, expert guidance by medical societies is bound by compliance with laws and regulations. Bright Futures specifies that, “Pediatricians should consult their own state laws for further guidance, should be aware of their state and local laws, community standards, and public health regulations, and should make use of free and confidential community-based testing programs if there are cost or confidentiality concerns.”^32,43 

Medical consensus and clinical research demonstrate what the best, most health-oriented care should look like, but clinicians are potentially put into situations where laws they must abide by are in direct conflict with what is best for patients. Best practices have been established; however, state laws do not necessarily adhere to these standards. Currently, academic society guidelines refer to state laws on consent and confidentiality to maintain legal compliance. The AAP has been deliberately nonprescriptive to avoid situations where its recommendations are in direct conflict with state laws. This limits the ability to construct granular guidance that supports consistent pediatric care nationally in the context of wide-ranging state laws.

Health care providers should be able to provide guidance on how to ensure safe, secure care for all of our adolescent patients.³³  According to the AAP endorsed position paper from the North American Society for Pediatric and Adolescent Gynecology and the Society for Adolescent Health and Medicine,⁴⁹  there are multiple steps to protecting adolescent privacy in the setting of the Cures Act Final Rule. These include learning about state and federal laws, meeting with informatics team and legal counsel, and advocating for information access that incorporates adolescent privacy protections.^16,48,49  Even with these efforts and sufficient resources, challenges in aligning the intent of state laws, federal laws, HIPAA regulations, and the 21st Century Cures Act remain.

This is a call to action to address this systemic policy issue in which state laws need to be aligned with best policies and brought closer in line with recommendations for best care. A nationwide effort to harmonize state laws would increase consistency in privacy protection for adolescents. We can’t solve these inconsistencies state by state. We must band together, determine the best policies, and promote them for the best interests of our patients.

The scope of this paper is limited to a cursory exploration into state laws. This study did not conduct a deep dive into the legal interpretations for each state but was instead an exercise meant to highlight the variability of consent and confidentiality policies inherent in state laws. Complexities in interpretation of the details of state regulations created challenges in developing a concise summary of privacy policies and may have resulted in inconsistencies in interpretations. It is possible that more recent updates in policies may have been missed.

State-to-state variability of adolescent privacy laws creates challenges for pediatric providers, EHR vendors, and policy makers, particularly in the setting of increased health information exchange. The complex interaction of differing state laws, HIPAA rules, and the 21st Century Cures Act Final Rule creates a challenging setting within which to provide safe, secure medical care for adolescents that complies with best-practice standards. Medical societies have established best practices for adolescent care through research and medical consensus; however, providers must yield to legal compliance with varying state laws. Health care providers, instead of policy makers and politicians, should be the ones determining privacy and confidentiality regulations for adolescent patients.

AAP

American Academy of Pediatrics

EHI

electronic health information

HER

electronic health record

HIPAA

Health Insurance Portability and Accountability Act

HIV

Human Immunodeficiency Virus

STI

sexually transmitted infection