21st Century Cures Act ONC Rule: Implications for Adolescent Care and Confidentiality Protections

Confidential health services are a cornerstone of the highest level of adolescent health care.^16,17,20  Navigating a path to adulthood includes developing autonomy in health care decisions during adolescence.²¹  Involving adolescents in their own medical decisions by sharing clinical information with them, and their parents whenever appropriate, also supports adherence and follow-up.^17,22  Protecting confidentiality supports adolescent development, promotes access to care, avoids adverse health outcomes and negative legal repercussions, and honors ethical principles; it is the standard of care and has been endorsed by numerous health care organizations, including the major medical groups supporting children, adolescents, and young adults.^16,20,23,24  Decades of research findings support the provision of confidential care to adolescents to improve health outcomes.^25,26  Privacy concerns influence whether, when, and where adolescents seek care and how candid they are with their health care providers.^12–15,27  If delayed in seeking care or deterred altogether, the adolescent’s health and life may be harmed.

Providing confidential health services and protecting adolescents’ privacy honors important ethical principles, such as autonomy or respect for persons, beneficence, nonmaleficence, and justice, thus minimizing harm and promoting the adolescent’s wellbeing.²⁸  Protecting access to confidential health care, especially for vulnerable adolescents who may lack supportive families, furthers the principle of justice and advances equity in the health care system. This is even more critical in a post-Dobbs environment when automatic and unexpected sharing of confidential health information could have negative legal implications for patients and providers.¹¹ 

The legal framework for confidentiality in adolescent health care is a complex patchwork of state and federal laws.^29–35  The specific legal standards differ for adolescents who are minors and for adult adolescents. Adolescent minors’ protections depend on geographic location, their status or living situation, and the services they are seeking.^29–31 

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, as well as other federal laws, including “Part 2” confidentiality rules for substance use disorders, Title X Family Planning Program confidentiality regulations, and Medicaid requirements, contain important federal confidentiality protections.^32–35  The HIPAA Privacy Rule includes general protections that apply to adolescents who are legally adults and also contains special protections for adolescent minors.³⁶  The application of these special protections for minors depends on the intersection of the HIPAA Privacy Rule, other federal laws, and state minor consent laws.

Minor consent laws vary significantly from state to state.^29–31  They may allow minors with a certain status or living situation (eg, homeless minors) to consent to care and may allow all or most minors to consent for specific services (eg, sexually transmitted infection diagnosis and treatment).²⁹  State laws also may contain provisions that permit, require, or prohibit the disclosure of information without the minor’s consent.²⁹  Along with other state medical privacy laws, these state minor consent and confidentiality laws are of critical importance in applying the ONC Rule to the disclosure of an adolescent’s health information.³⁷ 

State laws also affect adolescent minors’ access to particularly sensitive services and the confidentiality of information related to those services. For example, most states require parental consent or notification for minors to obtain an abortion, whereas allowing them to do so without parental involvement by seeking a court order in a judicial bypass proceeding is often a time-consuming process.³¹  Also, some states have considered or enacted laws that restrict minors’ access to gender-affirming care, even with parental consent. The extent of confidentiality protection is unclear when an adolescent patient discloses to their health care provider information about their gender identity, such as preferred name or pronouns, that they wish to keep confidential from parents/guardians or others who might have access to the medical record.³⁸ 

The 21st Century Cures Act (Cures Act), signed into law in 2016, contains provisions related to the Food and Drug Administration, drug development, and patient access to innovations. It also mandated the development of rules to enhance patient access to and control of their EHI, as well as interoperability of EHI. The Cures Act impacts patients, physicians, payers, technology developers, and other health care stakeholders.

The ONC issued a final rule on May 1, 2020, “21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health Information Technology Certification Program.”¹  The Centers for Medicare and Medicaid Services issued a concurrent rule addressing patient access to data and interoperability.³⁹  The compliance date for the information blocking provisions was April 6, 2021, and the scope of information to which these provisions apply was limited initially, then broadened as of October 6, 2022.^40,41 

The ONC Rule requires that patients have immediate access to their EHI, including “electronic protected health information,” as defined in HIPAA.⁴²  Clinical notes are included, but there is a specific exception for psychotherapy notes.⁴³  A significant implementation challenge is facilitating access while protecting confidentiality. In addition to giving patients access to their own EHI, the ONC Rule can contribute to breaches of confidentiality in a wide range of situations, as illustrated by the examples listed in Table 1. Breaches may occur both within a single health site or system or as a result of the interoperability aspects of the Rule, when information is shared across systems, including across states, with variable protections in the receiving sites.

The ONC Rule contains a ban on information blocking.⁴³  Under the Cures Act, information blocking is any practice that is “likely to interfere with, prevent, or materially discourage access, exchange, or use of [EHI] when an entity knows it is likely to do so.”^44,45  Initially, penalties and disincentives for health care providers who engage in information blocking had not been established; they will be the subject of future rulemaking.⁴⁶ 

The Rule contains 8 exceptions to the information blocking ban.^45,47  Three of the exceptions are of particular importance in the application of the Rule in adolescent health care: the “infeasibility” exception, the “privacy” exception, and the “preventing harm” exception.²  Under the infeasibility exception, nondisclosure of a patient’s EHI is not information blocking if the segmentation of shareable from protected information is not technically possible.⁴⁷ 

Under the privacy exception, nondisclosure is not information blocking if the information is protected from disclosure by state or federal law, the patient requests nondisclosure, and/or other conditions are met.⁴⁷  The application of this exception in adolescent health care depends on interpretations of the intersection of the relevant federal laws, such as the HIPAA Privacy Rule, with state minor consent and privacy laws.

The preventing harm exception has presented the greatest challenge for adolescent health care providers. Under the preventing harm exception, nondisclosure is not information blocking when it is reasonable and necessary to prevent harm to a patient if certain conditions are met.⁴⁷  The harm must either represent a threat to life or physical safety or must amount to substantial harm. ONC has clarified that this includes “substantial physical, emotional, or psychological harm.”⁴⁸  ONC guidance explains the types of harm recognized under the preventing harm exception and when substantial harm is recognized.⁴⁸  If EHI is disclosed because of the ban on information blocking, a broader array of harms may occur. Some of the harm adolescents may experience because of the disclosure or sharing of their EHI are outlined in Table 2.

Implementing the ONC Rule presents a number of challenges in the care of adolescents, not only for the providers who are accustomed to providing confidential care but also for those clinicians who are less familiar with the confidentiality protections that apply to the care of adolescents. Much of the reason for these challenges is due to the lack of segmentation of health information within the visit note, as well as in the entire medical record and across the array of patients’ EHI.^18,19,37 

To protect their adolescent patients’ privacy, clinicians have to navigate constraints on recording information in notes, identifying which medications and diagnoses may be sensitive or subject to legal protections, and determining which information is shareable with health care providers who need this information, or with parents entitled to nonconfidential EHI about their adolescent’s care. Often, both shareable and nonshareable information is intertwined within a visit note. Parents and guardians should have access to nonsensitive information not legally protected from disclosure or that the adolescent does not object to sharing. This is especially important for the parents of adolescents with serious medical illnesses and guardians of older adolescents and adult children with limited capacity. For adolescent minors, honoring their right to confidential care, in certain circumstances, may lead to a lack of documentation which could potentially be harmful to their future care. Moreover, not addressing health concerns that are legally confidential because of clinician fear of a breach of confidentiality when notes are released in compliance with the ONC rule, may lead to harm.

After the Dobbs decision, new concerns have arisen that patients and providers might suffer adverse legal consequences due to sharing and interoperability of EHI. This might occur as a result of the documentation of pregnancy options counseling or the discussion of abortion services or if an abortion is legally performed in one state, but the patient’s EHI is accessible in another state where abortion is illegal.¹¹ 

The full impact of the ONC Rule on clinician documentation is not yet known. However, widespread concern has emerged related to handling sensitive information when a clinician perceives a risk of harm to the adolescent patient if the information is shared.^2,49  As noted, ONC has issued guidance about how the “substantial harm” standard under the “preventing harm” exception to information blocking in the ONC Rule allows information to be withheld for emotional and psychological harm as well as physical harm.⁴⁸ 

HIT has evolved to share more health information with more systems and more individuals. Although confidentiality is often considered the domain of primary care providers and adolescent health specialists, the risk of disclosure and confidentiality concerns among adolescent patients exist across all medical and surgical specialties involved in the care of adolescents. The expanded sharing across systems due to the interoperability requirements of the ONC Rule can result in confidential information from one health care setting being disclosed in another practice setting. For example, information about a patient’s gender identity and gender-affirming care they receive, once recorded in the medical record, would be accessible to other providers in the same health care system, or in other systems, without the patient realizing that this might occur.³⁸  This can undermine the clinician-patient relationship in ways that could be devastating to patients and potentially put them at risk for the types of harm outlined in Table 3.

Access to EHI via patient portals by adolescent patients and parents, or other proxies, also raises significant ethical and legal issues.⁷  Although this expanded access has many benefits, especially when information is shared with patients, more granular control of health care information within HIT is required to ensure appropriate adolescent health services.^18,19,50  HIT capacity to segment discrete portions of medical records and EHI generally, assuring required portions are disclosed while others remain protected as confidential, has been limited.^18,19  Retroactive release of information after a visit through medical records requests by parents and others has significant potential to impact confidentiality, especially if the EHI is not segmented appropriately.

To be most effective and user-friendly for clinicians, patients, and parents, HIT systems would ensure customizable and automated granular segmentation to separate EHI so discrete information can be shared differently through portal systems to adolescent patients, proxies, health information exchanges, and other HIT systems.^18,19  An identified need has been to have sensitive information that is legally protected as confidential be easily separated from nonprotected information that can and should be shared.^18,19,37,51 

Varied approaches for managing access to adolescents’ EHI have been adopted by health systems and recommended by organizations concerned with the care of adolescents.^{18,20,49–52}  These approaches have included options such as “separate and differential” patient portal access for parents and adolescent minors, documentation of sensitive information in parts of the record that do not get printed or shared unless the reader has special access, and suppression of medications and diagnoses in after-visit summaries so that they do not appear when given to parents.^2,18,53 

Whether segmentation is automated by technology or applied manually by clinicians and patients has implications for the success and impact of the ONC Rule. An important strategy is for adolescent health care providers to be an integral part of the ongoing efforts to develop technical methodologies for the granular segmentation of digital health information.^18,37  Rules for HIT information sharing and patient and proxy access must be based on carefully crafted preestablished policies consistent with federal and state privacy laws, health system policies, and ONC Rule requirements. Thus far, wide variation has existed in the ways that different hospitals and health systems have set up their HIT systems to address the concerns of adolescent patients and their providers.⁵¹ 

The education of adolescent health care providers, adolescent patients, both minors and young adults, and their parents about the ONC Rule and about confidentiality protections and their limits is essential. All parties need clear explanations about how portals are set up for adolescent minors and their parents, with limited access, proxy access, or complete access, and what that means for access to clinical notes and other EHI under the ONC Rule. Even when adolescent portals are used to protect confidential information and communications, recent studies reveal parents and guardians often are able to access those portals or the contents of the medical record through other means.⁸  Clinical staff need to be educated to avoid defaulting to entering parental contact information in patient-specific fields or altering proxy access on the basis of parental requests.⁹  For adolescent health care providers to educate patients and parents appropriately, they themselves need to be educated about the ONC Rule, the relevant federal and state confidentiality laws, and how EHI can be used in compliance with these laws.

At each visit, when setting the stage for confidential care, clinicians should explain ways in which the ONC Rule requires access to EHI, which may result in the release of notes to the parent. Patients should be told that protection against breaches of confidentiality is not always assured. Although adolescents may be reluctant to share information about sexual and reproductive health, mental health, and alcohol/substance use behaviors, some are willing to do so voluntarily or with clinician help.⁵⁴  Discussions about the limits of confidentiality associated with sharing notes and the ONC Rule present an opportunity to encourage communication between adolescents and their parents. For adolescents who remain unwilling to share sensitive information with parents, a referral may be necessary to sites that can offer greater privacy protection, such as specialized family planning clinics or school-based and college health centers; although the ONC Rule likely applies to these sites, they may be governed by different privacy protections in state or federal law.

The Rule’s focus on electronic information raises significant equity issues for many patients and their families.⁵⁵  Literacy is a concern at baseline. For families with limited English proficiency, linguistic access to EHI is a major barrier because the ONC Rule does not require translation or multilanguage versions. The issue of literacy could be even more pronounced when considering the overall health literacy limitations of patients and families, which are dependent on language literacy, HIT proficiency, numeracy, and experience with the health care system. Also, accessing information via a patient portal is dependent on having a device (cellphone, tablet, or computer) that can run the necessary apps and access the internet. Some patients live in areas without cellphone or broadband access; others cannot afford cellular or wi-fi accounts with sufficient data to support digital access to their EHI.

The implementation deadline for the information blocking requirements in the ONC Rule was in April 2021, slightly >1 year into the COVID-19 pandemic. Earlier, many health systems had implemented patient portals, Open Notes, and other mechanisms that became necessary for complying with the Rule. Thus, patient access to their health information had been expanding even before the pandemic. Although data on the impact of the COVID-19 pandemic on the implementation of the ONC Rule are limited, a large increase in the use of telehealth during the pandemic has been well documented.

In many health care systems, the patient portal is the access point to make appointments, contact health care providers, and view test results. The portal is also generally the access point for telehealth video visits. It is potentially an ideal way for adolescents to access their providers, establish their independence as health care consumers, and receive confidential care. However, the same confidentiality issues arise with respect to the use of the patient portal by adolescents for telehealth purposes as exist with respect to the handling of their EHI generally. During the pandemic, and with the implementation of the ONC Rule, the use of patient portals increased, including increased enrollment of adolescents in some systems.^56,57 

This assurance of confidentiality protections is an important challenge in the creation, maintenance, and use of patient portals, which are the gateway to visit notes, laboratory results, appointments, messages, and telehealth visits. The pandemic increased the incidence of mental health and substance use problems in adolescents.⁵⁸  In many states, minors can receive confidential care for these concerns. Further research is needed to determine the extent to which health care systems successfully protected confidentiality for adolescents while implementing a surge in telehealth and initiating compliance with the ONC Rule during the pandemic but the experience with COVID-19 highlighted a number of ongoing challenges.

Implementation of the ONC Rule holds promise for increased sharing of EHI to improve health care delivery. The COVID-19 pandemic accelerated the use of patient portals, telehealth, and other elements of EHI systems that are involved in compliance with the ONC Rule. A lack of adequate controls and protections in HIT systems, a lack of clarity around the “preventing harm” exception to the information blocking ban in the ONC Rule, varying state and other policies addressing confidential care for adolescents, recent Supreme Court decisions impacting access to abortion services, and equity issues all present significant challenges for clinicians caring for adolescent patients. In particular, the ONC Rule requirements for sharing EHI and its ban on information blocking, with future potential for significant fines for noncompliance, pose specific concerns for effectively protecting confidential EHI for adolescents. Which stakeholders have access to an adolescent patient’s EHI may influence whether confidentiality is protected or breached; this is especially the case with sensitive reproductive health information in the post-Dobbs era. Developing tools to aid in the implementation of the Rule by health systems and clinicians is essential. The involvement of pediatric health care providers who understand the adolescent’s right to confidential care in these processes is essential. One pathway suggested by a series of “Questions to Consider” illustrates what is needed to apply the Rule in individual cases (Table 2). Additionally, developing and implementing effective protocols for patient portal use requires the intersection of pediatricians, health system leadership, and clinical staff with patients and parents. Ensuring confidential services are provided effectively is an iterative process requiring knowledge and the consistent application of developed policies across a health system.⁵⁹  This process is outlined in “Steps for Ensuring Proper Patient Portal Protocols and Protection of Adolescents’ Health Information” (Table 4).

Clinicians, health system leaders and staff, HIT developers, patients, parents, and other proxies must all work in the service of adolescent patients to ensure effective care delivery, institutional policy, and HIT system development that is consistent with the increasing autonomy and sensitive health concerns inherent in adolescent health care. Therefore, ongoing assessments of the 21st Century Cures Act and the ONC Rule, their impact on adolescent health care, and advocacy to achieve the optimal balance between information sharing and confidentiality protections are essential.

COVID-19

coronavirus disease 2019

EHI

electronic health information

HIPAA

Health Insurance Portability and Accountability Act

HIT

health information technology

ONC

Office of the National Coordinator for Health Information Technology