In 2020, the 21st Century Cures Act was enacted, mandating that patients have access to their electronic health record. This has the potential to benefit both patients and clinicians by increasing communication, transparency, and patient autonomy. However, with the onset of the act, a number of unintended consequences of the act have been identified. Presently, we discuss a case where documentation of intimate partner violence and the safety plan documented in a mother’s electronic health record automatically populated her newborn’s admission note. This confidential information inadvertently became accessible to the perpetrator: the infant’s father.
For the past decade, there has been a growing movement within American health care to provide patients with more transparent access to their medical records.1–3 This effort took a significant leap forward in 2020 with the enactment of the 21st Century Cures Act, which mandates health systems to ensure that clinical notes, laboratory results, and other health information are available for patient access.4 Advocates for this program have cited improved patient satisfaction, improved patient understanding of illness or condition, and higher compliance with treatment plans as benefits that transparent electronic health record (EHR) access can offer.5,6 Others point out potential downsides of unfettered patient access to clinical notes, including anxiety and confusion about working diagnoses, mistrust in the medical system when imprecise language is used in the medical record, and significant privacy concerns.7,8
The latter concern is especially salient in the field of pediatrics when another party (ie, a parent or legal guardian) has access to the patient’s medical record. Significant amount of concern has been raised for potential breaches in the privacy of adolescent patients, especially in cases where sexual health and mental health are being discussed.9
Similarly, practitioners have raised the alarm for cases of intimate partner violence (IPV) where an abuser might have access to their partner’s medical record and use information in the record, such as an instance of abuse, plans for legal proceedings, or treatment of a sexually transmitted infection to further manipulate or control them.10,11 Clinicians often struggle to maintain a balance between the competing roles of privacy and disclosure in patient safety, often leading to an ad hoc approach when documenting IPV.12
IPV in the setting of newborn care presents an additional, and often underappreciated, challenge.13 Often, medically relevant information for the care of the newborn that would otherwise be protected health information about the mother is also documented in the newborn’s medical record. When both parents are legal guardians (and under new federal guidelines would have immediate access to clinical notes upon finalization), an abuser may gain sensitive information about their partner if confidential details in the maternal EHR auto-populate the child’s medical record. This can result in significant safety issues and perpetuate abuse. Alerting practitioners to instances where the EHR may disclose sensitive information is crucial for more careful documentation and better support of IPV survivors in pediatric settings.14
We present a case where information about IPV from a mother’s EHR, that the father did not have access to, was inadvertently pulled into a newborn’s medical record that he did have access to, which could have put the mother and newborn at risk.
Case Report
A newborn was admitted for observation and the pediatric team wrote an “admission history and physical examination” using templated notes with prepopulated text from the mother’s medical record, which was automatically linked to the infant’s medical record through the EHR.
In addition to pulling in maternal information about the delivery (eg, time from rupture of membranes to delivery, delivery method), the 2 note templates pull in relevant maternal history (eg, gravida and parity, prenatal laboratories, and active problem list). This includes an auto-populated problem list with free-text notations by the obstetrical team.
In the current case, within the problem “pregnancy in the third trimester,” a narrative of IPV perpetrated by the father of the infant was documented, including potential legal plans and her safety plan details. Although our EHR has information-blocking features, this was not enabled, presumably because the obstetrics team did not realize that the mother’s health record could auto-populate the infant record.
This information was documented in the newborn’s medical record and, when signed, was made available in the patient’s EHR before the sensitive nature of the information was identified and was manually removed via addendum. The father (ie, the perpetrator of the abuse) maintains custody of the infant, and could have had access to this information via the EHR portal through his rights under the 21st Century Cures Act. The patient was discharged to the care of the mother after an uneventful stay. To our knowledge, the information remained in the mother’s medical record, and the patient followed up with a community pediatrician.
Discussion
The 21st Century Cures Act has significant implications for the practice of medicine in the United States. All elements of the EHR, including clinical notes, problem lists, and results tabs, are now written knowing that they may be easily read by patients or others with access to their EHRs. Although this regulation can provide new and innovative ways for patients to become involved in their care, the unintended consequences of this paradigm shift are still being enumerated.15
To our knowledge, a case of a mother’s safety plan being accessible to an abuser through their newborn’s medical record via EHR linkage has not been reported. Yet, it is likely a common avenue for potential harm caused by open access to patient medical records. This case shows how several different EHR functions that are powerful tools for patient care, such as auto-populated note portions, linked patient medical records, and multiuser proxy access, can create a scenario with the potential to put patients and their families at risk. Conversely, safe documentation and conscientious use of the EHR can strengthen survivor advocacy and healing-centered care.
Steps should be taken at several levels, including clinician, EHR, and policy, to mitigate these risks and prevent similar cases. The downsides of auto-population and auto-completion are well documented, whether in the case of a clinician forgetting to edit a template or accidentally recording sensitive information in a shared note. However, beyond note writers taking time to proofread notes to ensure that these errors do not occur, other members of the team should be made aware of instances where their documentation is used in a shared template and limit the amount of sensitive information put in those parts of the patient’s medical records.7
Linking patients’ medical records can be a convenient and reliable way of documenting information that is relevant for 2 related patients. However, it is easy to imagine cases like ours where a clinician is not aware that documentation in 1 patient’s medical record will be visible through another patient’s record. For instance, the notation of a parent’s illness in their medical record may automatically be brought into the family history portion of the clinical note during their child’s pediatric visit. If the parent did not wish to disclose that information to their child, it could cause significant strain on their relationship if the child accessed their own medical record. Although many EHRs do offer options to block information when there is a risk of harm to the patient, this may not be true for every EHR, and without this function, both documentation and care may be compromised for sensitive health concerns such as IPV. And, even when the function is available, clinicians may not be aware that medical records may be linked and may not enable it. Without clear EHR-side warnings that information from 1 medical record may be carried over into another patient’s medical record, it is easy for clinicians to make similar mistakes as in the case we present.
Lastly, it remains uncertain to what extent health care providers may block patient access to certain information in the medical record. There is an exception which permits blocking of information that may reasonably be harmful to the patient or another person, that extends to blocking information referencing another person.16 However, what constitutes “reasonable” has not yet been defined by the federal government. It is therefore subjective and is, in part, influenced by the judgment of the clinician. Clinicians are heavily discouraged to block information, as evidenced by the $1 million fine for information blocking.4 Thus, clinicians may err on the side of disclosure to avoid the fine, shielding themselves from legal exposure, but exposing their patients to potential harm.8 Multiuser or proxy access complicates this, especially in cases where a potential abuser did not have access at the time that the note was written, but gains it at a later point.11 The federal government should develop examples of information that are appropriate to block from patient view and/or from linkage with other medical records that clinicians can use as guidelines to better clarify the rule. Actionable recommendations for each of these domains are listed in Table 1.
Actions to Promote Safe Documentation and Healing-Centered Care for IPV Survivors and Newborns
| Clinician-side actions | Disclose limits of confidentiality to caregivers at prenatal and postnatal visits, and collaborate with survivors to ensure safe documentation.14,18 |
| Ask IPV survivors what can and cannot be included in the EHR.18 | |
| Educate health care workers about instances where their documentation may be pulled into another part of the EHR. | |
| Reinforce interdisciplinary coordination between obstetrics and pediatrics teams for follow-up care for IPV survivors and their children. | |
| Educate all health care workers about IPV, safe documentation, and local resources for IPV survivors.18 | |
| EHR-side actions | Warn or flag information that is being documented in a shared or linked portion of a chart, and highlight information that has been pulled from a linked chart.7 |
| Flag information that may be sensitive and potentially harmful so that it can then be selectively blocked (immediately and in the future), either by a clinician or a user/proxy.19 | |
| Create designated page types or protected sections of the chart designated for sensitive topics, like IPV. | |
| Incorporate survivor voices into EHR design to encourage culturally competent, nonbiased language in documentation. | |
| Federal government-side actions | Work with survivors and survivor advocacy groups to develop safe documentation policies. |
| Provide clearer guidelines for clinicians/institutions to clarify what information may be exempt from information blocking, explicitly including IPV documentation as an example.8 |
| Clinician-side actions | Disclose limits of confidentiality to caregivers at prenatal and postnatal visits, and collaborate with survivors to ensure safe documentation.14,18 |
| Ask IPV survivors what can and cannot be included in the EHR.18 | |
| Educate health care workers about instances where their documentation may be pulled into another part of the EHR. | |
| Reinforce interdisciplinary coordination between obstetrics and pediatrics teams for follow-up care for IPV survivors and their children. | |
| Educate all health care workers about IPV, safe documentation, and local resources for IPV survivors.18 | |
| EHR-side actions | Warn or flag information that is being documented in a shared or linked portion of a chart, and highlight information that has been pulled from a linked chart.7 |
| Flag information that may be sensitive and potentially harmful so that it can then be selectively blocked (immediately and in the future), either by a clinician or a user/proxy.19 | |
| Create designated page types or protected sections of the chart designated for sensitive topics, like IPV. | |
| Incorporate survivor voices into EHR design to encourage culturally competent, nonbiased language in documentation. | |
| Federal government-side actions | Work with survivors and survivor advocacy groups to develop safe documentation policies. |
| Provide clearer guidelines for clinicians/institutions to clarify what information may be exempt from information blocking, explicitly including IPV documentation as an example.8 |
Together, these efforts can shift the balance of power of the EHR to benefit IPV survivors, because safe documentation can provide a basis for trauma-informed and healing-centered care. By keeping a protected, patient-consented record of this information in the EHR, survivors can more easily be referred to appropriate resources that may lead to improved outcomes.17
Conclusions
The 21st Century Cures Act will continue to have unforeseen effects on the way medicine is practiced by providing patients with instant access to their medical records. Our case described how maternal disclosure of IPV and details of a safety plan as recorded in her EHR were auto-populated into her newborn’s admission note, potentially putting her and her infant at risk if the father gained proxy access to the infant’s medical record. To prevent these scenarios from happening in the future, a multilayered approach is needed. Clinicians should carefully review the entirety of their notes for sensitive information and be made aware when their documentation may be shared in another patient’s medical record. EHR systems should add an option to automatically “flag” sensitive or potentially harmful portions to facilitate necessary blocking. Finally, the federal government should more explicitly define what information is most appropriately blocked, including instances of IPV. Clinicians should take appropriate protective actions in their documentation through engaging survivors as partners to ensure safe documentation.
Dr Lamar participated in the care of the patient, conceptualized and designed the study, drafted the initial manuscript, and reviewed and revised the manuscript; Dr Jain participated in the care of the patient, participated in the conceptualization of the manuscript, and critically reviewed and revised the manuscript; Dr Schmitz conceptualized and designed the study, and reviewed and revised the manuscript for intellectual content; and all authors approved the final manuscript as submitted and agree to be accountable for all aspects of the work.
FUNDING: Supported by the Health Resources Services Administration award #U3DMC32755-01-00 and by the Robert Wood Johnson Foundation Grant #78701. The views expressed here do not necessarily reflect the views of the foundation. The funders had no role in the design or conduct of this study.
CONFLICT OF INTEREST DISCLOSURES: The authors have indicated they have no conflicts of interest relevant to this article to disclose.
Comments