Confidentiality in the Care of Adolescents: Technical Report

Confidentiality has wide-ranging implications in the care of adolescents until they reach the age of majority as well as young adults as they transition into independent adulthood. State and federal laws, health care entity policies, and basic ethical principles guide the provision of confidential health care. Relevant guidance may differ on the basis of geography, the age and legal status of the adolescent, and the type of service needed, creating a complex landscape for patients, families, health care professionals, and institutions. Confidentiality impacts the full health care experience, including the initial decision to seek care, the encounter between patient, family, and health care professionals, including time alone for minor adolescents with their clinician, billing and payment for services, and subsequent exchange of confidential health information between health care professionals and patients and between health care professionals and other health care entities.

Contemporary factors, including the expansion of electronic health records (EHRs) and related data interchange systems, broad regulatory changes including the implementation of the information blocking rules under the 21st Century Cures Act, and the dynamically evolving needs of adolescents, young adults, and families have underscored the necessity of accessible confidential care. In this technical report, a growing evidence base is reviewed that highlights the critical importance of confidentiality in the care of adolescents and young adults as well as the evolving complexities posed by contemporary factors. These insights provide an essential framework for providing safe, equitable, and youth-centered care today and drive improvements at both practice and policy levels tomorrow.

The right to confidentiality of one’s health information is an integral part of care and pertains to the control and exchange of data derived from that care. Confidentiality is distinguished from privacy, which pertains to the individual more broadly and not just their health information. The right to confidentiality is not absolute; therefore, health care professionals must know at all times what they may or may not disclose in their local contexts and convey these distinctions to their patients as well as their parents or guardians.

The American Academy of Pediatrics (AAP) Bright Futures: Guidelines for Health Supervision of Infants, Children, and Adolescents, fourth edition, defines the adolescent age range as 11 to 21 years.¹  For the purposes of this report, “minor adolescence” is defined as the period from 13 years of age until the 18^th birthday, since most confidentiality provisions for adolescents in state laws do not apply below the age of 13 (although some regulations do not specify a lower age limit) and the age of majority is accepted to be 18 years in most jurisdictions.²  Specific considerations for young adults 18 years and older who remain as dependents on insurance policies or to whom guardianship arrangements apply will also be addressed.

Although adolescents have historically been given limited rights to make decisions regarding their health care, there is a growing body of evidence that suggests that they are, in fact, capable of understanding the issues involved and making decisions based on that understanding.^3 ,4  However, this evidence, in general, has not been incorporated into the laws and policies that govern the ability to consent to care (other than in specific situations, as discussed later).

Ethical principles, including autonomy, beneficence, and justice, also support adolescent confidentiality. The principle of autonomy requires that we respect adolescents’ developing capacity to make decisions and recognize that this capacity will change over time. The principle of beneficence, which highlights the obligation to always seek the best interests of the patient, comes into play because public health data show that confidentiality provisions promote access to needed services and improve outcomes.^5 ,6  The principle of justice is important, because confidentiality provisions can mitigate racial and other disparities in access to care by assuring adolescents that their concerns will not be shared with others without their consent. These disparities^7 ,8  and the mitigating impacts of confidentiality provisions are particularly prominent in sensitive health domains, including sexual, reproductive, and behavioral health services.

Federal laws, including the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, the Title X Family Planning Program, and the confidentiality regulations for substance use disorder programs (42 CFR Part 2), generally provide a minimum basis for protection of minor adolescent confidentiality; state laws may provide more, but not less, protection. The Family Educational Rights and Privacy Act (FERPA), which controls access to and disclosure of students’ education records (including health information), and the 21st Century Cures Act are additional federal laws with substantial impacts on the confidentiality of an adolescent’s health information. State laws also address more granular issues, including the legal status of minors seeking services, the interpretation of exactly which services fall under state minor consent laws, the age at which minors can consent to services, and circumstances requiring parental notification of specific health issues. Additionally, individual health care entities or facilities may have policies that modify how particular provisions are applied in their specific settings.

At the federal level, the HIPAA Privacy Rule^9 ,10  offers some protections for minors. Adults, legally emancipated minors, and those who are considered “individuals” under the rule (ie, minor adolescents who may exercise rights under HIPAA without a parent or other adult as a personal representative) can control access to their health records in most circumstances. For the purposes of the HIPAA Privacy Rule, minors are considered individuals when: (1) a parent or guardian agrees that the minor adolescent can maintain a confidential relationship with a health care professional; (2) a minor adolescent may obtain the care without the consent of a parent and the minor, court, or other authorized person consents; or (3) the minor adolescent independently consents for care as allowed by applicable laws.¹¹  Applicable federal and state laws may impact parental access to a minor’s protected health information (PHI), even when the minor is considered an “individual” under the Privacy Rule. The rule specifies that parents’ access depends on whether other applicable law requires disclosure, prohibits disclosure, grants discretion to the health care professional, or is silent. The rule authorizes health care providers to exercise discretion regarding parental access to PHI using “medical judgment” in the latter two situations. Further, although health care professionals must act in accordance with these laws, they may use discretion when acting in the best interests of the patient.¹¹  States can adopt more protective rules but must at least ensure the minimum protections required by the Privacy Rule. An important provision in the Privacy Rule is that when health information is used for treatment, payment, or health care operations, the sharing of confidential information without patient consent is permitted.

HIPAA also requires that health care providers and systems (“covered entities”) develop a Notice of Privacy Practices (NPP), which must be provided to all patients. This NPP must describe the covered entity’s legal duties with respect to health information and how the covered entity may use and disclose PHI. It must also delineate the individual’s rights with respect to their information, including how to obtain further information about the covered entity’s privacy practices and how to file a complaint about a violation of the Privacy Rule. Pediatricians should educate adolescent and young adult (AYA) patients about the importance of the NPP and its impact on the confidentiality of their PHI, even though it may be the parent or guardian who acknowledges receipt of the NPP. Tailoring the NPP to issues specific to AYA health care, consistent with HIPAA legal requirements, may be useful, as well as providing an interpretation of its meaning in terms that the adolescent will understand.¹²  Further, differences in language proficiency and health literacy may impact understanding but are inconsistently considered when communicating relevant information.

Some school-based health centers and college health services operate under different confidentiality rules.¹³  The HIPAA Privacy Rule does not apply to health records within a student’s “education record,” which it defers to FERPA. This rule typically applies to records created by health care professionals working on behalf of a school, such as the school nurse. FERPA allows parents to access an unemancipated minor’s educational records, which often contain health information. If a school-based health center’s records are maintained separately, they are often subject to HIPAA, not FERPA. In any specific situation, it is important for health care professionals to carefully determine which laws apply.^10 ,11 

Also at the federal level, Title X of the Public Health Service Act (42 USC §§300–300a-6) ensures that individuals have access to high quality family planning services and related sexual and reproductive health preventive care and includes provisions that protect the confidentiality of associated health information when rendered in Title X clinics.¹⁴  In addition, 42 CFR Part 2 provides additional confidentiality protections for minor adolescents seeking treatment of alcohol or substance use disorders in any facility that receives federal funding and meets other requirements.¹⁵  Finally, the recent implementation of the 21st Century Cures Act and Open Notes has had profound impacts on confidentiality practices. Although fundamental confidentiality rights have not been altered, the way information is maintained and distributed has become much more complex. The specific provisions and their implications are discussed below.

At the state level, there is substantial variability, making it essential for pediatricians to understand their local contexts.^16 ,17  In general, state laws allow minor adolescents to consent to confidential care related to prevention, diagnosis, and treatment of sexually transmitted infections (STIs), reproductive health issues including pregnancy, substance use disorders, and in some cases, other mental health problems, although the age at which they may consent to such care varies among states.^2 ,18 ,19  Of note, there is tremendous variability among states even within each sensitive clinical domain. For example, although all states allow minor consent for STI services, some allow parental notification regarding STI services at the discretion of the health care professional. Further, some restrict which adolescents can consent to pregnancy-related services, including contraceptive services, abortion, and prenatal care. Further, although most states allow minor adolescents to consent for substance use treatment, many have minimum age requirements, and some do not clearly address the issue in state law. Many states also have no explicit laws regarding minor consent for mental health care, and others vary with regard to minimum age requirements.¹⁷ 

Importantly, the adolescent’s right to confidentiality generally applies when adolescents are allowed to give their own consent for health care. Further, the health care professional may determine, in good faith, that risks to the safety of the adolescent or others require disclosure of confidential information to a responsible adult.²⁰  Given these numerous complexities, essential resources health care professionals should review and reference in practice include the Guttmacher Institute’s “Overview of Consent to Reproductive Health Services by Young People,” which is updated monthly,²  and a recent review by Sharko et al of state-by-state variability in adolescent privacy laws.¹⁷ 

Finally, legal status laws governing designations such as mature minor, emancipated minor, minors as parents, incarcerated minor, and minor in foster care, also have key implications for health information protections. States’ provisions may grant mature minors autonomy and the decision-making authority necessary to provide informed consent for care. Mature minors are unemancipated but are deemed capable of making specific health care decisions independently. Key characteristics that inform this designation are age, functional autonomy, health complexity, demonstrated engagement in care, needed treatments, and developmental maturity.²¹  Further, states may grant legal emancipation in situations such as a minor being married, actively serving in the military, managing finances independently, or other specific criteria that can vary among states.²²  In these instances, youth, typically ages 14 through 17 years, are formally freed from the custody and control of parents or guardians. Pregnant and parenting minor birth parents can consent to their own care and that of their child in many states. Many states allow parents or guardians of youth in foster care to consent for nonconfidential care of the youth.²³  If parents are not able to engage adequately, courts may appoint a guardian or provide alternate means of consent. Adolescents in foster care typically can still consent to confidential services and expect protection of their PHI. Given all of these different variables that may impact the care of a specific youth, it is essential for pediatricians to be well-versed in the laws that govern their local context and the circumstances of each young person in their care.

Despite the common assumption that health care discussions are solely between an individual patient, their family, and their health care professional, there are multiple stakeholders involved both directly and indirectly in any health care encounter. The implications are particularly complex for minor adolescents.^24 ,25  The transition from the complete dependency of childhood, through adolescence, to adulthood, when most young people are capable of handling and controlling all of their medical records and affairs, is a continuum of developmental changes, rather than being defined by arbitrary age-defined cutoffs. Although age limits often determine confidentiality practices, those chronologic thresholds do not always align precisely with the evolving abilities of youth to handle health care matters, nor are they universally accepted by parents and other agents who have a stake in their health care.

Given the different stakeholders involved in adolescent care, their diverse interests and responsibilities, and the complex relationships between them, confidentiality discussions are multifaceted. Stakeholders can have direct involvement in the health care professional-patient interaction and decision-making (eg, patient, parent or guardian, and health care professional) or indirect engagement, receiving confidential information outside of direct interactions with the adolescent patient (eg, payers, consultants, pharmacies, schools, and other public agencies). Health care professionals often need to navigate a complex interplay between the perspectives, interests, and needs of multiple stakeholders to achieve the ultimate goal of providing beneficent care, the ethical obligation of acting in the best interests of the patient. Such care includes high-quality communication and coordination while pursuing positive health outcomes and ensuring safety at all times.²⁶ 

When a minor adolescent seeks care, the pediatrician’s primary duty is to the patient, and the pediatrician or pediatric health care professional should structure all parts of the encounter to maximize privacy, comfort, and confidentiality in a manner consistent with ensuring the patient’s safety. In some instances, doing so may conflict with the wishes of the parent or guardian, but the pediatrician should strive to meet the patient’s needs. When possible and acceptable, parent or guardian involvement in adolescent health experiences and decisions is generally desirable, yet there are many instances in which this is either not possible or is unacceptable to the youth.

Confidential care promotes trust of the clinician and encourages adolescent engagement in care and forthright exchange of accurate information.^{5 ,27 –32}  This also is true for young adult dependents on family health insurance policies.³³  When not assured that care is confidential, adolescents discuss fewer topics overall and fewer confidential topics with their health care professionals.^5 ,34  Specifically, adolescents and young adults are less likely to seek out contraceptive services, consent to STI screening or management, or disclose substance use.^{6 ,8 ,11 ,35}  In addition, if adolescents and young adults do not feel that confidentiality protections and other needs have been adequately addressed, some may seek care elsewhere, fragmenting their care experience, and some others may not seek care at all.^32 ,36 ,37 

Because of historical trauma, including systemic racism and inequities in access to care, certain populations may be particularly concerned about the handling of their PHI.³⁸  Sensitivity to these concerns is critical to ensuring that all individuals receive full consideration of their needs for privacy and confidentiality of their health care information. It is also important to handle sensitive health information and provide care in a manner that is culturally appropriate for each individual.

Assuring AYA patients of their confidentiality is crucial not only because of its impacts on communication and care-seeking behaviors, but because it is rooted in the normative developmental context of adolescence and the pediatrician’s fundamental obligation of providing beneficent, person-centered care. Confidentiality is developmentally appropriate and necessary in the context of evolving personal privacy needs, increasing autonomy, and growing decision-making capacity and responsibility.^39 ,40  It is important for health care professionals and health care entities to educate young people about confidentiality provisions to empower them to become independent consumers of health care services. Many youth seek out health information online,⁴¹  but confidentiality is often not addressed adequately by such sources. In addition, some younger adolescents may not understand or value confidentiality and may even be uncomfortable with common practices, such as time alone with health care professionals, highlighting the importance of education and supporting young people in knowing what to expect in their care over time.^24 ,42 

Parents and guardians are essential partners in promoting the health and well-being of youth and should be well-informed about their adolescent. In addition to conversations between parents and youth at home, health care professionals can support the exchange of key information during clinical encounters. However, although parent or guardian involvement is generally desirable, in some cases, the interests of the parent and adolescent may conflict or the adolescent may not be prepared to involve the parent in specific conversations. Unless significant risks to the safety of the adolescent arise or laws require otherwise, pediatricians should respect the adolescent’s preferences. When applicable laws allow adolescents to consent to specific services or allow certain adolescents to consent to their own care without parental consent, pediatricians generally may withhold resulting information from the parent; however, since not all health care issues are protected in this way, pediatricians should provide information about nonprotected matters if requested by parents or guardians. This scenario underscores the importance of efficient and reliable means of segmenting health data based on the degree of confidentiality required for any given piece of information.

Parents may vary in their understanding and perspectives regarding confidentiality.^43 ,44  In one study, 70% of parents of youth ages 13 to 18 years wanted their adolescents to have access to their health information online and 79% want their children to have control over the sharing of that information with others.⁴⁵  In contrast, multiple so-called “Parent Bill of Rights” bills have been introduced or enacted in certain states to expand parental access to medical records, to limit minor consent, and constrain confidentiality protections for minor adolescents.⁴⁶  It is important that parents understand that the adolescent’s right to confidentiality may depend on factors such as the child’s age and the identity of the health insurance policy holder.

Further, parental perspectives may evolve as their child progresses through adolescence or faces particular health challenges, such as chronic conditions.⁴⁷  One recent case-based survey found that parental perspectives on decision-making and confidentiality varied substantially across a range of issues and circumstances.^48 ,49  It is important for parents of minor adolescents to know nonsensitive health care details so that they can support their adolescents while they gradually accrue knowledge and skills needed to assume responsibility for their own health care. The pediatrician should attempt to reach common ground with the parent by underscoring a shared interest in the well-being of the youth and balancing competing demands when they exist. Discussing age, developmentally appropriate parental involvement, and graduated transitions in health care responsibilities and decision-making may help parents partner effectively with their youth and health care professionals over time.^50 ,51  Further, pediatricians can support parents in communicating effectively with their adolescents and young adults and employing positive parenting practices, so that they can become more involved, while also affirming confidentiality protections.⁵² 

Pediatricians may encourage adolescents to share health information with parents or guardians. This is a teachable moment in which pediatricians can discuss appropriate parental involvement, even for patients 18 years and older. In many instances, youth desire parental involvement and support but have difficulty initiating and navigating sensitive conversations. Health care professionals can provide critical guidance and support for youth and even mediate these conversations.

Of note, family dynamics may sometimes make information handling not only challenging but overtly contentious. In such circumstances, health care professionals need support from their institutions in managing conflicting perspectives and dissatisfaction. Further, sociocultural factors related to family structure, parent-child relational dynamics, perspectives and responsibilities regarding health and health care, and cultural perspectives on sensitive issues, such as mental health and sexual health, may also impact parental perspectives.

The health care professional caring for a minor adolescent who requests confidential services is in a unique situation, as the patient and parents or guardians may each have separate interests in the encounter, and the health care professional must be mindful of the roles that both have in the overall care of the adolescent. In balancing an adolescent’s desire for confidentiality with a parent’s concerns about their child’s health, the pediatrician’s role is to consider the circumstances of care and the tools and resources available for preserving confidentiality.^53 ,54 

In addition, health care professional perspectives and attitudes around confidentiality and knowledge of local laws may impact how they provide care.⁵⁵  Many clinicians are not familiar with relevant laws and clinical guidelines and do not receive training around implementing protections in practice. One study found that only 56% of health care professionals discussed confidentiality with adolescents, and many expressed uncertainty about management of sensitive concerns.⁵⁶  Adolescents and young adults may interact with a variety of clinicians over time who differ in their understanding of the importance of confidentiality or the value they place in preserving it. Health care professionals may perceive the impacts of confidentiality differently given the widely varying health needs of youth across different specialties and clinical settings, ranging from the medical home to specialty clinics and hospital settings.⁵⁷  One study showed that less than half of parents and adolescents reported discussing confidentiality practices, even within the medical home during preventive services visits.⁵⁸  Further, even though private conversation between health care professionals and adolescents is a common expectation among youth and families^34 ,54  and impacts the confidence of youth in seeking care,^32 ,59  actual time spent alone with adolescents during visits is inconsistent and variable across ages and genders.^60 ,61  In one recent study, only about half of youth 12 to 20 years of age receiving care from general pediatric professionals had private conversations with the clinician, indicating substantial opportunity to expand implementation of this best practice and strengthen access to confidential care.⁶²  The added time and logistical burdens of discussing and preserving confidentiality are not insignificant and may further impact health care professional workflow and attitudes, underscoring the need to develop practical tools and resources to support clinicians in maintaining best practices.

Several professional societies, including the AAP, the Society for Adolescent Health and Medicine, the American College of Obstetricians and Gynecologists, and the American Medical Association have affirmed the importance of confidentiality in adolescent health care and have been active agents in shaping the health care environment to support highest-quality care.^{26 ,40 ,63 –68}  Best practice guidelines and health care professional ethical standards articulated by these organizations support the provision of confidential services.

Finally, it is important to note that maintaining confidentiality in health care settings requires that all health care team members understand applicable laws and policies and act to preserve confidentiality for youth. Specifically, nurses, medical assistants, and laboratory staff often navigate sensitive information when engaging with youth and family members during clinical encounters. Further, front desk and other administrative staff will similarly encounter sensitive information when communicating with youth and their families around appointments and other related needs. Education and training in confidential care practices for all care team members is necessary to ensure high-fidelity protections throughout the adolescent’s care experience.

There are numerous indirect stakeholders in the care of adolescents and young adults including consultants, hospitals or health care systems, payers, pharmacies, schools, and other public agencies. Overall, there is little literature describing the full spectrum of challenges to confidentiality across sectors and their impacts.

Specialty consultants are in a unique situation because they may have access to the entirety of an adolescent’s health record (especially given the move toward integrated health care delivery systems) and, thus, may become aware of confidential information even when it is not directly related to the purpose of the consultation. The right to confidentiality for the adolescent is an essential tenet of the complete health record and must be acknowledged by all who have access to that record. Further disclosure by the specialist of information related to minor-consented services, in most cases, may only be done with the direct consent of the minor, regardless of the means by which the clinician becomes aware of such information. In addition, services performed by the specialist that have confidentiality implications, such as pregnancy testing or mental health screening, should be subject to the same protections as when those services are provided elsewhere.

By virtue of both vertical and horizontal integration, a broad network of health care professionals and other health care team members may access information in the medical records of a health care system. System-wide safeguards to ensure the confidentiality of PHI, regardless of where or how it is stored by the health care system, are critical. Health systems are also primary parties to more recent regulations around information blocking (limiting access, exchange, or use of electronic health information) and patient access to health records.

The entire commercial insurance claim process, including acknowledgment of receipt of a claim, requests for additional information, payment, or denial, and the sending of an explanation of benefits (EOB) to the policy holder, claimant, or patient, is fraught with risks of disclosure of potentially confidential information. These well-documented gaps in protection for adolescents and young adults have seldom been addressed with effective solutions.⁶⁹  Although youth insured by Medicaid do not typically face these confidentiality risks, those with commercial insurance are often faced with a choice between preserving confidentiality and receiving needed services covered by their insurance. One option is for the health care professional to refrain from billing for that care or to refer all youth needing sexual and reproductive health services to Title X-funded clinics or other venues that offer alternative payment options; although potentially effective for preserving confidentiality, these options are not scalable and sustainable, and they put the responsibility for failure to develop appropriate confidentiality policies squarely on the shoulders of the health care professional rather than payers or other entities.^69 ,70  These complex issues are discussed further below.

Because the nature of a confidential condition may be discernible from prescribed treatments, a pharmacy or a pharmacy benefits manager will also come into possession of confidential information in the ordinary course of business. Current procedures, including automated notification of prescription status and updating medication lists in EHRs, risk revealing confidential information about an adolescent’s care when filling or delivering prescriptions. In addition, the training and perspectives of pharmacists themselves related to adolescent care and confidentiality may vary, creating further vulnerabilities in the provision of confidential services.⁷¹ 

Schools routinely receive information from health care offices that may contain confidential information and are, thus, obligated to develop policies around consent and information exchange to ensure confidentiality. Often, schools exchange information for the purposes of ensuring a healthy and effective educational experience for adolescents (eg, educational accommodations, in-school health services). Given the lack of segmentation of health care documentation resulting in the frequent intermingling of confidential and nonconfidential details, it is important for schools to develop policies that address the benefits and risks of such information transfer.

In addition, school-based health care services may address sensitive needs, and the resulting health information must be managed in accordance with FERPA or HIPAA,¹³  depending on the specific setting. These complexities often increase when youth go to college and seek services in college health clinics.⁷²  The handling of these records can vary and should be discussed in detail with young people when they seek care so that confidentiality is preserved and parents are involved to the extent youth desire.

Other agencies involved in serving the needs of children (eg, foster care agencies, child welfare bureaus, and others) should also be involved in collaboration intended to recognize and safeguard the AYA’s access to information and need for preservation of confidentiality. Because many of these agencies are regulated legislatively, advocacy and cooperation across jurisdictions can help ensure a common approach to the rights of the AYA.

With recent technological advancements, such as EHRs, patient portals, integrated messaging between patients and health care professionals, after-visit summaries, automated appointment reminders, clinical result and other notifications, and the advancement of “open notes” and prohibitions against information blocking, there are many points of vulnerability in contemporary adolescent health care where confidentiality may be compromised if appropriate safeguards are not put in place.^73 ,74  Each of these functionalities is fundamentally designed to improve clinical care and patient experiences, but each also entails specific risks and vulnerabilities for AYA patients.

Despite the increasing sophistication of EHRs and comfort in their use among health care professionals, concerns regarding the maintenance of confidentiality remain substantial.^75 –78  Vendors and health care institutions share responsibility for the protection of confidentiality in the use of EHRs through the development of key functionalities (eg, proxy access, granular privacy controls, information segmentation) within EHRs and the implementation of necessary trainings and workflows in specific clinical settings. Development of appropriate and universally accepted rules on issues such as data segmentation is still in a relatively early stage, and the source of adequate funding to continue development is uncertain. Ideally, this would be federally funded to help ensure application on a national basis, but the issue of state laws governing confidentiality must also be addressed. Other innovations that can enhance protections within the EHR include surveillance mechanisms to prevent family members employed by the health care entity from accessing records and the option of creating “sensitive notes” that require specific access privileges (eg, for child maltreatment and mental health services).⁷⁹  The AAP policy statement on health information technology standards to ensure adolescent privacy addresses key considerations.⁸⁰ 

Patient access to health information between visits is important and has been shown to enhance care and engagement among adults.^81 ,82  Adolescents, young adults, parents, and health care professionals have varied perspectives regarding portals and their impact on confidentiality.⁸³  The complex interweaving of laws, regulations, and policies that govern confidentiality have substantial implications for how patient portals and access to health information can be provided to youth and their families in keeping with the mandates of increasing access, transparency, and engagement, while also protecting confidentiality.

Policies controlling access to health information of AYA via patient portals vary greatly from one institution to another. There is no widely accepted guidance regarding such issues as the age at which an adolescent can or should be given access to a portal or the age at which parental access should be blocked, nor are there well-developed procedures for differentiating between and segmenting the release of sensitive and nonsensitive information to the portal.⁸⁴  Because of these gaps, physicians and institutions are left to develop their own policies, and differences in policies can either impede transmission of information or lead to breaches of confidentiality during transmission between entities with different policies and procedures.

These issues have resulted in complicated processes at institutions that allow or disallow minor adolescents to directly access patient portals,⁸⁵  and the appropriate frequency for reassessing access parameters is unclear. For example, some minor adolescents initially may wish to grant access to their parent or proxy to maximize convenience for their family, particularly if they are not seeking confidential services at the time; however, their perspective or circumstances may change at any time, necessitating confidentiality protections, but without ready means to make needed changes in the portal environment without unintentionally signaling to the parent the onset of confidential concerns in the adolescent’s life. Deploying confidentiality protections in a precise and timely manner would require asking the minor adolescent during every health care interaction whether the parent or proxy can still have full access. Health care professionals and others, such as administrative staff, would need to be knowledgeable about the rights of minor adolescents to confidential care in their state and remember to do this at every interaction. This process may increase burden on health care professionals and staff, yet failure to implement these intricate protocols may result in breaches of confidentiality. Ideally, there would be automated segmentation of health information in patient portals and differential entry points for patients and proxies, allowing parents and minor adolescents access to health information with much more granularity than is possible currently.⁸⁶  There are ongoing efforts to develop solutions to this problem. One example is the independent health care task force for equitable interoperability, named Shift (https://www.shiftinterop.org/), which is working to develop viable solutions and includes health care professionals, medical informatics experts, lawyers, ethicists, patient advocates, and EHR vendors.

Health care professionals also have to consider how they might verify that the “owner” of a portal is the adolescent patient acting independently. Parents without direct portal access may sometimes create an adolescent portal account or ask their minor adolescent to sign up for an account using the parent's e-mail address to access their child’s health information, highlighting the need to confirm the identity of account holders and develop mechanisms to ensure accounts are used as designed once created. Two studies found that guardians accessed more than half of adolescent portal accounts.^87 ,88  The practicality of any such mechanisms to guarantee the propriety of portal use is unclear, emphasizing the need for detailed education of both the adolescent and the parent before establishing portal access. Importantly, improved data segmentation and increased parental portal access to nonsensitive information may decrease parental misuse of adolescent portal accounts. Further, youth in out-of-home placements (eg, foster care or justice or legal system involvement) may face additional barriers to attaining appropriate portal access because of issues related to consent as well as frequent transitions in care. For youth in foster care or kinship care placements, regulations vary regarding whether foster parents, kinship providers, and birth parents are afforded proxy access to an adolescent’s health information depending on the circumstances.

Implemented in 2021, the 21st Century Cures Act and associated regulations^89 –93  have spurred much discussion of the challenges of protecting confidentiality and the urgency of creating more granular controls within EHRs.^94 –96  Many health care professionals have limited training in managing confidentiality within EHRs and patient portals.⁷⁵  A common suggestion is for health care professionals to generate secure notes or otherwise denote content that should remain confidential,^94 ,95  although this places the burden on health care professionals to preserve confidentiality within record systems that do not otherwise have adequate protections. A statement by the North American Society for Pediatric and Adolescent Gynecology and the Society for Adolescent Health and Medicine, endorsed by the AAP, provides guidance on compliance with this federal mandate while continuing to protect adolescent confidentiality.⁹⁷  The AAP also provided additional guidance on how to best implement this rule in pediatric practices, including discussion of key exceptions that would allow the blocking of information release to proxies (parents) and release only to adolescents because of confidentiality concerns (when state laws allow these protections) as well as discussion of the infeasibility of streamlined processes because of lack of information segmentation.⁹³  Understanding the valid exceptions to information blocking prohibitions can mitigate challenges for health care professionals and barriers to confidentiality for youth.⁹⁸ 

Lack of data segmentation in the EHR creates difficulties in the handling of confidential information obtained during otherwise nonconfidential encounters, such as preventive care visits. Maintaining confidentiality is challenging unless the EHR has native functionalities that support segmentation of this data, such as parallel confidential and nonconfidential documentation options. This intermingling of confidential and nonconfidential information also poses challenges related to clinical summary documents, such as after-visit summaries (AVSs).^74 ,84  A breach may occur if a parent receives an AVS that contains confidential information. Providing the AVS directly to the adolescent may pose problems if the parent is expecting a summary document after an encounter. Some institutions have been able to segment information, specifically omitting confidential diagnoses, medications, and orders from AVS content.⁷⁴  Given the different perspectives and expectations of adolescents and their parents after visits, education by health care professionals around the rationale for different information exchange processes may be necessary. Further, given the lack of segmentation of information, health care professionals may need to supplement information exchange with parents to support their engagement in nonconfidential health issues, given that confidentiality protections may incidentally block nonconfidential details. Ideally, this segmentation of portal and AVS information should be automated to avoid increasing documentation burdens on health care professionals.

Given continual changes in clinical practice, maintaining a high-fidelity segmentation process requires close involvement of pediatricians to provide ongoing review of new facets of care (such as new STI testing) that may be added as standards of care evolve. Importantly, when the AVS is provided only through the patient portal, rigorous portal access protections and data segmentation should be sufficient.

Regional health networks and hospital and/or vendor health information exchanges support integrated care and population health management by allowing health care professionals to share patient health information between practices and institutions, even in different states with differing confidentiality provisions. Although these networks serve primarily as conduits for data exchange between health care professionals and do not store any health care information, they do need policies that require all users who receive information on minor-consented services to provide the same level of confidentiality protection as provided by the originator of the PHI. Some states, such as New York, have developed extensive regulations and guidance to ensure adequate confidentiality protections.^99 ,100 

In general, patients 18 years and older or the parents or guardians of minor adolescents consent for data entry into regional health information organizations (RHIOs); however, when minor adolescents consent to confidential care, consent for entry into RHIOs¹⁰¹  should only come from the adolescent. Most RHIOs are within a single state, and health care professionals and staff should be familiar with state laws governing adolescent confidentiality, yet this is not always the case, and breaches of confidentiality may occur.

Even more challenging are health care information exchange systems based on EHR platforms or health system networks. Confidential information may be accessible to a range of health care professionals in different states with varying local confidentiality provisions and practices, creating the potential for unintended breaches. This situation also creates the possibility that a health care professional in one state may be mandated to disclose information to a parent that was derived from an encounter in another state, within which that information is considered protected. Health care professionals may not be familiar with the originating state’s laws and may inadvertently breach confidentiality because of these differences between states.

Contemporary health care services involve not only formal EHRs and information exchanges but also other multifaceted communication modalities between health care professionals, patients, and families and between health care professionals and other health care entities. Although the latter typically entails more traditional modalities, such as telephone, facsimile, and secure electronic mail correspondences, the former may in some instances include SMS text messaging, other communication applications, or even social media engagements, depending on the needs and preferences of the patient. Many health care professionals may want to engage youth through whichever modalities they request in the spirit of trying to meet them where they are, but it is essential to remember that preserving the minor adolescent’s confidentiality is ultimately in their best interest and should generally supersede considerations of convenience or comfort. It is the responsibility of health care professionals to ensure that all modes of communication are HIPAA compliant and fully maintain confidentiality.

In recent years, transfer of health information has expanded to other access points and technologies, most notably telemedicine. These have improved ease of access for adolescents but have also created new questions around security and confidentiality.¹⁰²  Confidentiality provisions should protect both the delivery of services as well as the storage and transmission of health information and health records that result from those services. The coronavirus disease 2019 (COVID-19) pandemic accelerated the adoption of telemedicine for adolescent health care.^103 –106  Effective and safe use of these newer modalities of communication and information sharing requires close partnership between pediatricians, patients, families, technology vendors, and policy makers.^{84 ,107 ,108}  The same level of confidentiality protections and assurances that apply during and between in-person health care encounters should apply to telemedicine as well.¹⁰⁹  Additional steps may be required on the part of the health care professional to ensure that communications are truly confidential. Specifically, health care professionals can encourage youth to be certain they are in a private setting during the encounter (eg, their room, a car), confirm the absence of other people during sensitive conversations, advise youth to use headphones and chat features within telemedicine platforms to avoid being overheard, and confirm the accuracy of direct contact information during each encounter. Of note, there is potential for disparities¹⁰³  among youth in accessing telemedicine services as well as in ensuring confidentiality during encounters because of practical limitations related to the characteristics of home environments and equipment availability.

In addition, as new technologies, such as artificial intelligence, become a part of pediatric care, it will be important to ensure that these tools recognize and include all previously adopted methods for segmentation of data and preservation of confidentiality. The impact and unintended consequences of these new technologies on confidentiality must be assessed before their implementation to avoid creating new difficulties in preserving the rights of the AYA.

Billing and claims are necessary parts of our current health care system but pose substantial risks to confidentiality, particularly when a minor adolescent seeks and consents to confidential services without the direct involvement of a parent or guardian. Because payment requires exchange of medical information between health care professionals and payers, billing and claims processes complicate efforts to protect confidentiality for both minors as well as adult dependents on family policies.^{69 ,110 –112} 

Adolescents may be uninsured, underinsured, on public or private insurance, including as a dependent on a family insurance plan, or on a state family planning services plan. These nuances affect billing and claims processes and how their health information will be handled. In general, Medicaid coverage historically did not involve statements sent to parents because no insurance was purchased, but with the advent of managed Medicaid plans administered by large private payers in many states, the complexity of maintaining confidentiality through these contracted relationships has increased dramatically. The operations and billing processes of related state-funded reproductive health programs vary.¹¹³  Some states prohibit contraceptive care to minors through state-funded programs without parental notification.¹¹⁴  Title X of the Public Health Service Act requires funded organizations to provide confidential services to minor adolescents.^{14 ,115 ,116}  Title X-funded clinics can provide confidential sexual and reproductive health services using sliding-scale fees.¹¹⁷  Other federally supported programs for substance and alcohol use also have applicable rules.¹⁵ 

For minor adolescents and young adults on parent-subscribed commercial health insurance policies, consumer law gives the purchaser a right to know that related expenditures are appropriate; however, HIPAA provides that information about care may not be shared with unauthorized recipients, including parents when adolescents receive confidential care. For commercial payers, EOBs are communications to policy holders regarding services rendered to specific covered dependents to prevent fraudulent billing and provide policy holders information regarding what was covered by their insurance and what financial obligations remain. Although some states have developed mechanisms for covered dependents to receive confidential services while using insurance^{69 ,70 ,117 –120}  without information being disclosed to the policy holder, these processes are neither foolproof nor widespread. Some may allow owners of health information (minors or young adults who receive confidential services) to request that such correspondences are either not sent, are sent by alternate means, or are sent directly to the patient.⁶⁹  Importantly, the Patient Protection and Affordable Care Act requires coverage of essential preventive services, including many sexual or reproductive health services, without cost sharing, which could obviate the need for EOBs.^121 ,122  In addition, under the Affordable Care Act, many young adults remain on parent-subscribed health insurance policies up to the age of 26 years. For these adults, having insurance coverage is beneficial but may create further challenges in ensuring confidentiality.¹²³ 

Given this complex landscape, adolescents and young adults deserve a clear explanation of potential risks to confidentiality at the time of care to enable them to make informed decisions. Further, health care professionals should ensure adolescents and young adults receive needed care, even if it requires additional efforts to coordinate between different clinical venues or clinicians to account for differential risks to confidentiality across settings and payment structures. Health care professionals should consider a range of options for ensuring adolescents and young adults receive confidential care, including implementing modified payment plans^124 ,125  and confidential billing practices, and developing seamless processes for referring them to Title X-funded clinics and other low-cost alternatives.¹²⁶ 

There are some circumstances in which managing a minor adolescent’s risk to self or others is incompatible with preserving confidentiality. In these cases, it is critical for health care professionals to address safety risks proactively and work to mitigate potential negative consequences of any necessary breaches of confidentiality. Specifically, if a patient reports active suicidal ideation, that someone is harming them, or that they plan to harm others, the pediatrician and other mandated reporters must break confidentiality and inform other responsible individuals (eg, parents, other health care professionals, relevant authorities).¹²⁷  These responses can be challenging to navigate, may increase the distress of the adolescent, and strain the patient-health care professional relationship.

Subacute safety compromise may also compel disclosure of health information in certain situations. A common example is complex substance use behaviors. Although reports of substance use are often maintained in confidence between adolescents and their health care professionals, escalating patterns of use (ie, amount, frequency, types of substances used), use associated with severe impairment and life disruption, or use linked with potentially dangerous behaviors such as driving, may warrant disclosure to parents or others to ensure the safety of the adolescent.¹²⁸  There are no set rules on how to approach these complex situations, which always require skilled assessment and careful decision-making by health care professionals.

In addition, minor adolescents with nonsuicidal self-injurious thoughts and behaviors, defined as a direct, deliberate destruction of body tissues in the absence of lethal intent,¹²⁹  may be at risk for severe harm and are at a much higher risk of suicide.^130 ,131  Although self-injurious thoughts and behaviors themselves may not have lethal intent, given the potential for severe injury and association with potential suicidal ideation and attempts, health care professionals may consider breaking confidentiality to ensure the safety of the adolescent.

Further, clinical circumstances that entail mandated reporting of risks to the patient or others supersede confidentiality considerations. Mandated reporting generally surrounds possible abuse or neglect of minor adolescents. Additional compulsory disclosures include the reporting of information about reportable diseases (eg, certain sexually transmitted infections) and health information disclosed by health care professionals who are compelled to testify in legal proceedings. Recent efforts have explored further the issue of adolescent relationship abuse, which may not fall under mandated reporting requirements but represents a substantial potential threat to the safety of the adolescent.^132 ,133  Of note, human trafficking falls under mandated reporting requirements in many jurisdictions.¹³⁴ 

Pediatricians should discuss the limits of confidentiality before starting confidential portions of clinical encounters to ensure youth are well-informed about the possibility of essential disclosures in certain circumstances.¹²⁷  When disclosure is necessary, the pediatrician should inform the minor adolescent of the need to break confidentiality before doing so, if possible. Any such disclosures should be made only after careful consideration and ideally in partnership with the adolescent, given the potential for unilateral disclosures to increase the distress of young people and disrupt treatment alliances. Importantly, disclosures in some cases may increase safety risks to the youth depending on the parent’s response to the disclosure, and this should be considered when determining whether disclosure is in the best interests of the adolescent. Pediatricians should give them as much control as possible over the disclosure process, including when, how, and with whom information is shared and which specific details are disclosed. In many cases, youth may agree with the need for involvement of caring adults but simply need support from their health care professional in navigating these challenging conversations. Thoughtful and proactive involvement of caring adults may actually decrease the distress of the youth by mitigating isolation and eliminating the chance of future disclosures of information at a time and in a manner not of their choosing.

In health emergencies and stable critical illness in which the adolescent is unconscious or otherwise unable to consent to testing and care, it is well accepted that needed care may be provided to preserve life and limb.¹³⁵  Such care, however, may reveal health information that typically would be maintained confidentially. For example, evaluation might reveal pregnancy, a sexually transmitted infection, or substance use of which the next-of-kin is unaware.

Minors in foster care and kinship care typically are entitled to the same confidentiality protections as other youth, although this can vary between states.¹³⁶  Certain states may have conditional disclosure laws, such as permitting disclosure of a minor adolescent’s HIV status or a range of other health information to foster parents or other out-of-home caregivers, even if the youth consented to the relevant care independently. Pediatricians should be familiar with local laws.¹³⁷  The dynamics of consent for routine components of care (eg, immunizations) may vary depending on the circumstances, but in general, these youth are able to consent for confidential services when needed as any other youth can. The health care needs of youth in foster care and kinship care are oftentimes complex and entail additional vulnerabilities to confidentiality breaches because of transitions of custody and care and resulting transfers of health information.^138 ,139  In addition, populations that have been subjected to systemic racism and marginalization are often disproportionally represented in the foster care system, and the consequences of breaches in confidentiality may be particularly problematic for these youth. Given these complexities, it is essential to maintain updated contact information as well as clear identification of who is able to consent for services and who the primary foster care or kinship care individual is at all times to avoid improper disclosures of information.

For youth involved in the justice or legal system and correctional settings, health services standards set forth by the National Commission on Correctional Health Care emphasize the importance of privacy in the provision of clinical services and confidential handling of health information. These standards have been established to ensure that youth can seek care and support freely and that their dignity is maintained in every respect. However, staff are ultimately guided by relevant laws that apply to their specific state or jurisdiction,¹⁴⁰  which may result in variability across settings.

Adolescents and young adults who are refugees or immigrants with varied legal statuses may face additional complexities and risks related to maintaining the confidentiality of their PHI.^141 ,142  These challenges have been particularly pronounced related to reproductive health and mental health needs and services and are ongoing foci of advocacy among varied stakeholders. Given the inordinate challenges many of these youth face and the associated health consequences, ensuring high-quality, accessible health services is critically important.

Managing confidentiality for adolescents with complex health care needs may be challenging, particularly in the setting of behaviors that pose pronounced risks to health and safety because of their underlying chronic conditions. These adolescents may interface with numerous health care professionals across multiple settings, creating additional points of vulnerability in information handling. Although sexual health care needs in this population are often overlooked, data demonstrate that adolescents with chronic conditions have rates of sexual activity similar to their healthy peers.¹⁴³  Concerns may also arise related to treatment nonadherence and other risky behaviors. Although these behaviors are common among youth and are often handled without breaching confidentiality, any related negative outcomes may be particularly severe in the context of a chronic condition. Health care professionals may consider breaching confidentiality to engage a supportive adult and address risks that rise to a particular threshold of concern. In such cases, an approach that centers the adolescent’s perspectives and priorities as much as possible is critical to ensuring a positive outcome.

Caring for patients with neurodevelopmental or intellectual disabilities may involve additional challenges in maintaining confidentiality, because these patients may engage in risk behaviors that are otherwise protected by confidentiality provisions in neurotypical adolescents.¹⁴⁴  Although recommended broadly, it is particularly important for pediatricians to encourage patients with neurodevelopmental disabilities to speak with parents about confidential topics such as sexual health behaviors, given the increased risk for abuse and other negative outcomes in this population.^145 ,146  Furthermore, using developmentally appropriate language is important to ensure patient-centered discussion of these complex topics.^145 ,147 

In addition, issues regarding consent for services, which drives confidentiality protections around resulting health records, may be complicated in the setting of neurodevelopmental disability. It is critical for health care professionals to ensure appropriate consent for services is obtained during care in keeping with the decision-making capacities of individual patients. There are a range of supported decision-making arrangements that may be implemented by neurodiverse youth and their families. The specifics of information sharing in these circumstances are generally determined by health care professionals and families using shared decision-making.¹⁴⁸  Parents often gain legal guardianship of their adolescents with cognitive impairment or intellectual disabilities as adolescents transition to become legal adults. The parents then become legally allowed full access to health information, regardless of the age of the patient.

There are numerous documented health disparities among LGBTQIA+ adolescents. Standardized collection of sexual orientation and gender identity information is critical to measure outcomes in this population.^149 –151  The AAP recommends that EHRs are designed to respect the gender identity of each patient and ensure patient confidentiality.¹⁵²  Maintaining confidentiality of sexual orientation and gender identity information can be challenging, especially in instances in which adolescents may have not yet shared this information with family members or guardians. If an adolescent patient is “out” to themselves and to their pediatrician but is not ready to disclose to their family members or other members of their care team, segmentation of any documented data on sexual orientation or gender identity in the EHR is needed to prevent a confidentiality breach, and discussion with the adolescent of the implications of documentation in the EHR is indicated.

Gender-affirming care can help to resolve dysphoria caused by secondary sex characteristics, but there are potential instances in which youth and parents disagree about these interventions. There are no specific legal carve-outs for transgender or gender-diverse youth to seek gender-affirming treatment without parental consent, although an adolescent might be able to seek some reproductive health care (ie, with resulting menstrual suppression or manipulation) under existing state legal protections.^152 ,153  Pediatricians should familiarize themselves with their state’s laws to provide high-quality confidential care to their transgender and gender-diverse patients and consult with legal counsel as this is a rapidly evolving area of law.

In managing these and other challenging circumstances, it is critical to sustain focus on beneficent care and continually center the perspectives and priorities of the adolescent patient, whether or not confidentiality can ultimately be maintained. Often, the nuances of complex circumstances require careful clinical decision-making that considers the adolescent’s ability to understand the risks and benefits of different management options, the severity of current health and safety concerns, and overriding constraints on confidentiality, such as mandated reporting requirements. Transparency about decision-making should be maintained whenever feasible. Once a determination is made, careful planning around next steps is always necessary given the complex systems and processes that affect information handling.

Clearly explaining the limits of confidentiality^127 ,154  before beginning potentially sensitive conversations is a clinical best practice. Before any disclosures, it is important to engage the minor adolescent directly and offer as much control over the disclosure process as is feasible. Framing discussion in terms of securing additional supports for the adolescent and ensuring safety rather than legal imperatives is both more patient-centered and likely more intelligible for youth.¹⁵⁵  Limiting disclosures to only essential information may be technically challenging but is critical. Finally, detailed documentation around confidentiality discussions with patients and families is essential given the complex implications of resulting decisions. A clear rendering of the situation at hand, the countervailing considerations, risks, and benefits considered, and the ultimate decision and plan, with a focus on the best interests of the adolescent, is important.

Confidentiality is essential for high-quality, AYA-centered health care services. Pediatricians should understand the relevant laws, systems, and processes within their local contexts so that they can provide care that supports optimal outcomes and keeps everyone safe, particularly as a range of contemporary factors creates vulnerabilities in information handling. In addition, health systems, EHR developers, payers, and other relevant entities have critical roles to play in improving tools and processes to optimize care and outcomes, while facilitating data sharing and preserving confidentiality. The current literature underscores the importance of confidentiality while highlighting opportunities to innovate practice and evolve policy in the future to further improve confidentiality protections and health care experiences for adolescents and young adults.

Richard J. Chung, MD, FSAHM, FAAP

Janet B. Lee, MD, FAAP

Jesse M. Hackell, MD, FAAP

Elizabeth M. Alderman, MD, FSAHM, FAAP

Elizabeth M. Alderman, MD, FSAHM, FAAP, Chairperson

Elise D. Berlan, MD, MPH, FAAP

Richard J. Chung, MD, FSAHM, FAAP

Michael Colburn, MD, MEd, FAAP

Janet Lee, MD, FAAP

Maria Monge, MD, FAAP

Taraneh Shafii, MD, FAAP

Stephenie B. Wallace, MD, MSPH, FAAP

Laura K. Grubb, MD, FAAP

Stephenie B. Wallace, MD, MSPH, FAAP

Anne-Marie Amies, MD – American College of Obstetricians and Gynecologists

Laura K. Grubb, MD, MPH, FAAP – Society for Adolescent Health and Medicine

Liwei L. Hua, MD, PhD – American Academy of Child and Adolescent Psychiatry

Seema Menon, MD – North American Society for Pediatric and Adolescent Gynecology

Maria H. Rahmandar, MD, FAAP – Section on Adolescent Health

Ellie Vyver, MD – Canadian Pediatric Society

Lauren Zapata, PhD, MSPH – Centers for Disease Control and Prevention

Karen S. Smith

James Baumberger, MPP

Jesse Hackell, MD, FAAP, Chairperson

Yvette Marie Almendarez, MD, FAAP

Abeba Mebrahtu Berhane, MD, FAAP

Patricia E. Cantrell, MD, FAAP

Lisa Michele Kafer, MD, FAAP

Tomitra Latimer, MD, FAAP

Robin Warner, MD, FAAP

Robert H. Wiskind, MD, FAAP

Alisa Skatrud – Family Liaison

Seth Kaplan, MD, FAAP – AAP Section on Administration and Practice Management

Abigail English, JD – Center for Adolescent Health and the Law

Mackenzie Magnus

Elisha Ferguson

AAP

American Academy of Pediatrics

AYA

adolescent and young adult

EHR

electronic health record

EOB

explanation of benefit

FERPA

Family Educational Rights and Privacy Act

HIPAA

Health Insurance Portability and Accountability Act

NPP

Notice of Privacy Practices

STI

sexually transmitted infection