Minor Consent and Confidentiality and HIPAA’s Impact on Child Abuse and Neglect Cases Presented By: Jessica Braunstein Associate General Counsel Children’s Healthcare of Atlanta

2 Consent Overview Georgia Medical Consent Statute – persons authorized to consent to medical/surgical treatment: –Any adult for themselves, whether by living will or otherwise; –Any person authorized under a durable power of attorney for healthcare; –Any parent for his minor child. –Any married person for an incompetent spouse; –Any person temporarily standing “in loco parentis” whether formally serving or not, for the minor under his care; and any guardian, for his ward; –Any female in connection with pregnancy

3 Consent Overview In the absence of persons listed to consent: –Any parent for his adult child –Any adult for his brother or sister; or –Any grandparent for his grandchild –Any adult child for his parents Exception – In case of emergency –No consent is required Good Faith Immunity: –Any person acting “in good faith” shall be justified in relying on the representations of any person purporting to give consent, including, but not limited to, his identity, his age, his marital status, his emancipation, and his relationship to any other person for whom the consent is purportedly given.

4 Minors and Consent Minors - persons under the age of 18 Georgia Medical Consent Law –Minors cannot consent to medical treatment for themselves or others –Authorization from parent, guardian or person standing in loco parentis is required Exceptions: –Status –Type of treatment sought

5 Exceptions: Status Law authorizes minors who have achieved a certain status to consent: –Minor parents can consent to treatment for minor child(ren) –Married minors can consent to treatment for self and minor or adult spouse

6 Exceptions: Treatment Law authorizes minors to consent to certain types of treatment: »Minor females for testing or treatment in connection with pregnancy, pregnancy prevention or childbirth Includes contraceptive services (prevention) Not abortion or sterilization »Minors for treatment for substance/drug abuse Inpatient or outpatient »Minors for testing or treatment for sexually transmitted diseases

7 Minors and Consent Cont. Physician Notification Provisions: –Permitted where treatment sought is for substance/drug abuse or sexually transmitted diseases »Including HIV/AIDS –Not permitted where treatment sought is related to pregnancy »Minor must consent »Opportunity for discussion

8 Whose Medical Records Are They? HIPAA - Records belong to patient or ‘personal representative’ –‘Personal representative’ = person able to consent under applicable law If minor consents, medical records containing PHI related to the treatment is confidential unless the minor consents to release

9 Cases / Hypotheticals Janie is a 16-year-old patient of Dr. Tightlip. She is in love, and she asks Dr. Tightlip to give her a prescription for birth control. She tells Dr. Tightlip that she doesn't want her parents to know because they would try to stop her from seeing the love of her life. Dr. Tightlip prescribes birth control pills for Janie without telling her parents. Three months later, Janie's mother finds the birth control pills in Janie's dresser drawer. Outraged that Dr. Tightlip would go behind their backs and encourage their daughter in promiscuity, Janie's parents sue Dr. Tightlip for treating their minor child without their consent. Outcome?

10 Cases / Hypotheticals Janie's boyfriend tells her that he has been diagnosed with syphilis and suggests that she see a doctor immediately. He assures her that she can give consent to the treatment without her parent's permission. Embarrassed that her parents sued Dr. Tightlip for helping her, she makes an appointment with Dr. Tellall. Dr. Tellall treats her sexually transmitted infection (STI) and gives her an ultimatum -- either she tells her parents, or he will. Outraged, Janie threatens to sue Dr. Tellall if he tells her parents. Despite her threatened lawsuit, Dr. Tellall notifies Janie's parents that he is treating her for venereal disease. Can be sued for breach of confidentiality or treatment of minor without consent?

11 Hypotheticals/Cases When Janie's mother found the birth control pills in her dresser, Janie stopped taking them. Three months later, a home pregnancy test shows that she is pregnant. Desperate to keep her parents from finding out, she returns to Dr. Tightlip for an abortion. He tells her that she is about six weeks pregnant. She pleads with him not to tell her parents and to perform the abortion immediately. Can he perform the abortion? Does he have to notify parents?

12 Cases / Hypotheticals Steve is a 16 year old minor who has used smoked marijuana for fun with some buddies few months ago. Since then, he has smoked marijuana every weekend and finds it difficult to resist the urge when his friends approach him with the drug. He is afraid to use it again because he feels as if he has a problem. He wants to talk to a doctor about it, but thinks his mom will be angry with him if she finds out. Can Steve speak with a doctor at the local health clinic about his problem without his mother's approval? Can Steve receive a prescription from the doctor to treat his addiction without parental notification?

13 HIPAA: How Does it Impact Child Abuse Cases? Health Insurance Portability and Accountability Act of 1996 (HIPAA) –Intended to protect confidentiality of patient records Sets a national standard for security and privacy of patient health data or “protected health information” (PHI) Applies to “covered entities”: –includes virtually all health care organizations and providers Preempts most state laws that are less strict

14 What isn’t PHI? PHI is “any information, whether oral or recorded in any form or medium" that –"[i]s created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse"; and –"[r]elates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual."

15 HIPAA Exceptions In most cases, HIPAA requires authorization prior to sharing PHI –Signed authorization / Release of Information Form –Court Order signed by a judge –Subpoena along with supporting documentation HIPAA regulations set forth a list of exceptions that apply to child abuse and neglect cases: –Permitted disclosures without authorization or consent under certain circumstances –Makes clear that health care providers suspecting abuse must still report, even if PHI is disclosed

16 HIPAA Exceptions Cont. HIPAA regulations allow for disclosure of PHI where state law provides for the reporting of child abuse and to an appropriate government authority authorized to receive reports of child abuse or neglect –Georgia law mandates reporting of child abuse to DFCS, or, if unavailable, police or DA –Report should include names, addresses, age, nature and extent of injuries, evidence of previous injuries, and any other information that might be helpful in establishing cause of injury and ID of perpetrator –Disclosure to MDTs, CACs and CFR groups could also fall under this exception HIPAA permits sharing of PHI for mandated reporting purposes without parental authorization

17 HIPAA Exceptions cont. Permits disclosure (beyond mere reporting) of PHI about victims of child maltreatment to appropriate authorities if disclosure is authorized by law, and: »(1) necessary to prevent harm to victim or others, or (2) the victim consents »Obligation to notify that report was made unless: Notice would place child at risk of serious harm, or Notice would be given to person responsible for abuse and thus not in best interest of child victim

18 HIPAA Exceptions cont. Permits disclosure to medical examiners and coroners Permits disclosure pursuant to Court Order, subpoena, or other legal process –May requires notice to the patient/parent –Provides for process to obtain qualified protective order to restrict use of PHI disclosed Permits disclosure to Law Enforcement agencies upon inquiry: »Limitations on disclosures – must be authorized by law and necessary to prevent harm

19 HIPAA and Child Protection HIPAA regulation protects victims of child abuse cases by keeping information out of the hands of an abusive parent HIPAA provides that a “personal representative” of patient otherwise entitled to HIPAA protections (i.e. parent, guardian) may not be allowed access to a minor’s records if there is: –Reasonable belief that that patient was subject to abuse or neglect by such personal representative or that the personal representative could endanger the patient, and –Determination that it is not in best interest of patient to treat person as patients’ personal representative

20 What this means... Most importantly, HIPAA does not inhibit reporting of child abuse –HIPAA supports disclosure of PHI to investigate and preventing child abuse and neglect –HIPAA protects information from disclosure that would be contrary to child’s best interests –Gives courts and law enforcement agencies ability to access relevant health information Unclear whether HIPAA allows for reporting of information related to parents, siblings, etc.

Questions?