Scenario:
We have a 16-year-old minor whose guardian is the State of Oregon who would like to establish care with our office while in Foster Care. The patient’s Resource Parent may prefer that she not establish care with our office.
Can you advise us on the HIPAA regulations for this scenario?
Answer:
Please note that for purposes of this Q&A, we focused on Oregon’s minor consent laws for reproductive health care and general medical treatment.
What are the practice’s HIPAA obligations if they accept the 16-year-old minor as a patient?
The HIPAA privacy rule defers to state law to determine the rights of minors to consent and their resulting HIPAA privacy rights (addressed in more detail below). Where a minor meets the age requirements to consent to care, the minor is treated the same as an individual under HIPAA, including having the same HIPAA privacy rights. Here, the 16-year-old minor meets the minimum ages required to consent to several types of care set forth in ORS 109.640, titled “Right to reproductive health care, medical treatment or dental treatment without parental consent” (addressed in more detail further below). This means the minor has the same HIPAA privacy rights as an individual. Accordingly, the practice’s HIPAA privacy obligations to the 16-year-old minor are the same as those for an individual when it involves such types of care.
HIPAA on Rights of Unemancipated Minors and Personal Representatives
Under HIPAA, an unemancipated minor’s privacy rights are determined by the minor’s rights to consent to medical care under state law. Specifically, the HIPAA privacy rule expressly defers to state law to determine the rights of minors to consent to care and their resulting privacy rights. In this respect, where a state law does not require the consent of a parent, legal guardian, or other person acting in loco parentis who has authority to act on behalf of the minor in making healthcare-related decisions (which may include a resource parent) before a minor can obtain a particular health service, and the minor has not requested that such person be treated as the minor’s personal representative, then such person is not recognized as a HIPAA personal representative of the minor and has no control over the minor’s health care decisions or the PHI related to such care.
- 45 CFR § 164.502(g)(3)(i)(A) (stating that a minor recognized as an individual under HIPAA has authority over the minor’s PHI related to health care services if the minor consents to the health care services and no other consent is required by applicable law, and the minor has not requested that any person be treated as the minor’s personal representative);
- 45 CFR § 164.502(g)(3)(i)(B) (stating a legal guardian or other person acting in loco parentis is not a HIPAA personal representative with respect to the minor’s PHI-related to care if the minor can lawfully obtain health care services without the consent of a parent, legal guardian or other person acting in loco parentis, and the minor consents to such health care services).
Oregon’s Minor Consent Law: ORS 109.640
ORS 109.640, “Right to reproductive health care, medical treatment or dental treatment without parental consent,” sets forth the different age requirements a minor must satisfy to be able to consent for the delineated types of care provided therein to receive from a health care provider without the consent of a parent or legal guardian, including from a nurse practitioner licensed under ORS 678.375 to 678.390 who is acting within the scope of practice for a nurse practitioner (“Licensed Nurse”), such as:
- Abortions: a minor under 15 years old may give consent to an abortion only if the abortion is provided by a health care provider who is acting within the provider’s scope of practice, which includes a Licensed Nurse, and who reasonably believes in the provider’s professional judgment, that (a) involving the legal guardian may result in the physical or emotional abuse of the minor or the neglect of the minor; or (b) requiring the consent of the legal guardian would not be in the best interest of the minor, for the reasons documented by the provider after obtaining the concurrence of another health care provider who is associated with a separate medical practice or facility. ORS 109.640(2).
- Reproductive Health Care: a minor of any age may give consent to receive such services from certain health care providers, including from a Licensed Nurse unless it involves an abortion, in which case the requirements stated above must be met. ORS 109.640(3). If the reproductive health care involves elective sterilization, the minor must be 15 years or older. ORS 109.640(1).
- Medical Diagnosis or Treatment: a minor 15 years or older may give consent to medical diagnosis or treatment by a Licensed Nurse, a physician licensed by the Oregon Medical Board, a naturopathic physician licensed under ORS chapter 685, and by a physician assistant who is licensed under ORS 677.505 to 677.525 and who is acting pursuant to a collaboration agreement as defined in ORS 677.495.
Conclusion
As first stated above, as the HIPAA Privacy Rule defers to Oregon law to determine the rights of minors, and the minor here meets the ages required for consent to the types of care covered by ORS 190.640 (certain reproductive healthcare), the minor here has the same HIPAA privacy rights of an individual with respect to such types of care. Accordingly, the practice’s HIPAA obligations to the minor are the same as that of an individual, including the obligation to abide by the minor’s privacy preferences communicated to the practice.
Please note that if the type of care at issue is different than those covered in ORS 109.640, the age required for consent may be different, which may change the minor’s rights and the practice’s HIPAA obligations.
If the resource parent asks, is the practice required to disclose the minor’s health information even though the minor is requesting that the practice not do so?
No, because the minor is of legal age to consent to the types of care provided in ORS 109.640 and has privacy rights as an individual under the HIPAA privacy rule, including the right to restrict the disclosure of the minor’s PHI related to such types of care to the resource parent.
Thus, if the minor does not name the resource parent as the minor’s HIPAA personal representative, the resource parent has no legal right under HIPAA to receive the minor’s PHI from the practice and, in such case, the HIPAA privacy rule prohibits the practice from making such disclosure.
Please note that if the type of care at issue is different than those covered in ORS 109.640, the age required for consent may be different, which may change the minor’s rights and the practice’s HIPAA obligations.
Does the type of care matter, e.g., reproductive health care?
If the type of care is outside the types of care described in ORS 109.640, probably not given the minor’s age. However, a review of the applicable state law governing the subject type of care would be required to make this determination.
If the type of care at issue is covered by ORS 109.640, no, it would not for two reasons.
- First, because the minor is over the legal age set forth in ORS 109.640, the minor has the right to consent to any of the types of care covered by ORS 109.640 and has HIPAA privacy rights related to such types of care, including the right to restrict disclosure of the minor’s PHI related to such types of care to the resource parent.
- Second, only an authorized HIPAA personal representative of a minor who is of legal age to consent has a right to receive the minor’s health information. 45 CFR § 164.502(g)(3)(i). Here, if the 16-year-old minor doesn’t identify the resource parent as the minor’s HIPAA personal representative to the practice, the resource parent has no control over the minor’s health care decisions or any rights with respect to the minor’s PHI related to such types of care.
Since the resource parent doesn’t appear to be the legal guardian, do they have standing to expect the minor patient’s information?
Assuming the type of care at issue is covered by ORS 109.640, no, for two reasons.
- First, the minor is over the legal age required by ORS 109.640 to consent to the types of care provided in said statute and has the same HIPAA privacy rights as that of an individual, including the right to restrict disclosure of the minor’s health information to the resource parent.
- Second, only an authorized HIPAA personal representative of a minor who is of legal age to consent has a right to receive the minor’s health information. 45 CFR § 164.502(g)(3)(i). Here, if the 16-year-old minor doesn’t identify the resource parent as the minor’s HIPAA personal representative, the resource parent has no legal right to receive the minor’s PHI related to such types of care.
Recommended Actions for the Practice
- Document verification of the minor’s legal age.
- Maintain a record of the minor’s legal guardian’s identity.
- Document the minor’s privacy preferences, including the minor’s instructions not to release health information to the resource parent.
- Ensure the minor does not name the resource parent as the minor’s personal representative on any of the practice intake forms or otherwise (e.g., verbally to any practice staff member who might then enter that name in the patient’s file/electronic record).
- Flag the minor’s patient file regarding the minor’s privacy restrictions as to the resource parent to mitigate a potential risk of a practice staff member impermissibly disclosing the minor’s health information to the resource parent.
For the purposes of researching this situation, the team focused on reproductive healthcare, but we anticipate the answers will be the same regardless of the type of care given the minor's age.
____
The Real Talk article series includes real customer questions and our answers. Since these are questions directly from actual clinics, practices, hospitals, and businesses, we thought you might have these questions too. We hope that you find this format helpful. Stay tuned for more Real Talk - your question might even be featured!