The American Academy of Pediatrics has shared an article entitled Implications of the 21st Century Cures Act in Pediatrics that is a very good overview of considerations for health care providers and other actors serving pediatric patients. 

Each state has rules or regulations as to which health decisions the minor can make on their own. Generally, if the minor is legally empowered to make their own decision for treatment, then they have the right to keep it private from their parents/caregivers. For example, this is a list of reproductive health services that adolescents can consent to and therefore can presumably request not to share the information (though check with your legal team!).

Question from Jan. 2021:  Where the patient is a minor and to avoid breaching the patient’s confidentiality and trust with the provider, will the Preventing Harm Exception cover an actor’s practices that interfere with a parent or legal representative’s access, exchange, or use of the minor’s EHI? 

ONC Answer: No. Unless an actor reasonably believes a practice that interferes with a parent or other legal representative’s requested access, exchange, or use of the minor’s EHI will substantially reduce a risk of at least substantial harm to the patient or another person, the Preventing Harm Exception is not designed to cover that practice.

The Privacy Exception contains a sub-exception (45 CFR 171.202(e)) that covers practices respecting an individual’s request not to share information, subject to certain conditions. 

Question from Jan 2021: Where the patient is a minor and to reduce a risk of harm other than physical abuse, will the Preventing Harm Exception cover an actor’s practices that interfere with a parent or legal guardian’s access, exchange, or use of the minor’s EHI? 

ONC Answer: Yes, where the risk of harm has been determined on an individualized basis and all other conditions of the Preventing Harm Exception are met. For example, the practice must be no broader than necessary and the actor must reasonably believe the practice will substantially reduce the risk of harm. (For all the conditions of the Preventing Harm Exception, please see 45 CFR 171.201.)

For purposes of the Preventing Harm Exception, a parent or legal guardian would be considered a patient’s legal representative. The Preventing Harm Exception’s type of harm condition applies a “substantial harm” standard for practices interfering with a patient’s representative’s requested access, exchange, or use of the patient’s EHI. (See 45 CFR 171.201(d)(1)).

The type of harm conditions for Preventing Harm Exception coverage of practices interfering with patients’ and their representatives’ access to EHI on the basis of an individualized determination of risk are specifically aligned with the HIPAA Privacy Rule’s grounds for reviewable denial of an individual’s right of access under the Privacy Rule. (See also ONC Cures Act Final Rule preamble discussion and Table 3—Mapping of Circumstances Under § 171.201(d) to Applicable Harm Standards).

Experts agree that there is a fine line to walk in facilitating access to minors' records while also protecting their privacy. This legal blog post discusses several considerations:

During the ages in which minors can consent to certain healthcare services (such as reproductive health services), parents have a right to access some of a child's medical information but generally not that for which the child consents on his or her own. Providing just the right amount of access—no more and no less—has long proven difficult, and is now all the more imperative.

Providers have historically often addressed this by entirely excluding medical records of such minors from patient portals. However, to knowingly interfere with a parent's access to EHI of a minor (other than the few services to which the minor may consent) may constitute information blocking under the final rule.

Overly broad policies blocking access likely will not comply with Information Blocking Final Rule. If a health center provider cannot segment out the confidential information, then the provider may need to rely on the infeasibility exception—which requires a response within 10 days explaining why it is infeasible to segment out the data. If explaining the basis of infeasibility would expose that the minor sought confidential services, then an individualized determination to withhold information to prevent harm to the minor may be an alternative. It’s important to understand that this exception must be individually applied, and thus cannot be applied broadly to all minors. As such, as ONC mentions in their response to frequently asked questions, the privacy exception, which contains a sub-exception that covers practices respecting an individual’s request not to share information, subject to certain conditions, is likely the best path forward. This requires that minors request that their information not be shared and document that request with the clinic.