Boston Childrens Hospital Tackles Teen Records Privacy

Boston Childrens Hospitals pioneering approach would bar parents from seeing sensitive portions of their childrens personal health records.

10 Mobile Health Apps From Uncle Sam (click image for larger view and for slideshow)
The increase in the use of personal health records
raises important questions about adolescents access to their own PHRs
and who can view their sensitive personal health information, noted Fabienne Bourgeois, a pediatric hospitalist at Boston Childrens Hospital (BCH), in a recent blog post.
Writing on the blog of John Halamka, CIO of Beth Israel Deaconess Medical Center, Bourgeois pointed out that childrens and adolescents PHRs are generally controlled by their parents. However,
teenagers have a right to privacy when they share confidential information with their physicians
, she noted. Often, this includes data about reproductive health, sexually transmitted diseases, substance abuse and mental health that adolescents might not want to share with their parents.
As it turns out, this type of confidential information is pervasive throughout most EHRs, noted Bourgeois, who is also the clinical lead on applications at BCH. And it is EHRs that are the main source for the PHRs that reside on patient portals.
[ Bill Clinton spoke out against kids obesity at recent health conference. Read
Bill Clinton Stumps For Health IT At HIMSS
. ]
To address these issues, BCH has developed a custom-built PHR with separate accounts for patients and parents. Bourgeois wrote, The parent has sole access to the patients portal until the patient turns 13, at which point both the parent and the patient can have access. … At 18 years, the patient becomes the sole owner of the portal account, and we deactivate the parents link (unless we receive court documents stating that the parent remains the medical guardian).
The federal HIPAA law dictates that the patient have sole control over his or her PHR at age 18, because an 18-year-old is defined as an adult with full privacy rights under HIPAA, Bourgeois told
InformationWeek Healthcare
. But soon, BCH will give adolescents over 18 the ability to share their information with select individuals, including parents. They also will be able to choose which categories of information they want to share.
BCH has identified and tagged sensitive information from the EHR, including labs related to pregnancy, sexually transmitted illnesses (STIs), genetic results, select confidential appointments, and potentially sensitive problems and medications.
This information is currently filtered from both parent and adolescent accounts, but in the near future the sensitive information will flow to the adolescent account, but not to the parent account, Bourgois said in the article. So, even if a patient is less than 13 years, the parent would not have access to this information.
Asked why BCH would prevent parents from obtaining such information for children under 13 years old, she said every family is different and has a different relationship with its physician. In one family, well disclose information around STIs in a 10-year-old, if we feel that the patient is at risk and its appropriate to give that information to the family, she said.
However, she added, sending that information to a patient portal that includes a PHR might not be the best way to communicate it. Some of this information is best handled in a person-to-person conversation with a provider, she said.
In her post, Bourgeois offered a couple of alternative ways to handle adolescent PHRs. One method would be to provide shared access for patient and parent, but filter out all sensitive information. Another approach would be to provide access only to the adolescent and include sensitive data.
Why would a healthcare organization want to cut off parents access to their childrens health records before they turned 18? Some practices have found that hiding sensitive information is something thats more complicated than they can manage, Bourgeois replied in the interview. They dont have the ability to tag information and filter the sensitive information, which is just littered throughout the EHR. Therefore, they allow access to the adolescent only.
BCH is also trying to deal with the problem of sensitive data hidden in unstructured parts of the EHR, such as clinical notes. The approach were taking with clinical notes is that were going to create a particular type of note called confidential notes, Bourgeois said. In addition, were allowing providers to decide whom the note can go to. If theyre going to push the note to the portal, they can choose whether it should go to the parent, the adolescent patient, or both.
This is not an ideal solution, because it puts the onus for protecting the privacy of this information on the physician, she acknowledged. But its the best mechanism her institution could come up with for now, she said.

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Boston Childrens Hospital Tackles Teen Records Privacy