Knowledge Library

While the news is full of high-profile HIPAA breach cases and assessments of multi-million-dollar fines, smaller practices are not immune. They often succumb to the same types of error and bad judgment that affect larger providers. Fortunately, by following a few sensible guidelines, even smaller practices can safeguard themselves against the improper disclosure of protected health information (PHI) that leads to a HIPAA breach.

The Risk Management department at NORCAL often gets calls describing treatment scenarios involving adolescents that do not neatly fit into one of the sensitive treatment categories. These situations often require the clinician to weigh the adolescent’s need for autonomy against the parents’ need to nurture, guide, and protect their child. When the line between what can and cannot be shared with a parent appears legally ambiguous, a physician’s discretion is often the best solution. Consider the following two cases.

Practices must be able to protect the confidentiality of adolescent patients’ sensitive condition treatment information in patient portals. Consider the following case.

Many states allow third parties (e.g., relatives and nannies) to consent for a minor’s medical treatment so long as the parent’s/guardian’s authorization is already in place. Clinicians are sometimes tempted to bend the minor consent rules when the adolescent is older or when the patient comes in with a relative who appears to be a caretaker, even though that caretaker does not have legal standing to consent for the adolescent’s medical treatment. Consider the conflicting interests of the parties in the following case.

Not all adolescent consent issues involve sensitive treatment scenarios. As adolescent patients become drivers, they are more likely to present for treatment without a parent. Although a patient may seem mature enough to consent for general treatment, a parent’s consent is still required. Consider the following case.