Confidential Communication: Addressing Challenges of Open Electronic Health Records for Youths and Families

Patient engagement is essential in medical practice for accurate diagnosis, successful treatment, and enhanced patient satisfaction (1). In the pediatric setting, the task of communicating effectively—building a rapport; listening empathically; and providing clear, culturally sensitive, and developmentally appropriate observations, explanations, and recommendations—includes both the guardians and their child (2). Successful communication between physician, parent, and adolescent child requires partnership building, interpersonal sensitivity, and informativeness (3). The first task, partnership building, involves forming a therapeutic rapport—providing a safe environment that enhances the comfort of the adolescent patient and their caregivers in voicing concerns, perspectives, and expectations for the consultation. A physician who is attentive, curious, and elicits information about unique strengths and resilience factors, as well as areas of pathology, is demonstrating interpersonal sensitivity. Finally, informativeness includes the quality and quantity of the health information provided by the physician. This information has historically been conveyed verbally. With the widespread adoption of electronic health records (EHRs), information may also be accessed by the patient and/or caregiver through the patient portal of the medical record (4).

Benefits and Potential Drawbacks of Open Health Records

The EHR provides many benefits for safe patient-centered care. The documentation of a physician’s work serves as an internal record to optimize the continuity of patient care. Coordination of care among providers is more efficient when a uniform EHR is utilized, allowing for more informed and effective medical decision making, especially for patients with more complex or multisystem health concerns. This transparency of health information may facilitate trust and more active engagement in health care decisions (5).

The 21st Century Cures Act (Cures Act) is legislation that was designed to advance the U.S. Department of Health and Human Services’s goal of implementing a value-based health system. One of its key aims is to ensure that the health care industry adopts standardized policies and technology that give patients and their families access to their medical information electronically. The Cures Act increases access to, use of, and exchange of electronic health information (EHI). Providers and health care systems must make available to patients: consultation notes; discharge summaries; history and physicals; imaging, laboratory, and pathology report narratives; procedure notes; and progress notes. Although psychotherapy notes that are separated from the rest of the patient’s medical record and documented by a mental health professional may be “blocked” from general access in the EHR, clinicians and organizations are required to share medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment provided, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date (6).

The easy entrance to Internet portals to access health records presents opportunities for patient and family engagement and risks to confidential patient care (7). States vary in their laws about the types of information protected within behavioral health records and the extent of adolescent patient health confidentiality. In most medical settings, parents have direct access to their children’s medical records until they turn 18 years of age or are legally emancipated. For behavioral health, sexual health, and other sensitive treatment records, most states ensure confidentiality in the treatment of a teen, and parental access is blocked. Teens may not realize that affording proxy access to their parents in some situations (e.g., for telehealth visits, in which a secure video platform is provided through the electronic health system) allows the parent to see many of their confidential records (8).

Another rarely considered potential breach of confidentiality involves sensitive information about parents in the adolescent’s medical record. Various clinicians may have populated the record with information about parental behaviors and family history that parents may not have disclosed to their child and that they have chosen not to disclose. The issues of parent privacy and the adolescent’s access to health information that parents want to withhold, are an ongoing ethical dilemma that an astute clinician may identify as a goal of family treatment (7).

There are data that adolescents may forego mental health care despite self-perceived need for mental health services. One potential barrier that may dissuade youths from seeking care is a concern about confidentiality, lack of parental consent, and stigma. Some youths described the attitude of their families and themselves that the problem would “go away.” Others felt that their parents would not approve and did not want them to know. Concerns about privacy were common (9).

The Society for Adolescent Health and Medicine strongly supports confidential care for minor adolescents (10). “Confidentiality protection is an essential component of health care for adolescents because it is consistent with the development of maturity and autonomy and without it, adolescents will forego care,” (11) especially for sensitive health issues such as sexually transmitted infections, contraceptive services, and mental health care (12). Because the EHR aggregates information about all health care provided within an integrated health system, it may be difficult to ensure that electronic access to confidential information is properly secured. Even if mental health notes are not openly accessible to parents, adolescents who access care are likely to have confidentiality breached when their parents receive an explanation of benefits from their insurance carrier specifying the services received by the youth and covered by the policy. For example, testing for pregnancy or sexually transmitted diseases may compromise adolescent privacy. Some clinicians may limit their testing or prescriptions, or provide nonspecific diagnoses, to preserve patient privacy—all of which may have negative effects on coordinated care (4).

Another common breach of confidential care for minor adolescents was revealed by Xie and colleagues (13), who reported that in one large institution, 2,307 of the 3,701 adolescent portal accounts (62%) were used or accessed by guardians because the guardian’s e-mail was the one registered on the account. The breaches of adolescent confidentiality associated with the erroneous e-mails may damage the adolescent’s trust in medical and mental health providers.

Confidential information in the EHR may be “blocked” from access by patients and other providers under eight “exceptions to the blocking rule” (Cures Act). The two exceptions that are most relevant to psychiatrists for “blocking” open access to EHI are the preventing harm exception and the privacy exception. According to the preventing harm exception, if a clinician has a reasonable belief that sharing information will cause harm to the patient, the information may be blocked from access; and according to the privacy exception, if a clinician is prohibited from sharing EHI under state or federal privacy laws, or if the patient specifically requests that the information not be shared, the clinician should block access (6).

Clinical Vignette

Amalia is a 16-year-old adolescent who was referred by her mother and school social worker for a psychiatric evaluation because of concerns about her increasing oppositionality and falling grades. When her school closed because of the COVID-19 pandemic, Amalia had refused to turn on her camera for the virtual school sessions. Since then, she has become “sassier” toward her mother and has started lying about having completed her homework. Ms. Flores, Amalia’s single mother, worried that Amalia may be tempted to experiment with illicit drugs. Amalia had seen a therapist about 1 year ago when her grades were falling, but she did not take well to the virtual platform for her psychotherapy visits, and the therapy was stopped.

Amalia and her mother stepped into Dr. Carver’s waiting area. Amalia surveyed the room closely for signs revealing the types of patients that came to this office. Amalia’s mother sat mostly stone-faced, in anticipation of potentially being “blamed” for Amalia’s difficulties. It was never directly voiced to her, but she had learned to read the nonverbal signs from teachers, counselors, school administrators, and even some health professionals.

Dr. Carver gave Amalia and her mother a warm smile at their first meeting. As was her usual practice, Dr. Carver met with the adolescent and mother together to review what each was hoping to gain from the consultation. Then, she met with Amalia and her mother individually for further history and diagnostics. Amalia was initially reticent, but then she warmed up and described her symptoms of depression, anxiety, and isolation; she revealed that she found comfort in the relationship with her new boyfriend and that they “smoked weed” together on the weekends. She was apprehensive that her mother would find out this information, including the fact that she had sex with her boyfriend. She assured Dr. Carver that they used a condom. Her depressive disorder affected her sleep, enjoyment of activities, and motivation. She said that she had not self-harmed and did not have suicidal thoughts or impulses. School had always been difficult for her because of distractibility and poor focus.

Amalia’s mother, Ms. Flores, described Amalia as being born at 30 weeks of gestation weighing three pounds. She needed to remain in the neonatal intensive care unit for a month because of immature lungs. She had generally done well after that, meeting developmental milestones (when prematurity was accounted for). She was an impulsive and somewhat fussy baby. Amalia and her mother lived with maternal grandparents to help care for her and provide financial support. Amalia reportedly has never met her father. Amalia’s mother hoped for treatment that would help Amalia “stay out of trouble.” She was particularly concerned that Amalia might be using illicit substances. Ms. Flores said that she kept “a good eye on” Amalia and did not think she had romantic interests or had used illicit substances “yet.” She worked long hours at times, but Amalia’s grandparents were attentive.

After the assessment, Dr. Carver completed the psychiatric evaluation report in the EHR. She wanted to share the report and recommendations to engage Amalia and her mother in collaborative decision making about recommended treatment. Dr. Carver diagnosed an unspecified depressive disorder and suggested further assessment for attention-deficit hyperactivity disorder and learning differences. Dr. Carver was in a quandary about whether to include information about substance use and sexual activity in the report. It was important to Amalia’s treatment but had been shared confidentially. In the end, she did not document that information in the report. Amalia and her mother made an appointment for the next week to discuss the findings and recommendations.

Dr. Carver met Amalia and her mother in the waiting room. This time, both sat pouting across the room from each other. Dr. Carver again smiled, this time more tentatively. Both Amalia and her mother sulked as they entered the psychiatrist’s office.

“Mom, why didn’t you tell me that you used cocaine when you were pregnant with me and that Dad went to jail?” Amalia barked at her mother.

“And why didn’t you tell me that you are sleeping around and using drugs?” Ms. Flores countered.

“Wait, slow down a minute. What happened between last week and now?” Dr. Carver queried.

“It’s the medical record,” Ms. Flores blurted. “When I looked through it, I saw that her pediatric visit included a pregnancy test and test for sexually transmitted diseases. They also checked off drug use of marijuana and vaping. And who knows what else? Does she want to end up like I was—using drugs, pregnant, and with a boyfriend in jail? I didn’t want her to know I had used drugs, because she might try to justify using drugs herself and put it back on me. I cleaned up my act and don’t want her learn the hard way like I did.”

“So, I guess all of the promises about privacy were con jobs!” Alicia snapped.

Dr. Carver took a deep breath and considered the situation.

“I am so sorry this happened! I guess the privacy settings weren’t used. I wanted to share my report with you both. I was going to let Amalia read it first, and then we would discuss it together. This confidential information wasn’t in my report—how did you find it?”

“Oh, it’s there if you go back and look through everything—from her birth records on,” Ms. Flores replied bitterly.

“Or if you’re a snoop!” Amalia countered.

“Here’s my suggestion,” Dr. Carver began tentatively. “We call the medical records department and discuss appropriate privacy settings and how to make them clear for all providers. In the meantime, there is a lot of processing to do about the information that was erroneously disclosed. We can’t take that back.”

“No, thanks. I don’t need any more lectures,” Amalia declared.

“Well, I don’t want you to blame everything on me,” Ms. Flores countered. “I feel guilty enough already.”

Dr. Carver let the last sentence sit in the air for a while. Both Amalia and her mother had tears in their eyes.

“Okay, Amalia,” Ms. Flores gently whispered. “We have each other. Always have and always will. Let’s get things out in the open and deal with them,”.

“I am very sorry this happened,” said Dr. Carver. “I feel responsible for not checking the privacy settings for other information in the chart. With that said, I think some sessions with a family therapist may be very helpful. I know one who, I think, will be a great fit. Let’s make another appointment next week to discuss my assessment and jointly make a treatment plan.”

Both Amalia and her mother nodded. Ms. Flores wiped her eyes with a tissue. Amalia opened the door for her mother as they departed.

Approach to Information Release

Physicians who treat adolescents should jointly determine what information will be shared and with whom it will be shared. Understanding state laws and institutional policy will be important for developing this process. The Cures Act Final Rule focuses on information blocking, but it also provides the opportunity to maximize information sharing for both adolescent patients and their proxies (typically, parents or guardians). For example, proxy access to nonprotected medical information is crucial for optimizing the management of adolescents with complex health issues. The discussion about what information from mental health treatment will be shared is an ongoing collaborative consideration in treatment (14).

Requirements for Implementation

For the appropriate release of information to adolescents or their proxies (or both), two key elements of the EHR are essential to have in place. First, both the adolescent minor and their proxy (if they approve) require access to the medical record, even if it is in a segmented way. As different types of information are released to adolescents and their proxies, it is critical to ensure that the account is accurately linked to the correct user. Although it can be challenging to develop and maintain the two different levels of access, it is key for enabling differential information release. Second, having a way to parse out protected information reliably from general clinical information is critical. Many EHRs have a confidential note type for this purpose (10).

Open access to medical records may improve health care and enhance transparency. It remains a challenge for clinicians to protect the sensitive health care information of their patients. Most institutions do not adequately address process design issues related to the EHR for adolescent patients. Billing and support personnel require training regarding state privacy policies regarding adolescent patients. Built-in privacy-related decision-support tools within the EHR will help teens negotiate their records productively and educate them about privacy settings. Anoshiravani and colleagues (14) suggested that, until an EHR has robust privacy functionality, limited patient portal access may be required.

Recommendations to Enhance Transparency and Ensure Confidentiality with Adolescent Minors and Their Caregivers

1. Set the stage: Provide information at the outset to the caregivers and adolescent patient about plans for evaluation and treatment.

   1. Emphasize the essential role of the adolescent patient in providing input about symptoms, relaying their strengths and interests (resilience factors), and participating in treatment decisions consistent with age and developmental capacities.

   2. Review communication methods. Some practitioners prefer communication through the EHR. Review the “patient portal” and how to send messages. If communication is offered through other methods (e.g., answering service, telephone, or other), make clear what information should be shared in which venue. The contact method for emergencies should be clearly spelled out.

   3. Review with the adolescent patient the functionality of the EHR. Explain “proxy” settings in the EHR regarding what will be shared and what will be blocked. Determine with the youth what they wish to share with their guardians (or proxy) and what they choose to keep private.

   4. Meet with the youth and guardians to review the importance of adolescent confidentiality in mental health care. This also provides an opportunity to specify what information will be accessible in the EHR to the proxy.

   5. Review that safety is of primary importance and that confidentiality cannot be ensured if there are legitimate safety concerns (to self or others).

2. Listen carefully and acknowledge the child’s or adolescent’s aspirations and values, as well as those of the parents or caregivers, and document accordingly.

3. Work with your institution to understand and implement appropriate confidentiality settings on patient records.

   1. Check to ensure that the appropriate e-mail is connected to the patient record, as e-mail is often the method of conveying EHR information.

   2. Review the EHR mechanism to tag notes as confidential.

4. Complete medical documentation with the assumption that the patient will have access.

   1. Identify strengths and progress to highlight positive regard for the adolescent patient.

   2. Use clear and teen-friendly language about the disorder and treatment plan.

   3. Check in regularly about any questions about the treatment plan. Review proxy settings and whether any changes are desired.

   4. Clarify which information shared by the adolescent patient or their guardians should be kept confidential. Ensure that confidentiality settings are in place to limit adolescent access to confidential parental information, as well as to limit parental access to confidential adolescent patient information.

   5. Document important information, but use discretion, in the event that the proxy may inadvertently access the information.

   6. If the EHR privacy settings are not configured for an adolescent patient, consider limiting access to notes, using the confidentiality settings, for information that is particularly sensitive and does not need to be shared with other providers.