Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

5/16/2013
05:24 PM
50%
50%

Boston Children's Hospital Tackles Teen Records Privacy

Boston Children's Hospital's pioneering approach would bar parents from seeing sensitive portions of their children's personal health records.

10 Mobile Health Apps From Uncle Sam
10 Mobile Health Apps From Uncle Sam
(click image for larger view and for slideshow)
The increase in the use of personal health records raises important questions about adolescents' access to their own PHRs and who can view their sensitive personal health information, noted Fabienne Bourgeois, a pediatric hospitalist at Boston Children's Hospital (BCH), in a recent blog post.

Writing on the blog of John Halamka, CIO of Beth Israel Deaconess Medical Center, Bourgeois pointed out that children's and adolescents' PHRs are generally controlled by their parents. However, teenagers have a right to privacy when they share confidential information with their physicians, she noted. Often, this includes data about reproductive health, sexually transmitted diseases, substance abuse and mental health that adolescents might not want to share with their parents.

"As it turns out, this type of confidential information is pervasive throughout most EHRs," noted Bourgeois, who is also the clinical lead on applications at BCH. And it is EHRs that are the main source for the PHRs that reside on patient portals.

[ Bill Clinton spoke out against kids' obesity at recent health conference. Read Bill Clinton Stumps For Health IT At HIMSS. ]

To address these issues, BCH has developed a custom-built PHR with separate accounts for patients and parents. Bourgeois wrote, "The parent has sole access to the patient's portal until the patient turns 13, at which point both the parent and the patient can have access. … At 18 years, the patient becomes the sole owner of the portal account, and we deactivate the parent's link (unless we receive court documents stating that the parent remains the medical guardian)."

The federal HIPAA law dictates that the patient have sole control over his or her PHR at age 18, because an 18-year-old is defined as an adult with full privacy rights under HIPAA, Bourgeois told InformationWeek Healthcare. But soon, BCH will give adolescents over 18 the ability to share their information with "select individuals," including parents. They also will be able to choose which categories of information they want to share.

BCH has identified and tagged sensitive information from the EHR, including labs related to pregnancy, sexually transmitted illnesses (STIs), genetic results, select confidential appointments, and potentially sensitive problems and medications.

"This information is currently filtered from both parent and adolescent accounts, but in the near future the sensitive information will flow to the adolescent account, but not to the parent account," Bourgois said in the article. "So, even if a patient is less than 13 years, the parent would not have access to this information."

Asked why BCH would prevent parents from obtaining such information for children under 13 years old, she said every family is different and has a different relationship with its physician. "In one family, we'll disclose information around STIs in a 10-year-old, if we feel that the patient is at risk and it's appropriate to give that information to the family," she said.

However, she added, sending that information to a patient portal that includes a PHR might not be the best way to communicate it. "Some of this information is best handled in a person-to-person conversation with a provider," she said.

In her post, Bourgeois offered a couple of alternative ways to handle adolescent PHRs. One method would be to provide shared access for patient and parent, but filter out all sensitive information. Another approach would be to provide access only to the adolescent and include sensitive data.

Why would a healthcare organization want to cut off parents' access to their children's health records before they turned 18? "Some practices have found that hiding sensitive information is something that's more complicated than they can manage," Bourgeois replied in the interview. "They don't have the ability to tag information and filter the sensitive information, which is just littered throughout the EHR. Therefore, they allow access to the adolescent only."

BCH is also trying to deal with the problem of sensitive data hidden in unstructured parts of the EHR, such as clinical notes. "The approach we're taking with clinical notes is that we're going to create a particular type of note called confidential notes," Bourgeois said. "In addition, we're allowing providers to decide whom the note can go to. If they're going to push the note to the portal, they can choose whether it should go to the parent, the adolescent patient, or both."

This is not an ideal solution, because it puts the onus for protecting the privacy of this information on the physician, she acknowledged. But it's the best mechanism her institution could come up with for now, she said.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
6/17/2013 | 1:07:57 AM
re: Boston Children's Hospital Tackles Teen Records Privacy
This is one of the most
ridiculous things that I ever read. How can they deny the parent the knowledge
of a mental health issue in their 13 year old? The HIPAA Laws were put in place
to protect adults privacy, their children should fall under their guardians on
this, not completely separate. A person is not considered an adult until 18 for
a reason, one of those is they are not capable of making appreciate health
decisions regarding their personal health,

Paul Sprague

InformationWeek Contributor
jaysimmons
50%
50%
jaysimmons,
User Rank: Apprentice
5/30/2013 | 2:24:05 AM
re: Boston Children's Hospital Tackles Teen Records Privacy
This article raises a very valid point when it comes to doctor-patient confidentiality in the case where the patient isnGt over 18 years of age. Man adolescents may be afraid to see a physician for fear of their parents finding out that what they have been doing and may be putting their health at risk. I like the idea of having a patient portal for the patient and one for the guardian where they can filter the type of information available to each user. I do believe though that the physician should have enough good sense that they could filter out this information manually until a better mechanism has been developed for their EHRs.

Jay Simmons
Information Week Contributor
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Malware Attacks Declined But Became More Evasive in Q2
Jai Vijayan, Contributing Writer,  9/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12505
PUBLISHED: 2020-09-30
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852 version FW07 and prior versions. WAGO 750-880/xxx-xxx version FW07 and prior versions. WAGO 750-881 ve...
CVE-2020-12506
PUBLISHED: 2020-09-30
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362 version FW03 and prior versions. WAGO 750-363 version ...
CVE-2020-4629
PUBLISHED: 2020-09-30
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.
CVE-2019-17098
PUBLISHED: 2020-09-30
Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior version...
CVE-2020-15731
PUBLISHED: 2020-09-30
An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448.