National Center for Youth Law


Print This Post

The Affordable Care Act and Adolescent Health

Closing confidentiality loopholes so that adolescents nationwide can benefit fully from newly available health benefits and insurance

By Rebecca Gudeman

80f9c99de6“Lila,” 16, came from a strict home. She knew that her parents would be devastated if they found out she were sexually active, and the consequences would be severe were she to become pregnant. But she found herself in a place where she had to get a pregnancy test. She went to a local clinic, knowing that she could obtain care on her own and confidentially under the law in her state. While she could have signed up for a publicly funded insurance program to pay for the pregnancy counseling, she had private insurance through her parents and assumed it would be safe to use. A week or two later, Lila’s parents received a letter at home from their health insurance company. It was an explanation of benefits form (an EOB) that noted one of the person’s enrolled on their health policy received pregnancy related services. They confronted Lila. Several days later, Lila attempted suicide by swallowing a bottle of Tylenol.1


Insurance plans often send communications to insurance policy holders regarding payments and claims about services rendered under their plans. These communications can include information about the types of health services provided to enrollees of the plan as well as information about the medical professional who provided the care. The communications, which may come in the form of an explanation of benefits form (EOB), a denial of claims notice or even a quality improvement survey, at times play an important role in the insurance process, keeping consumers informed about charges against their policy and benefits available, as well as protecting against fraud and identity theft. In some cases, federal or state law actually requires insurers to send such communications.2 However, when the patient is a dependent enrolled on an insurance policy held in another’s name, a request for insurance reimbursement may trigger disclosure of confidential health information to the policyholder without the patient’s knowledge or consent. As Lila’s case makes clear, this can have devastating consequences.

While not new, this problem has taken on a new importance with implementation of the Patient Protection and Affordable Care Act of 2010 (ACA). The ACA requires a series of reforms to health insurance that are being rolled out over the course of several years. Among other changes, the ACA will mean more families are eligible for affordable insurance coverage and more individuals are enrolled on insurance plans held in another’s name.3 It also will require new insurance plans to make critical preventive care available for free to their insured.  These two components of the ACA have the potential to increase adolescent access to critical care. However, confidentiality concerns may mean young people will not take full advantage of services available to them. Growing awareness of the problem has many looking for answers.  A bill recently signed by Governor Jerry Brown in California and co-sponsored by the National Center for Youth Law may provide a national model.

The Insurance Loophole: Why “breaches” of confidential health information by insurers aren’t breaches at all.

Although these unauthorized insurance disclosures appear to breach confidentiality law, in fact, most confidentiality laws, including regulations implementing the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA), include exceptions that allow insurers to disclose otherwise confidential health information for health care operations purposes and for billing and payment processing without need of patient authorization.4 These exceptions make disclosures of a dependent’s health information to the insurance policy holder possible.

Indeed, in a Youth Law News article published in 2003 shortly after the regulations implementing HIPAA’s Privacy Rule first were published, NCYL senior attorney Rebecca Gudeman described this loophole, noting that the new HIPAA regulations might not address the specific confidentiality violations to which teens are most vulnerable.5

“[S]ome of the most common incidental disclosures of adolescent information are linked to insurance policies in which a parent is the named insured. Even with a right to confidentiality, most minors are still dependents. Therefore, parents often are involved in payment issues. Does HIPAA provide any protection? Not really. Because most insurance communications are for the purpose of payment or health care operations, insurers do not need the minor’s written consent prior to making disclosures. While some may argue that an EOB form is a disclosure not directly tied to payment, breaches incidental to payment-related disclosures are allowed as well.”6

In developing the HIPAA regulations, the U.S. Department of Health and Human Services did give dependents some recourse. The HIPAA regulations give individuals the right to request that their insurers send communications by alternate means or to an alternate location – in other words, that communications such as an EOB be sent by electronic mail or to an alternative address rather than by mail to the home address. However, HIPAA states that insurers only need to accept such requests if the request “clearly states” that disclosing the information involved might “endanger the individual.”7 Confidential conversations with several insurance companies suggest the plans receive very few such requests each year. NCYL’s 2003 article predicted several reasons why adolescents might not take advantage of this right:

“Some teens may find it difficult to express their fears – particularly to an unknown insurer. Many also know that explicitly describing danger may lead to a child abuse report. While teens may be willing to share such information with a provider, they will be less likely to share such personal information with an insurer. In addition, the regulations do not define “endanger.” Is fear of abuse required? What if the minor states she would avoid service if there were a risk her parents might find out? Is lack of service enough to endanger the minor? Further, the regulations do not define “clearly states.” Is a statement that disclosure may endanger the minor enough, or does the minor have to give specific detail? Interpretation of these terms is left to the insurer’s discretion, making the efficacy of this option hard to predict.”8

The HIPAA regulations also grant patients the right to request that an insurer not send certain communications to a policyholder.9 If the insurer accepts the request, the insurer must honor it. However, HIPAA does not obligate insurers to accept these requests when the insurer is paying for some or all of the health care provided.10 Confidential conversations with several insurers suggest very few requests are made and even fewer honored.

“Breaches” of confidential health information by insurers lead to lost care opportunities, public expense and worse.

A decade after HIPAA implementation, we now can say this loophole in confidentiality law has led to harm.  While not a matter of concern in every case, unauthorized disclosures and the risk thereof can have consequences, particularly when patients are seeking sensitive care, such as mental health treatment, substance use treatment, or reproductive health care. Harms can include foregone or delayed treatment, such as refusing testing for sexually transmitted diseases or delaying a mental health appointment for fear of disclosure. Indeed, a nurse practitioner who works with young people described it as a common problem: “I have had many clients who refuse testing for sexually transmitted infections or won’t fill a contraceptive prescription because they are on their parents’ insurance.”11 Harms also can include patients choosing to enroll in publicly funded insurance programs rather than using their private insurance to pay for care.12 And harms can include the consequences when information is disclosed without patient consent or knowledge, as in Lila’s case.

Unauthorized disclosures through insurance: Not just an adolescent concern

When a patient is a dependent enrolled on an insurance policy held in another’s name, a request for insurance reimbursement may trigger disclosure of confidential health information to the policyholder without the patient’s knowledge or consent. This can pose a risk for adults as well as young people, as Jane’s story highlights:

For years, Jane was subject to psychological and at times physical abuse by her spouse, Dan. When she got pregnant, she hoped it would get better. It didn’t; it got worse. She finally divorced Dan when her daughter was three. She gained full custody of their child, but the court gave Dan supervised visitation, and ordered that he enroll his daughter on his health insurance. Jane moved to a nearby community and worked hard to keep her location secret from Dan. She was afraid that he would stalk them or worse, based on threats and past behavior. One night, her daughter had a high fever. Jane went to the emergency room. She paid the co-pay but used her daughter’s insurance coverage for the rest. Dan received an EOB that listed the date of service and location of service for their daughter. Based on the hospital used, Dan now knew where they lived. Dan then called the hospital. He said he had questions about payment and the hospital ended up giving him his daughter’s address. A week later, Jane saw him sitting in a car parked in the street outside her house when she left to bring her daughter to daycare.

With a bill such as SB 138 in effect, Jane could have submitted a confidential communications request to the insurance company and had EOBs sent to her home address rather than to Dan’s. SB 138 might have prevented Dan from finding Jane and their daughter. In most families, this type of protection is not necessary, but as this case shows, in certain situations, the ability to obtain additional confidentiality protections can be a lifeline.

Potential to improve adolescent health outcomes under the ACA requires teens be willing to use their insurance

For advocates who care about adolescent health outcomes, the problem is particularly urgent, as reforms required by the ACA have the potential not only to increase the numbers of insured adolescents but to make some of the most needed care widely accessible to adolescents for the first time.

The ACA will increase the number of young people enrolled in private insurance plans through several required reforms – among others, by allowing young people under age 26 to enroll as dependents on a parent’s health insurance policy and by making affordable insurance options available to more families. The ACA also will make high priority preventive care more accessible.  It requires health plans created or bought since the Act’s passage to cover certain preventive health services and make them available with no copayment or other cost to the insured.

The preventive services that must be made available to insured adolescents at no cost cover high priority needs. For example, adolescents will have to be provided preventive screening and counseling for sexually transmitted diseases (STD) at no cost under their ACA insurance plan. Right now, young people between the ages of 15 and 24 make up almost half of all new STD diagnoses each year.13 According to the CDC, a primary reason for the higher prevalence of STDs in this population is difficulty accessing quality preventive care and lack of insurance. Insurers also will have to provide “free” depression and substance use screening to adolescents. The need for this type of screening is great. In a 2011 survey of middle and high school students, 15.8 percent said they seriously considered suicide in the prior year and nearly 25 percent reported having felt so sad or hopeless in the last year that it interfered with their normal activities.14 Insurers also will have to provide adolescents with free access to all FDA-approved contraceptive methods and contraceptive counseling, as well as screening for interpersonal violence, all at no cost. National studies suggest that anywhere from one in five to one in four adolescent girls have been in a violent relationship.15 As described in a recent Youth Law News article on reproductive coercion by NCYL staff attorney Erin Liotta, more than half of the 16-to-20-year olds in a study of young women visiting family planning clinics in northern California reported already having survived intimate partner violence.16

Widely available and accessible preventive services for youth could dramatically improve adolescent health outcomes; however, prior experience shows that adolescents and young adults may not take advantage of the free services available to them unless insurance confidentiality concerns are addressed.

Health Advocates Begin to Review Options

Over the last few years, there has been increased recognition and concern about this loophole and its impact, and advocates nationally began to talk more about options.

In July 2012, the Guttmacher Institute issued an important report entitled “Confidentiality for Individuals Insured as Dependents: A Review of State Laws and Policies.”17 The authors identified the six forms of insurance communication most frequently linked to unauthorized disclosures of patient information and surveyed the law in all 50 states and the District of Columbia looking for statutes and regulations that either required, authorized, or limited these communications. Where they found statutes or regulations authorizing or requiring a specific type of communication, the authors noted whether that law requires the communication to include specific content or be sent to specific recipients.

The authors identified approaches adopted by a few states that directly or indirectly limit disclosures of a dependent’s health information in insurance communication.18 Among others, they highlighted section 3234 of the New York Insurance Law. Section 3234 requires insurers to send EOBs regarding claims made; however, it makes an exception when the patient has no balance due for the service. This could prove very helpful when adolescents seek no-cost preventive care under a newly obtained ACA health insurance policy. However, as the report’s authors highlight, nothing in the New York law prohibits insurers from sending EOBs in such cases and insurers may “elect” to send them in any case.19

As another example, the Guttmacher research uncovered an insurance regulation from Washington State entitled “Right to limit disclosure of health information” adopted over a decade ago. Section 284-04-510 of the Washington Administrative Code limits insurers from disclosing nonpublic personal health information to a policyholder concerning certain types of health service, including reproductive health, STD, drug treatment and mental health care, when a patient asks for that limitation.20 It also limits disclosure of nonpublic personal health information about minors who have sought care that they can consent to on their own.21 Unfortunately, there is no information to confirm that this regulation is being fully implemented.

In general, the authors of the Guttmacher report state that there is little information about whether any of the approaches they documented have resulted in greater confidentiality in practice. They also note that, “several of them, while offering some promise, also appear to pose problems of their own or contain gaps or loopholes.”22

Advocates nationally now are looking at these efforts to try to develop a comprehensive response. In California, the National Center for Youth Law, the California Family Health Council, and the ACLU sponsored legislation, recently signed into law, that builds on rights in HIPAA and lessons from other states.

California Senate Bill 138 – The Confidentiality of Health Information Act

Senate Bill 138 (2013), (SB 138), authored by Senator Ed Hernandez (D) and co-sponsored by NCYL, allows individuals with health insurance under another person’s policy to submit a “confidential communications request” to their insurer. A confidential communications request is a request to have insurance communications sent to the patient rather than the policyholder at an alternative address or via a different form and format, such as e-mail.23

The bill requires insurers to comply with the request in two situations. Insurers must comply with a request if the dependent is requesting confidential communication of information relating to receipt of “sensitive services.”24 The term “sensitive services” is defined in the bill to include, among other services, mental health counseling, reproductive health services, STD testing and care, sexual assault services, and drug treatment.25 An adolescent can only make a request for confidential communication regarding sensitive service care if the minor consented or could have consented to the care under the applicable state law.26

Insurers also must comply with a confidential communication request from an adolescent or adult if the patient states that disclosure of all or part of the information that might be revealed in an insurance communication could endanger the patient, regardless of the type of health care sought.27

HIPAA already gives individuals the right to make confidential communications requests of their insurers; however, SB 138 addresses some of the gaps in the current HIPAA regulation that have made patients hesitate to make such a request. For example, where HIPAA does not define “endanger,” SB 138 defines “endanger” for this purpose to mean that the patient “fears that disclosure of his or her medical information could subject the [individual] to harassment or abuse.”28 The bill explicitly prohibits insurers from requiring individuals to explain why disclosure of this information might endanger them.29

The bill also addresses some practical implementation questions. It requires insurers to implement confidential communications requests within a fixed window of time and requires insurers to inform individuals about the status of their request when they ask for information. The bill also states that a confidential communications request remains in force until explicitly revoked by the individual. This means that individuals will not be required to make new confidential communications requests for every service they obtain. Notably, the bill makes clear that a confidential communication request does not limit insurers from communicating with health care providers and does not limit health care providers from communicating with patients. Finally, there are enforcement provisions that apply if insurers do not comply with the legislation. The California Association of Health Plans did not oppose the bill in its final form.  Symbolically, California Governor Jerry Brown signed the bill into law on October 1st, 2013, the same day that the states were required to launch their health insurance exchanges under the ACA.   SB 138 will go into effect on January 1, 2015.

Looking Ahead

The loopholes in HIPAA and state law that allow private insurers to share a dependent’s confidential health information with the policyholder have existed for years. Due to confidentiality concerns, many adolescents have foregone or delayed needed care, among other harms. Unless confidentiality concerns are addressed, young people may not take full advantage of the benefits available to them as health care reform under the ACA is implemented. Advocates nationally will be watching the implementation of California’s Confidentiality of Health Information Act to see if it can provide a national model.

Rebecca Gudeman is a senior attorney specializing in adolescent health care. She directs NCYL’s adolescent reproductive health project and oversees the project’s website,

  1. Based on a case shared in private conversation with David Knopf, a former professor and social worker in the Division of Adolescent Medicine at UCSF, Facts have been changed to hide identifying characteristics. For a shorter version of this case story, see Prof. Knopf’s testimony in support of California SB 138 before the California Senate Health Committee on April 3, 2013. Video available at at minute 1:14:30.
  2. See e.g. 29 U.S.C. 1133; Cal. Ins. Code 10123.13.
  3. For more information about the ACA, the U.S. Centers for Medicare and Medicaid Services developed a website with a consumer friendly description of what the ACA does and will do including answers to common questions about its impact on health insurance, available at
  4. See e.g. 45 C.F.R. §§164.502(a)(1)(ii), 164.506 and Cal. Civ. Code § 56.10(c)(2).
  5. Rebecca Gudeman, “Adolescent Confidentiality and Privacy Under the Health Insurance Portability and Accountability Act,” Youth Law News, July-Sept 2003, available at
  6. Id. at 5.
  7. 45 C.F.R §§ 164.522(b)(1)(ii),164.502(h).
  8. Gudeman, supra at 5.
  9. 45 C.F.R. § 164.522(a)(1)(i).
  10. 45 C.F.R. § 164.522(a)(1)(ii).
  11. Comment posted by Rachel Picone in response to Michelle Andrews, “How Some Parents Could Learn Adult Daughters’ Birth Control Habits”, NPR, Oct. 12, 2012, available at
  12. Citing data from the National Survey of Family Growth, Rachel Benson Gold wrote that when teens with private health insurance sought contraception, 32% of those surveyed chose to use public insurance programs rather than their private insurance plan to pay for the care. Only 10% of insured women over 30 made that same choice. See Rachel Benson Gold, Unintended Consequences: How insurance processes inadvertently abrogate patient confidentiality, Guttmacher Policy Review, Vol. 12 No. 4 (2009). Available at
  13. Centers for Disease Control and Prevention, “STDs in Adolescents and Young Adults,” accessed on August 22, 2013, citing data from Weinstock H, Berman S, Cates W Jr. “Sexually Transmitted Diseases among American Youth: Incidence and Prevalence Estimates, 2000” Perspect. Sex Reprod. Health 2004:36(1):6-10. Available at
  14. Data retrieved from the “Youth Online” database on August 22, 2013, “Youth Online” makes available data collected from the National Youth Risk Behavior Surveillance System (YRBSS), a national school based survey conducted annually by the Centers for Disease Control and Prevention in collaboration with local agencies. Database available at:
  15. Erin Liotta, “Detecting Reproductive Coercion: Teen Pregnancy as a Red Flag,” Youth Law News, Jan.-Mar. 2013, citing research from National Conference of State Legislatures, Teen Dating Violence, (last visited Feb. 12, 2013) and Elizabeth Miller et al., Reproductive Coercion: Connecting the Dots Between Partner Violence and Unintended Pregnancy, 81 Contraception 457 (2010).
  16. Id., citing to Elizabeth Miller et al., Pregnancy Coercion, Intimate Partner Violence and Unintended Pregnancy, 81 Contraception 316, 319 (2010).
  17. Abigail English, Rachel Benson Gold et al, “Confidentiality for Individuals Insured as Dependents: A Review of State Law and Policies,” Guttmacher Institute and Public Health Solutions, July 2012. Available at
  18. Id. at 18-19.
  19. Id. at 18.
  20. Wa. Admin. Code § 284-04-510(2).
  21. Wa. Admin. Code § 284-04-510(3).
  22. English, Gold et al., supra. at 18.
  23. Ca. Sen. Bill No. 138 (2013 Reg. Sess.), § 2. Available at
  24. See id. at § 4.
  25. Id. at § 2.
  26. See id.
  27. Id. at § 4.
  28. Id at § 2.
  29. Id. at § 4.