Unauthorized disclosures through insurance: Not just an adolescent concern
When a patient is a dependent enrolled on an insurance policy held in another’s name, a request for insurance reimbursement may trigger disclosure of confidential health information to the policyholder without the patient’s knowledge or consent. This can pose a risk for adults as well as young people, as Jane’s story highlights:
For years, Jane was subject to psychological and at times physical abuse by her spouse, Dan. When she got pregnant, she hoped it would get better. It didn’t; it got worse. She finally divorced Dan when her daughter was three. She gained full custody of their child, but the court gave Dan supervised visitation, and ordered that he enroll his daughter on his health insurance. Jane moved to a nearby community and worked hard to keep her location secret from Dan. She was afraid that he would stalk them or worse, based on threats and past behavior. One night, her daughter had a high fever. Jane went to the emergency room. She paid the co-pay but used her daughter’s insurance coverage for the rest. Dan received an EOB that listed the date of service and location of service for their daughter. Based on the hospital used, Dan now knew where they lived. Dan then called the hospital. He said he had questions about payment and the hospital ended up giving him his daughter’s address. A week later, Jane saw him sitting in a car parked in the street outside her house when she left to bring her daughter to daycare.
With a bill such as SB 138 in effect, Jane could have submitted a confidential communications request to the insurance company and had EOBs sent to her home address rather than to Dan’s. SB 138 might have prevented Dan from finding Jane and their daughter. In most families, this type of protection is not necessary, but as this case shows, in certain situations, the ability to obtain additional confidentiality protections can be a lifeline.
Potential to improve adolescent health outcomes under the ACA requires teens be willing to use their insurance
For advocates who care about adolescent health outcomes, the problem is particularly urgent, as reforms required by the ACA have the potential not only to increase the numbers of insured adolescents but to make some of the most needed care widely accessible to adolescents for the first time.
The ACA will increase the number of young people enrolled in private insurance plans through several required reforms – among others, by allowing young people under age 26 to enroll as dependents on a parent’s health insurance policy and by making affordable insurance options available to more families. The ACA also will make high priority preventive care more accessible. It requires health plans created or bought since the Act’s passage to cover certain preventive health services and make them available with no copayment or other cost to the insured.
The preventive services that must be made available to insured adolescents at no cost cover high priority needs. For example, adolescents will have to be provided preventive screening and counseling for sexually transmitted diseases (STD) at no cost under their ACA insurance plan. Right now, young people between the ages of 15 and 24 make up almost half of all new STD diagnoses each year.13 According to the CDC, a primary reason for the higher prevalence of STDs in this population is difficulty accessing quality preventive care and lack of insurance. Insurers also will have to provide “free” depression and substance use screening to adolescents. The need for this type of screening is great. In a 2011 survey of middle and high school students, 15.8 percent said they seriously considered suicide in the prior year and nearly 25 percent reported having felt so sad or hopeless in the last year that it interfered with their normal activities.14 Insurers also will have to provide adolescents with free access to all FDA-approved contraceptive methods and contraceptive counseling, as well as screening for interpersonal violence, all at no cost. National studies suggest that anywhere from one in five to one in four adolescent girls have been in a violent relationship.15 As described in a recent Youth Law News article on reproductive coercion by NCYL staff attorney Erin Liotta, more than half of the 16-to-20-year olds in a study of young women visiting family planning clinics in northern California reported already having survived intimate partner violence.16
Widely available and accessible preventive services for youth could dramatically improve adolescent health outcomes; however, prior experience shows that adolescents and young adults may not take advantage of the free services available to them unless insurance confidentiality concerns are addressed.
Health Advocates Begin to Review Options
Over the last few years, there has been increased recognition and concern about this loophole and its impact, and advocates nationally began to talk more about options.
In July 2012, the Guttmacher Institute issued an important report entitled “Confidentiality for Individuals Insured as Dependents: A Review of State Laws and Policies.”17 The authors identified the six forms of insurance communication most frequently linked to unauthorized disclosures of patient information and surveyed the law in all 50 states and the District of Columbia looking for statutes and regulations that either required, authorized, or limited these communications. Where they found statutes or regulations authorizing or requiring a specific type of communication, the authors noted whether that law requires the communication to include specific content or be sent to specific recipients.
The authors identified approaches adopted by a few states that directly or indirectly limit disclosures of a dependent’s health information in insurance communication.18 Among others, they highlighted section 3234 of the New York Insurance Law. Section 3234 requires insurers to send EOBs regarding claims made; however, it makes an exception when the patient has no balance due for the service. This could prove very helpful when adolescents seek no-cost preventive care under a newly obtained ACA health insurance policy. However, as the report’s authors highlight, nothing in the New York law prohibits insurers from sending EOBs in such cases and insurers may “elect” to send them in any case.19
As another example, the Guttmacher research uncovered an insurance regulation from Washington State entitled “Right to limit disclosure of health information” adopted over a decade ago. Section 284-04-510 of the Washington Administrative Code limits insurers from disclosing nonpublic personal health information to a policyholder concerning certain types of health service, including reproductive health, STD, drug treatment and mental health care, when a patient asks for that limitation.20 It also limits disclosure of nonpublic personal health information about minors who have sought care that they can consent to on their own.21 Unfortunately, there is no information to confirm that this regulation is being fully implemented.
In general, the authors of the Guttmacher report state that there is little information about whether any of the approaches they documented have resulted in greater confidentiality in practice. They also note that, “several of them, while offering some promise, also appear to pose problems of their own or contain gaps or loopholes.”22
Advocates nationally now are looking at these efforts to try to develop a comprehensive response. In California, the National Center for Youth Law, the California Family Health Council, and the ACLU sponsored legislation, recently signed into law, that builds on rights in HIPAA and lessons from other states.
California Senate Bill 138 – The Confidentiality of Health Information Act
Senate Bill 138 (2013), (SB 138), authored by Senator Ed Hernandez (D) and co-sponsored by NCYL, allows individuals with health insurance under another person’s policy to submit a “confidential communications request” to their insurer. A confidential communications request is a request to have insurance communications sent to the patient rather than the policyholder at an alternative address or via a different form and format, such as e-mail.23
The bill requires insurers to comply with the request in two situations. Insurers must comply with a request if the dependent is requesting confidential communication of information relating to receipt of “sensitive services.”24 The term “sensitive services” is defined in the bill to include, among other services, mental health counseling, reproductive health services, STD testing and care, sexual assault services, and drug treatment.25 An adolescent can only make a request for confidential communication regarding sensitive service care if the minor consented or could have consented to the care under the applicable state law.26
Insurers also must comply with a confidential communication request from an adolescent or adult if the patient states that disclosure of all or part of the information that might be revealed in an insurance communication could endanger the patient, regardless of the type of health care sought.27
HIPAA already gives individuals the right to make confidential communications requests of their insurers; however, SB 138 addresses some of the gaps in the current HIPAA regulation that have made patients hesitate to make such a request. For example, where HIPAA does not define “endanger,” SB 138 defines “endanger” for this purpose to mean that the patient “fears that disclosure of his or her medical information could subject the [individual] to harassment or abuse.”28 The bill explicitly prohibits insurers from requiring individuals to explain why disclosure of this information might endanger them.29
The bill also addresses some practical implementation questions. It requires insurers to implement confidential communications requests within a fixed window of time and requires insurers to inform individuals about the status of their request when they ask for information. The bill also states that a confidential communications request remains in force until explicitly revoked by the individual. This means that individuals will not be required to make new confidential communications requests for every service they obtain. Notably, the bill makes clear that a confidential communication request does not limit insurers from communicating with health care providers and does not limit health care providers from communicating with patients. Finally, there are enforcement provisions that apply if insurers do not comply with the legislation. The California Association of Health Plans did not oppose the bill in its final form. Symbolically, California Governor Jerry Brown signed the bill into law on October 1st, 2013, the same day that the states were required to launch their health insurance exchanges under the ACA. SB 138 will go into effect on January 1, 2015.
The loopholes in HIPAA and state law that allow private insurers to share a dependent’s confidential health information with the policyholder have existed for years. Due to confidentiality concerns, many adolescents have foregone or delayed needed care, among other harms. Unless confidentiality concerns are addressed, young people may not take full advantage of the benefits available to them as health care reform under the ACA is implemented. Advocates nationally will be watching the implementation of California’s Confidentiality of Health Information Act to see if it can provide a national model.
Rebecca Gudeman is a senior attorney specializing in adolescent health care. She directs NCYL’s adolescent reproductive health project and oversees the project’s website, www.teenhealthlaw.org .
- Based on a case shared in private conversation with David Knopf, a former professor and social worker in the Division of Adolescent Medicine at UCSF, Facts have been changed to hide identifying characteristics. For a shorter version of this case story, see Prof. Knopf’s testimony in support of California SB 138 before the California Senate Health Committee on April 3, 2013. Video available at http://www.calchannel.com/recent-archive/  at minute 1:14:30.
- See e.g. 29 U.S.C. 1133; Cal. Ins. Code 10123.13.
- For more information about the ACA, the U.S. Centers for Medicare and Medicaid Services developed a website with a consumer friendly description of what the ACA does and will do including answers to common questions about its impact on health insurance, available at https://www.healthcare.gov/families 
- See e.g. 45 C.F.R. §§164.502(a)(1)(ii), 164.506 and Cal. Civ. Code § 56.10(c)(2).
- Rebecca Gudeman, “Adolescent Confidentiality and Privacy Under the Health Insurance Portability and Accountability Act,” Youth Law News, July-Sept 2003, available at http://www.youthlaw.org/fileadmin/ncyl/youthlaw/
- Id. at 5.
- 45 C.F.R §§ 164.522(b)(1)(ii),164.502(h).
- Gudeman, supra at 5.
- 45 C.F.R. § 164.522(a)(1)(i).
- 45 C.F.R. § 164.522(a)(1)(ii).
- Comment posted by Rachel Picone in response to Michelle Andrews, “How Some Parents Could Learn Adult Daughters’ Birth Control Habits”, NPR, Oct. 12, 2012, available at http://www.npr.org/blogs/health/2012/10/02/
- Citing data from the National Survey of Family Growth, Rachel Benson Gold wrote that when teens with private health insurance sought contraception, 32% of those surveyed chose to use public insurance programs rather than their private insurance plan to pay for the care. Only 10% of insured women over 30 made that same choice. See Rachel Benson Gold, Unintended Consequences: How insurance processes inadvertently abrogate patient confidentiality, Guttmacher Policy Review, Vol. 12 No. 4 (2009). Available at http://www.guttmacher.org/pubs/gpr/12/4/gpr120412.html 
- Centers for Disease Control and Prevention, “STDs in Adolescents and Young Adults,” accessed on August 22, 2013, citing data from Weinstock H, Berman S, Cates W Jr. “Sexually Transmitted Diseases among American Youth: Incidence and Prevalence Estimates, 2000” Perspect. Sex Reprod. Health 2004:36(1):6-10. Available at http://www.cdc.gov/std/stats10/adol.htm .
- Data retrieved from the “Youth Online” database on August 22, 2013, “Youth Online” makes available data collected from the National Youth Risk Behavior Surveillance System (YRBSS), a national school based survey conducted annually by the Centers for Disease Control and Prevention in collaboration with local agencies. Database available at: http://apps.nccd.cdc.gov/youthonline/App/Default.aspx 
- Erin Liotta, “Detecting Reproductive Coercion: Teen Pregnancy as a Red Flag,” Youth Law News, Jan.-Mar. 2013, citing research from National Conference of State Legislatures, Teen Dating Violence, www.ncsl.org/issues-research/health/teen-dating-violence.aspx  (last visited Feb. 12, 2013) and Elizabeth Miller et al., Reproductive Coercion: Connecting the Dots Between Partner Violence and Unintended Pregnancy, 81 Contraception 457 (2010).
- Id., citing to Elizabeth Miller et al., Pregnancy Coercion, Intimate Partner Violence and Unintended Pregnancy, 81 Contraception 316, 319 (2010).
- Abigail English, Rachel Benson Gold et al, “Confidentiality for Individuals Insured as Dependents: A Review of State Law and Policies,” Guttmacher Institute and Public Health Solutions, July 2012. Available at http://www.guttmacher.org/pubs/confidentiality-review.pdf 
- Id. at 18-19.
- Id. at 18.
- Wa. Admin. Code § 284-04-510(2).
- Wa. Admin. Code § 284-04-510(3).
- English, Gold et al., supra. at 18.
- Ca. Sen. Bill No. 138 (2013 Reg. Sess.), § 2. Available at http://leginfo.ca.gov/pub/13-14/bill/sen/sb_0101-0150/sb_138_bill_20130903_amended_asm_v93.pdf 
- See id. at § 4.
- Id. at § 2.
- See id.
- Id. at § 4.
- Id at § 2.
- Id. at § 4.