WOKR-TV's website (from Rochester) has an article about the balancing act that healthcare providers have to deal with as a consequence of privacy legislation. The article focusses on HIPAA, but similar issues arise here under PIPEDA and provincial laws.

Privacy Laws And Kids, A Delicate Balance:

" Patrice Walsh (Rochester, NY) 08/24/04 - If a child gets hurt, parents are usually the first to be notified, but not always.

At age 18, young people in college are considered adults and protected under Health Insurance Portability and Accountability Act (HIPAA) law. They must consent before parents are notified in case of illness or injury.

Megan Bero, 18, is accustomed to having her mother nearby when she's sick. Now the SUNY Brockport freshman is on her own for the first time, and suffering from a case of hives.

Megan was given a prescription, something her mother would not have been told unless Megan wanted her to know.

Megan said, 'If it's something serious, I think she should be told, she's my mother, she should be called.'"

Ontario's Bill 31 does a better job in dealing with substitute consent, but a lot remains up to the judgment of individual physicians and healthcare providers.

My general approach is to consider the ability of the individual child to consent (in a meaningful way) to the collection, use or disclosure of personal information. If the kid is able to make those decisions in an informed manner, the decision is theirs to make and the physician should not assume they are able to disclose any information to the parent without consent. Even if there is a general consent from the child to disclose information to the parents, particular care must be taken when you are dealing with sensitive topics, such as pregnancy, abortion and sexually transmitted diseases. The physician should always be aware of the privacy rights of the patient and consistently looking after the patient's best interests.

Complete aside: I find the infantilization of young adults to be very interesting. As a lawyer who advises a number of universities and post-secondary institutions on privacy practices, it is clear that the line between child and adult is blurring, at least from the perspective of the parent. When I went to university, it was unheard of for a parent to call a professor to ask about a kid's progress and there never would have been any thought that the university was acting in loco parentis. An eighteen year old is an adult. Period. End of sentence. Now universities are facing an onslaught of parents who act as though their kids are in high school still and assume they have a right to know whether Johnny has been skipping English 101. Nothing of substance, I just find it interesting.

Labels: health information, information breaches