Shifting into Action: from Data Segmentation to Equitable Interoperability for Adolescents (and Everyone Else)

Abstract

Background Technological improvements and, subsequently, the federal 21st Century Cures Act have resulted in increased access to and interoperability of electronic protected health information (ePHI). These not only have many benefits, but also have created unique challenges for privacy and confidentiality for adolescent patients. The inability to granularly protect sensitive data and a lack of standards have resulted in limited confidentiality protection and inequitable access to health information.

Objectives This study aimed to understand the challenges to safe, equitable access, and interoperability of ePHI for adolescents and to identify strategies that have been developed, ongoing needs, and work in progress.

Methods Shift, a national task force formalized in 2020, is a group of more than 200 expert stakeholder members working to improve functionality to standardize efforts to granularly identify and protect sensitive ePHI to promote equitable interoperability.

Results Shift has created high-priority clinical use cases and organized challenges into the areas of Standards and Terminology; Usability and Implementation; and Ethics, Legal, and Policy.

Conclusion Current technical standards and value sets of terminology for sensitive data have been immature and inconsistent. Shift, a national diverse working group of stakeholders, is addressing challenges inherent in the protection of privacy and confidentiality for adolescent patients. The diversity of expertise and perspectives has been essential to identify and address these challenges.

 

Scroll to top

Keywords

interoperability - privacy - confidentiality - standards - implementation - data segmentation - DS4P - adolescent

Background and Significance

We have entered a digital age in which electronic protected health information (ePHI) is becoming accessible and shareable for all patients. Increased patient access to ePHI promotes health care autonomy, improved access to providers, control over personal health information, and is now mandated by the U.S. federal 21^st Century Cures Act Final Rule.[1] However, this access to health information raises unique privacy concerns for adolescent patients.[2]

Age of Adolescence

Adolescence is a time of exploration and discovering a sense of self apart from parental influence. Adolescence is also a time of increased needs for reproductive, mental, and behavioral health.[3] [4] [5] Multiple studies have found that adolescents will not seek needed health care for issues such as mental health, reproductive health, and intimate partner violence if they fear that related sensitive information will be shared with parents or guardians.[6] [7] [8] [9] [10] [11]

It is essential that adolescents are ensured a private, protected relationship with health care providers, a relationship secured by law in most states. The beliefs and attitudes an adolescent develops during this time regarding one's ability to trust clinicians and the health care system may follow them for the rest of their life. Also, recent state and federal policies have created exigency on the protection of sensitive health data in the electronic health record (her), including legislation related to reproductive and gender-affirming care.

 

Scroll to top

Adolescent Privacy Protection in the Electronic Health Record

Protecting adolescent privacy in therEHR has unique challenges.[12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] Varying privacy and confidentiality laws add complexity to interstate health information exchange (HIE). These laws vary by minors' age, type of care, and context. It is imperative to communicate limitations in privacy protection to adolescents and their parents, who are often unaware of the implications of shared sensitive health information.[17] [25] [26] [27] [28] [29] [30] Health care providers encourage adolescents to share sensitive information and thus must find ways to prevent unintended information disclosures. Strategies, such as separate adolescent and parental proxy portal accounts, have been established to help protect this information.[31] However, portal privacy policies vary widely and have limited protection against parental access to adolescent accounts.[32] [33] [34] [35] [36] [37] Research across three children's hospitals reported that 64% of adolescent accounts had been accessed by a parent, presenting an additional barrier to privacy protection.[32]

All 50 states afford varying degrees of adolescent confidentiality for certain types of care (usually substance use, reproductive, and mental health), though there is significant variability in confidentiality limitations and portal policies.[38] At the onset of adolescence, many health systems provide portal access to the patient and move the parent/guardian to a proxy account. When provisioning proxy access, some health systems limit proxy account information to a small subset of health information and allow full access to the adolescent. Other institutions avoid the risk of inadvertent disclosure by allowing the patient and proxy account to access only limited nonsensitive health information. At the age of majority, young adults gain full access and the proxy access must be removed.

These portal access shifts present a challenging workflow for most health IT platforms. With significant effort and clinical informatics resourcing, health systems may be able to structure limited granular segmentation of data that cross to different portal users. However, this is institution-specific and cannot be leveraged for interoperability. The limitation of standards and lack of implementation guidance render this build complex and resource-intensive, so it remains a limited alternative.[39] Similar considerations exist for digital health platforms targeted to teens.

 

Scroll to top

Sensitive Data

What is “sensitive” to one individual may not be sensitive to another. Based on federal and state law, information related to reproductive health (sexually transmitted infections, pregnancy, and genetic information), sexual orientation, behavioral health, and substance use are commonly considered “sensitive.” However, other data may be considered sensitive in certain contexts (e.g., an injury for a serious athlete). Some do not regard certain health data as sensitive and may be offended when others consider it so (for instance, a proudly gay individual or an advocate for the destigmatization of mental health conditions). Furthermore, patients may face implicit and explicit biases basheron EHR information.[40] [41] [42] [43] [44] [45] [46] [47] Patients may wish to block certain data from being shared, but due to limitations in segmentation abilities, must share data in an all or none fashion regardless of platform. Furthermore, requesting that data not be shared through the HIE and the health system requires a savvy patient and institutional compliance.

Even if agreement is reached around sensitive data elements and deployment of the necessary technical capabilities, unaddressed usability questions such as how patients request withholding of data, what informed consent would involve and how it would apply to adolescents, and how clinical systems would operate under redaction or obfuscation and interact with other systems (e.g., decision support) remain. For the portal, in particular, questions exist about whether and how proxies would know (or not know) that data are present but redacted.

 

Scroll to top

Equitable Interoperability

The ability to share medical records seamlessly among health care providers has been a goal over the past decade. However, as health information becomes more readily shared between health care systems and clinicians, numerous complexities arise. For example, a patient may not want sensitive information, such as a prior abortion, readily shared with their allergist. However, there are concerns about potential safety issues if data redaction blocks view of a patient's full medical history.

Lack of mature standards prevents reliable, consistent granular protection of sensitive data, leading to information blocking of larger segments of ePHI and inequitable patient access to health information.[39] This differentially affects vulnerable patient groups with increased needs for sensitive data protection, such as LGBTQ youth and victims of abuse. Currently, patients without sensitive data can fully benefit from interoperability, whereas those with sensitive data may fear doing so, resulting in health inequities. Some organizations resort to blunt algorithms or manual processes to withhold data sharing for broad populations, which may result in care inequities and potential information blocking, as patients with stigmatized conditions may decline to consent to data sharing. As some sensitive conditions are more prevalent in vulnerable populations (including adolescents) and historically disenfranchised populations, such concerns contribute to disparities in care.

 

Scroll to top

Information Blocki^ng

The 21st Century Cures Act Information Blocking Final Rule and the Dobbs v. Jackson Women's Health Organization Supreme Court decision intensified the need to segment and protect sensitive data.[1] [48] Information blocking is “a practice that is likely to interfere with the access, exchange or use of electronic health information, except as required by law or specified in an information blocking exception.”[49] [50] [51] [52] The Dobbs decision heightens the urgency for development of functionality enabling granular segmentation of reproductive health and pregnancy outcomes data from a broad range of health care stakeholders, particularly for interstate data sharing.[40] [41] Lack of granular segmentation standards that accommodate information blocking exceptions may ultimately result in less information sharing. Implementation of functionality to comply with information blocking provisions has made privacy concerns a lived reality for clinical staff, patients, and technology vendors alike.

 

Scroll to top

 

Scroll to top

Methods

Shift

There have been efforts to address these challenges involving the granular segmentation of sensitive data, but current technical standards to identify and protect sensitive health data are immature and inconsistent. Although value sets for sensitive terminologies exist, they are neither comprehensive nor maintained, and fail to identify all sensitive adolescent health information. Health care providers need more sophisticated functionality to identify, segment, and protect sensitive ePHI while complying with regulations and improving general access to ePHI. Other populations besides adolescents (e.g., racial, ethnic, and sexual minorities) may experience medical mistrust and implicit biases if sensitive health information is shared without their knowledge, explicit consent, and ability to withhold certain data.

Shift, an independent task force for equitable interoperability, was formalized in 2020 to address challenges arising from the need to segment data. The Governing Board for Shift includes representation from the American Academy of Pediatrics, American Medical Association, Electronic Health Records Association, Integrating the Healthcare Enterprise, Drummond Group, AARP, and the Office of the National Coordinator for Health IT (ONC) as an ex officio member. The Drummond group has been a stakeholder and supporter of the work of Shift; in this capacity, they are one of several Governing Board organizations who guide Shift's mission, vision, and deliverables. Also in this capacity, they have provided in-kind services such as Web site hosting, project management services, and personnel. Shift (http://www.shiftinterop.org) brings together more than 200 expert stakeholders to tackle these questions through a consensus-driven approach to advance standards development, implement guidance, and drive policy.

 

Scroll to top

Brief Review of Existing Work

Shift first explored the work that had already been done in this space to understand the challenges and opportunities of where existing work could be leveraged and where new development was needed. To address the need for a national standard to support tagging of sensitive data for interoperable data sharing, the Data Segmentation for Privacy (DS4P) HL7 Clinical Document Architecture (CDA) Implementation Guide (IG) standard was developed in 2011 and accredited by the American National Standards Institute in 2014.[53(p7)] This IG was primarily developed around data exchange subject to 42 Code of Federal Regulations (CFR) Part 2 restrictions related to federally funded substance use treatment programs. The original standard allowed for tagging of Consolidated Clinical Document Architecture (C-CDA) metadata at the document, section, or entry level to indicate that the data contained therein was restricted and subject to redisclosure restrictions. A handful of pilot implementations are described in [Supplementary Table S1] (available in the online version).

Since then, DS4P HL7 version 2.9 and DS4P Fast Healthcare Interoperability Resources (FHIR) IGs have been developed. DS4P FHIR allows direct labeling of data elements as sensitive without the dependency of sending the C-CDA document. DS4P has also provided the data segmentation underpinnings then supported by several consent management platform tools, which allow a patient or organization to define how they would designate their data to be shared. Since May 2020, the HL7 Security Work Group has been developing an evolving FHIR DS4P IG leveraging the HL7 Healthcare Privacy and Security Classification System for security labeling. Further development of DS4P FHIR implementation guidance for the use of FHIR security labels based on an expanded set of use cases is needed.

Some EHR vendors have, and continue to, develop vendor-specific functionality that supports tagging of sensitive data, specifically for release to the portal. These development efforts accelerated in response to the 21st Century Information Blocking Final Rule. While this work may benefit some users, some vendor-specific approaches do not promote interoperability or the ability to share data with established exceptions across the health care ecosystem.[54]

While DS4P allows for tagging of data to specify its sensitivity, a consent management platform is then needed to capture patient sharing preferences. Several these have been developed and piloted, including Consent2Share, an open-source tool developed by the Substance and Mental Health Services Administration (SAMHSA), which utilized DS4P CDA. More recently the San Diego Regional HIE Leading Edge Acceleration Projects (LEAP) project focused on implementation of the FHIR Consent Resource to manage consent for privacy, medical consent, advance directives, and research, as well as using a security labeling service.[55]

Although DS4P and various consent management platforms have had successful individual pilots within a single regional system, implementation of granular segmentation and consent management to support individual privacy preferences and equitable interoperability has not scaled nationwide.

 

Scroll to top

Shifting the Approach

After understanding the existing landscape of data segmentation efforts, Shift developed an approach that was not only narrowly focused on technical standards alone but also simultaneously considered the usability, implementation, ethics, legal, policy, provider, and patient considerations as key pillars. Shift identified key leaders and stakeholders passionate about all of these aspects of the work and then created subworkgroups that scoped out these challenges described in detail below. The first step involved creating high-priority use cases that were based on real-world needs that cut across different age groups, sensitive conditions, and types of data exchange. The adolescent use case with fictional patient Maritza is depicted in [Fig. 1] with the other use cases summarized in [Fig. 2].

Fig. 1 (Top) Maritza a 16-year-old female visits her primary care physician for a visit where she and her mother discuss Maritza's worsening asthma for which she is prescribed an inhaler and referred to a pulmonologist. (Bottom) While Maritza and the primary care physician talk alone, she shares that she plans to be sexually active and an oral contraceptive pill (OCP; ethinyl–estradiol–norethindrone) is prescribed. This order and documentation about it are highlighted in yellow in the diagram (data presented in this figure are imaginary). EHR, electronic health record.

Fig. 2 Shift use cases. EHR, electronic health record; HIE, health information exchange.

 

Scroll to top

Standards, Terminology, and Technical Challenges

One challenge to moving beyond blunt “all-or-none” information-sharing policies and toward granular data segmentation is to define specifically which data need to be segmented. Such effort often begins with legal guidance around broad categories such as reproductive or mental health, followed by the translation of those concepts into medical terminology and structured codes needed to automate this work in a standardized fashion. As a result, individual institutions must create their own list of sensitive diagnoses, procedures, laboratory results, and vital sign codes that must be regularly updated. Such efforts require a significant amount of informatics resources that many institutions lack. Laws defining protected categories of data exist at the broad level of reproductive health or behavioral health and provide no translation into specific diagnostic (e.g., the International Classification of Diseases Tenth Revision), procedure (e.g., Current Procedural Terminology), laboratory (Logical Observation Identifier Names and Codes), or medication (RxNorm) codes, which has resulted in a patchwork of nonstandardized lists. The variation in lists of sensitive conditions may render a condition treated as sensitive at one institution to be treated as not sensitive at a second institution posttransmission.

This may impact adolescent practitioners when addressing reproductive health concerns such as contraception. In the adolescent Maritza use case, EHR managers at the primary care physician's (PCP) health care system would have defined a list of sensitive medications and included the oral contraceptive pill (OCP) on that list and also defined where that information would and would not show up in the EHR and portal. However, the EHR used by the pulmonologist's health system—even if from the same vendor—might be configured differently, including without a list of sensitive medications ([Fig. 3]).

Fig. 3 The complex interplay of systems and data across multiple electronic health record systems. While health system 1 (green circle) may have particular policies around sensitive medications, that information will travel to other systems such as a specialist provider, pharmacy, or payor who all may have different rules with handling classifications of sensitivity. EHR, electronic health record; PCP, primary care physician.

Another challenge is to use standardized condition lists to tag sections of the EHR with the appropriate sensitivity label. This has been done at the time of data transmission through the C-CDA, but there is increasing exploration of security labeling using FHIR resources, which would allow tagging of individual data elements within the chart itself and even potentially the tagging of free text via natural language processing. Many settings specialized in caring for adolescents may be attuned to the privacy protection needs of this population and their specific relevant state legislation. They may set up vendor-specific functionality and train their staff in workflows to support these protections. However, when an adolescent's data leave the confines of these settings, protecting their privacy may become more challenging. In the use case, the PCP's EHR may have defined the OCP as a sensitive medication and may prevent any sensitive medications from being listed in the medication list of the proxy portal account. When Maritza's medication list is sent to the pulmonologist's EHR system, the OCP on the medication list may no longer be marked as sensitive, thereby showing the OCP in Maritza's medication list on the pulmonologist's portal, where her mother has proxy access. This issue is partly a technical challenge of EHR structure and becomes much more of an implementation and usability challenge based on how institutions build and train clinicians to use EHRs.

 

Scroll to top

Usability and Implementation Challenges

While the technical challenges are myriad, solving them is only part of the work. Usability, which covers everything from the way patients request sensitive data segmentation to how clinicians view and interact with segmented data in EHRs, must be taken into account. This conversation usually starts when patients are first given information about a health care practice's notice of privacy policy (NPP) and documentation about the Health Insurance Portability and Accountability Act (HIPAA) and are asked to sign a document describing how their information will be used and shared. Some of this process takes place face-to-face, and some preferences may be captured digitally such as through an eConsent mechanism. The examples discussed here largely focus on provider-based care, but patients may use self-selected digital health services, which have their own protocols and usability considerations. When Maritza and her mother first sought care at the PCP and pulmonologist's office, they would have been asked to review and agree to the NPP and HIPAA policies, and in the current state would not have had the ability to make specific data segmentation requests.

On the clinician side, usability questions such as how redacted data show up in EHRs and whether there are alerts to clinicians suggesting that the record contains data they cannot see. EHRs use data such as diagnosis to inform clinical decision support and other functionality, and if the data powering such systems are obfuscated the function of downstream processes must be managed. For instance, if in the future Maritza requires treatment such as an antiepileptic medication, a drug–drug interaction checker may find potential adverse reactions between the antiepileptic and the OCP through functionality that providers rely on as a safety check.

Beyond the usability challenges, variation may result from EHR vendors' technology, variation in institutional IT resources, and the ability to implement more complex workflows. Institutions have their own legal and policy mandates around granular data segmentation, and these challenges affect other stakeholders such as pharmacies and payors. When Maritza's PCP ordered both the new inhaler medication and the OCP, the orders were both sent to the same pharmacy, where Maritza's mother might be listed as the primary contact. The pharmacy information systems would also need to know that the OCP is a sensitive medication and that the pharmacy should not inform Maritza's mother that there are two medications. Similarly, when the claim goes to the insurance company, the details of the visit are shared with the primary guarantor (who is usually not the adolescent) in an explanation of benefits (EOB) form, and again the OCP as a sensitive medication should not appear ([Fig. 4]). As an aside, this raises a complex ethical and legal question around whether information can be obfuscated from the person paying the health insurance premium and/or copay.

Fig. 4 The primary care physician's EHR system and patient portal is configured so that the oral contraceptive pill (ethinyl–estradiol–norethindrone) is identified as a sensitive medication and not shared with Maritza's mother through the proxy portal access. However, when this medication information is exchanged to the pulmonologist's EHR system (part of a separate health care system), the medication is not identified as sensitive and furthermore is revealed to Maritza's mother in the second proxy portal account, indicated with the red outline. EHR, electronic health record.

 

Scroll to top

Ethical, Legal, Administrative, and Policy Challenges

There are complex ethical and legal considerations to address. For example, categories of sensitive data need to be identified and codified. However, due to broad legal variability across state lines with nuanced gray areas of interpretation, differing institutional interpretations leads to differing policy development. Ethical questions remain around patients' rights to redact data they do not want to share and whether such rights supersede a clinician's belief that a complete medical record is essential for safe medical decision-making.

More recently, the legal risks for patients and providers alike have been escalating, particularly around the criminalization of reproductive care and gender-affirming care. If a patient crossed state lines to receive such care in a state where care is legal, details about this care could follow them back to states where such care is illegal and thereby expose patient and provider to legal risk. Even when such care is lawful, data redaction could prevent the stigma and bias experienced by some patients when providers are aware of the care.[40] [42] [43] [44] [45] [46] [47]

 

Scroll to top

Existing Work

Some EHR vendors have, and continue to, develop vendor-specific functionality that supports tagging of sensitive data, specifically for release to the portal. These development efforts accelerated in response to the 21st Century Information Blocking Final Rule. While this work may benefit some users, vendor-specific approaches do not promote interoperability or the ability to share data with established exceptions across the health care ecosystem.[54]

While DS4P allows for tagging of data to specify its sensitivity, a consent management platform is then needed to capture patient sharing preferences. Several these have been developed and piloted, including Consent2Share, an open-source tool developed by the SAMHSA, which utilized DS4P CDA. More recently the San Diego Regional HIE LEAP project focused on implementation of the FHIR Consent Resource to manage consent for privacy, medical consent, advance directives, and research, as well as using a security labeling service.[55]

Although DS4P and various consent management platforms have had successful individual pilots within a single regional system, implementation of granular segmentation and consent management to support individual privacy preferences and equitable interoperability has not scaled nationwide. DS4P and consent management tools do not adequately address other high-value clinical use cases such as Maritza's, and as a result, granular segmentation of data leveraging these tools has not been prioritized.

 

Scroll to top

 

Scroll to top

Results

The pilot implementations of the DS4P standard advanced the notion and technical possibility of granularly segmenting data within a narrow clinical and technical scope. Shift's approach introduces additional high-value real-world clinical use cases, develops a reusable methodology, and builds on pilot implementations and standards development work already underway.

Clinical Use Cases

Shift has developed four high-priority clinical use cases to be addressed in two phases, as depicted in [Fig. 2].

Clinicians with subject matter expertise developed these use cases in an iterative process along with other Shift stakeholders who provided feedback on informatics, data, and ethical considerations. The range of topics that were determined to be important were divided across the use cases. The Pareto principle was used to create comprehensive, representative use cases that are detailed but not overly complex to ensure that initial implementation would be feasible. The use cases include a patient narrative followed by discrete data elements, the specification of specific methods of exchange, and privacy concerns including harms. Shift's clinical use cases have also been leveraged in other related stakeholder work such as that featured in the Stewards of Change Institute report, the OpenID Heart Working Group, and the Gravity Project on the social determinants of health use cases.[56] [57] [58]

 

Scroll to top

Standards and Terminology

Standards development work, in alignment with the HL7 Security Workgroup, is focused on formulating a framework methodology that can:

• Identify use case data elements harmonized using the U.S. Core Data for Interoperability.

• Use a decision-tree process to better standardize the translation of broad categories (i.e., reproductive health) to subcategories (i.e., sexually transmitted infections) to specific code sets.

• Curate value sets for the data elements, which includes defining a nationally available, steward-maintained Value Set Authority Center (VSAC) terminology value set for sensitive conditions.

• Leverage DS4P FHIR work for designing and implementing computer consumable HL7 data tags.

• Define privacy policies and identify patient consent preferences through an existing consent management engine to develop sandbox demonstrations of increasing complexity.

The National Library of Medicine maintains the VSAC Web site, which acts as a central database of value sets developed by various organizations for clinical, operations, and research purposes. SAMHSA developed a C2S VSAC Value Set of sensitive conditions, largely focused on the 42 CFR Part 2 use case, but this was not comprehensive around other conditions and has not been maintained since 2016, so is now outdated. Shift is bringing together organizations that can be stewards of a Shift-guided value set that can become a de facto standard.

 

Scroll to top

Implementation

Implementation guidance is needed to address several challenges and controversial issues. If a single site or system has the resources to invest in a pilot, it can determine how to manage such challenges within its own system, but for granular segmentation of data to scale nationally, such recommendations are needed on a broader level.

Shift is engaging expert stakeholders in a modified Delphi process to develop consensus-driven guidance around areas identified as specific barriers to implementation, including those outlined above. At a high level, this will involve determining how to achieve the appropriate balance between patient safety and privacy considerations as well as the balance between allowing specificity while limiting provider burden. Once drafted, Shift will seek feedback and ultimately endorsement of this implementation guidance from clinical and industry professional societies.

 

Scroll to top

Ethical, Legal, and Policy

Shift is developing a foundational legal framework, including a specific adolescent roadmap, to help implementers navigate compliance and jurisdictional considerations. This work will facilitate the required standards revision and implementation guidance with a scalable methodology needed to drive widespread adoption. Future work will include advocacy for and sponsorship of governmental policy to promote equitable interoperability across the health care ecosystem.

Stakeholders are unlikely to adopt new standards without a financial or policy driver. ONC has introduced DS4P as an optional standard, as in the past industry regarded required standards with unease due to the effort and cost of development and implementation. Shift's goal is to work across the industry to mature the standard and implementation guidance while working closely with ONC to advance policy that drives widespread adoption.

 

Scroll to top

 

Scroll to top

Discussion

The use cases across the different age spans have been designed to address the high-yield clinical scenarios encountered in the real world. These span reproductive health, mental or behavioral health, substance use issues, as well as integration with sensitive social determinants of health data. The use cases each identify a specific challenge around sensitive data exchange including EHR to patient portal, EHR to EHR directly and through an HIE, as well as plans to address connections between EHR data and third party mobile applications.

There is a significant amount of common framework that all use cases can benefit from around standards for segmenting sensitive data. However, there are unique aspects for each of the cases that are being developed as well. While most states provide adolescents' with the right to seek confidential care around certain topics, it is uncertain if this means they also have the right to request that their medical records are not exchanged to a specialist at a different health system if their parent/guardian wants them to. These additional ambiguities and scenarios regarding adolescent rights necessitate further refinement and implementation by health care systems.[59]

 

Scroll to top

Conclusion

Adolescence is a time of increasing desire for and benefit from privacy during growth into adulthood. Advances in health information, digital access to personal health information, and regulatory mandates supporting individuals' access to their EHR have created new opportunities for adolescents to manage their privacy. Such advances also have created new complexities in the management of health information and—more importantly—the human relationships with parents and medical care providers that underlie effective health management. The development of information sharing standards and integrated applications along with the clarification and coordination of policy across states and the federal government increasingly support development of data segmentation functionality. Shift reviewed the insights from previous work and assessed persistent gaps to identify additional high-value real-world clinical use cases, build upon ongoing standards development, and develop a scalable methodology. The progression of this work will advance the implementation of an adolescent health record that supports youths' growing autonomy and privacy needs as well as provider requirements for administering effective, appropriate care.

 

Scroll to top

Clinical Relevance Statement

This manuscript is clinically relevant due to the current pressing challenge that health care systems and providers of health care data wrangle with regarding the provision of access to adolescents' regarding their own health care data while maintaining confidentiality.

 

Scroll to top

Multiple-Choice Questions

1. Which of the following is not a challenge of protecting adolescent privacy in EHRs in today's interoperable ecosystem?

   • Understanding state law and translating broad categories into standardized terminology

   • Inability to granularly segment data

   • Lack of access to patient portals for adolescents

   • Transmission of data to guarantor on the EOB

   Correct Answer: The correct answer is option c. Today's EHRs do provide access via patient portals to adolescents who meet the criteria for access as defined by state law, regulation, and institutional policy.

2. What is meant by the term “equitable interoperability”?

   • Making sure everyone has access to high-speed bandwidth Internet

   • Making sure that everyone gets the benefits of interoperability by providing the ability to granularly segment data instead of forcing individuals to choose blunt “all or none” privacy protections

   • Ensuring that every health care organization is connected to a Qualified Health Information Network (QHIN)

   • Making sure that every clinic has a patient portal that can be accessed using a mobile device

   Correct Answer: The correct answer is option b. Equitable interoperability ensures that all individuals receive the benefits of an interoperable health care ecosystem.

3. Which one of the following is not a deliverable of Shift?

   • Identify a steward to maintain a nationally available VSAC terminology value set for sensitive conditions

   • Build a consent management platform

   • Leverage a modified Delphi process to produce consensus-driven expert data segmentation implementation guidance regarding several complex issues related to patient safety, usability, and ethics

   • Advocate for a policy driver to advance widespread adoption of granular segmentation capabilities

   Correct Answer: The correct answer is option b. Shift is not developing a consent management platform but rather is building on existing technology to advance consent processes and granular segmentation of data.

4. How can I get more information about Shift or get involved in this work?

   • Visit http://www.shiftinterop.org

   • Obtain a certification through a health IT developer

   • Become a QHIN

   • Implement a certified EHR

   Correct Answer: The correct answer is option a. Information about Shift initiatives that are currently recruiting assistance is available at http://www.shiftinterop.org.

 

Scroll to top

 

Scroll to top

Conflict of Interest

C.S., M.S., C.P., and H.G. are all volunteer members of Shift; H.G. is Shift Board cochair. H.G. works for Cambridge Health Alliance, the nonprofit entity through which Shift funds are administered. C.S. is an employee of Sharecare; however, none of the work in this paper is based on his work or time there.

Protection of Human and Animal Subjects

No human or animal subjects were involved in this work.

• References

• 1 Federal Register. 21st century cures act information blocking final rule. National Archives; 2020. Accessed December 14, 2022 at: https://www.federalregister.gov/documents/2020/05/01/2020-07419/21st-century-cures-act-interoperability-information-blocking-and-the-onc-health-it-certification
• 2 Sinha S, Puttagunta R, Vodzak J. Interoperability and information-blocking rules: implications for pediatric and adolescent health care professionals. JAMA Pediatr 2021; 175 (10) 997-998
• 3 Morris JL, Rushwan H. Adolescent sexual and reproductive health: the global challenges. Int J Gynaecol Obstet 2015; 131 (suppl 1) S40-S42
• 4 Bearinger LH, Sieving RE, Ferguson J, Sharma V. Global perspectives on the sexual and reproductive health of adolescents: patterns, prevention, and potential. Lancet 2007; 369 (9568): 1220-1231
• 5 Alderman EM, Breuner CC. COMMITTEE ON ADOLESCENCE. Unique needs of the adolescent. Pediatrics 2019; 144 (06) e20193150
• 6 Jones RK, Purcell A, Singh S, Finer LB. Adolescents' reports of parental knowledge of adolescents' use of sexual health services and their reactions to mandated parental notification for prescription contraception. JAMA 2005; 293 (03) 340-348
• 7 Lindberg C, Lewis-Spruill C, Crownover R. Barriers to sexual and reproductive health care: urban male adolescents speak out. Issues Compr Pediatr Nurs 2006; 29 (02) 73-88
• 8 Klein JD, Wilson KM. Delivering quality care: adolescents' discussion of health risks with their providers. J Adolesc Health 2002; 30 (03) 190-195
• 9 Klein JD, McNulty M, Flatau CN. Adolescents' access to care: teenagers' self-reported use of services and perceived access to confidential care. Arch Pediatr Adolesc Med 1998; 152 (07) 676-682
• 10 Reddy DM, Fleming R, Swain C. Effect of mandatory parental notification on adolescent girls' use of sexual health care services. JAMA 2002; 288 (06) 710-714
• 11 Ginsburg KR, Slap GB, Cnaan A, Forke CM, Balsley CM, Rouselle DM. Adolescents' perceptions of factors affecting their decisions to seek health care. JAMA 1995; 273 (24) 1913-1918
• 12 Moreno MA, Ralston JD, Grossman DC. Adolescent access to online health services: perils and promise. J Adolesc Health 2009; 44 (03) 244-251
• 13 Tieu L, Sarkar U, Schillinger D. et al. Barriers and facilitators to online portal use among patients and caregivers in a safety net health care system: a qualitative study. J Med Internet Res 2015; 17 (12) e275
• 14 Stablein T, Loud KJ, DiCapua C, Anthony DL. The catch to confidentiality: the use of electronic health records in adolescent health care. J Adolesc Health 2018; 62 (05) 577-582
• 15 Summers D, Alpert I, Rousseau-Pierre T. et al. An exploration of the ethical, legal and developmental issues in the care of an adolescent patient. Mt Sinai J Med 2006; 73 (03) 592-595
• 16 Williams RL, Taylor JF. Four steps to preserving adolescent confidentiality in an electronic health environment. Curr Opin Obstet Gynecol 2016; 28 (05) 393-398
• 17 Wisk LE, Gray SH, Gooding HC. I thought you said this was confidential? Challenges to protecting privacy for teens and young adults. JAMA Pediatr 2018; 172 (03) 209-210
• 18 Bourgeois FC, Nigrin DJ, Harper MB. Preserving patient privacy and confidentiality in the era of personal health records. Pediatrics 2015; 135 (05) e1125 –e1127
• 19 Spear SJ, English A. Protecting confidentiality to safeguard adolescents' health: finding common ground. Contraception 2007; 76 (02) 73-76
• 20 Gray SH, Pasternak RH, Gooding HC. et al; Society for Adolescent Health and Medicine. Recommendations for electronic health record use for delivery of adolescent health care. J Adolesc Health 2014; 54 (04) 487-490
• 21 Anoshiravani A, Gaskin GL, Groshek MR, Kuelbs C, Longhurst CA. Special requirements for electronic medical records in adolescent medicine. J Adolesc Health 2012; 51 (05) 409-414
• 22 Spooner SA. Council on Clinical Information Technology, American Academy of Pediatrics. Special requirements of electronic health record systems in pediatrics. Pediatrics 2007; 119 (03) 631-637
• 23 Blythe MJ, Del Beccaro MA. Committee on Adolescence; Council on Clinical and Information Technology. Standards for health information technology to ensure adolescent privacy. Pediatrics 2012; 130 (05) 987-990
• 24 Diaz A, Neal WP, Nucci AT, Ludmer P, Bitterman J, Edwards S. Legal and ethical issues facing adolescent health care professionals. Mt Sinai J Med 2004; 71 (03) 181-185
• 25 Bourgeois FC, DesRoches CM, Bell SK. Ethical Challenges Raised by OpenNotes for Pediatric and Adolescent Patients. Pediatrics 2018; 141 (06) e20172745
• 26 Hutchinson JW, Stafford EM. Changing parental opinions about teen privacy through education. Pediatrics 2005; 116 (04) 966-971
• 27 Ancker JS, Sharko M, Hong M, Mitchell H, Wilcox L. Should parents see their teen's medical record? Asking about the effect on adolescent-doctor communication changes attitudes. J Am Med Inform Assoc 2018; 25 (12) 1593-1599
• 28 Kleiner KD, Akers R, Burke BL, Werner EJ. Parent and physician attitudes regarding electronic communication in pediatric practices. Pediatrics 2002; 109 (05) 740-744
• 29 Gaskin GL, Bruce J, Anoshiravani A. Understanding parent perspectives concerning adolescents' online access to personal health information. J Particip Med 2016; 8: e3
• 30 Vodicka E, Mejilla R, Leveille SG. et al. Online access to doctors' notes: patient concerns about privacy. J Med Internet Res 2013; 15 (09) e208
• 31 Steitz B, Cronin RM, Davis SE, Yan E, Jackson GP. Long-term patterns of patient portal use for pediatric patients at an academic medical center. Appl Clin Inform 2017; 8 (03) 779-793
• 32 Ip W, Yang S, Parker J. et al. Assessment of prevalence of adolescent patient portal account access by guardians. JAMA Netw Open 2021; 4 (09) e2124733
• 33 Sharko M, Wilcox L, Hong MK, Ancker JS. Variability in adolescent portal privacy features: how the unique privacy needs of the adolescent patient create a complex decision-making process. J Am Med Inform Assoc 2018; 25 (08) 1008-1017
• 34 Parsons CR. Inappropriate access to the adolescent patient portal and low rates of proxy account creation. JAMA Netw Open 2021; 4 (09) e2125251
• 35 Bergman DA, Brown NL, Wilson S. Teen use of a patient portal: a qualitative study of parent and teen attitudes. Perspect Health Inf Manag 2008; 5: 13
• 36 Jasik CB. Unlocking the potential of the patient portal for adolescent health. J Adolesc Health 2016; 58 (02) 123-124
• 37 Byczkowski TL, Munafo JK, Britto MT. Variation in use of internet-based patient portals by parents of children with chronic disease. Arch Pediatr Adolesc Med 2011; 165 (05) 405-411
• 38 Sharko M, Jameson R, Ancker JS, Krams L, Webber EC, Rosenbloom ST. State-by-state variability in adolescent privacy laws. Pediatrics 2022; 149 (06) e2021053458
• 39 Xie J, McPherson T, Powell A. et al. Ensuring adolescent patient portal confidentiality in the age of the cures act final rule. J Adolesc Health 2021; 69 (06) 933-939
• 40 Khanna RR, Murray SG, Wen T. et al. Protecting reproductive health information in the post-Roe era: interoperability strategies for healthcare institutions. J Am Med Inform Assoc 2022; 30 (01) 161-166
• 41 Clayton EW, Embí PJ, Malin BA. Dobbs and the future of health data privacy for patients and healthcare organizations. J Am Med Inform Assoc 2022; 30 (01) 155-160
• 42 Nayak MM, Revette A, Chai PR. et al. Medical cannabis-related stigma: cancer survivors' perspectives. J Cancer Surviv 2022;
• 43 Moreno A, Laoch A, Zasler ND. Changing the culture of neurodisability through language and sensitivity of providers: Creating a safe place for LGBTQIA+ people. . NeuroRehabilitation 2017; 41 (02) 375-393
• 44 Kolb K, Liu J, Jackman K. Stigma towards patients with mental illness: An online survey of United States nurses. Int J Ment Health Nurs 2023; 32 (01) 323-336
• 45 Schwarzlose RF. Superiority and stigma in modern psychology and neuroscience. Trends Cogn Sci 2023; 27 (01) 4-6
• 46 Soled KRS, Dimant OE, Tanguay J, Mukerjee R, Poteat T. Interdisciplinary clinicians' attitudes, challenges, and success strategies in providing care to transgender people: a qualitative descriptive study. BMC Health Serv Res 2022; 22 (01) 1134
• 47 Healy M, Richard A, Kidia K. How to reduce stigma and bias in clinical communication: a narrative review. J Gen Intern Med 2022; 37 (10) 2533-2540
• 48 Supreme Court of the United States. . Dobbs v. Jackson Women's Health Organization. Supreme Court of the United States; 2022. Accessed December 14, 2022 at: opinions 21pdf 19–1392_6j37.pdf https://www.supremecourt.gov
• 49 Office of the National Coordinator for Health Information Technology. . What Is Information Blocking and to Whom Does It Apply? Office of the National Coordinator for Health Information Technology. Accessed May 30, 2023 at: https://www.healthit.gov/topic/information-blocking#:~:text=What%20Is%20Information%20Blocking%20and,in%20an%20information%20blocking%20exception
• 50 Ford CA, Bourgeois F, Buckelew SM. et al. Twenty-first century cures act final rule and adolescent health care: Leadership Education in Adolescent Health (LEAH) Program experiences. J Adolesc Health 2021; 69 (06) 873-877
• 51 Carlson J, Goldstein R, Hoover K, Tyson N. NASPAG/SAHM Statement: The 21st Century Cures Act and Adolescent Confidentiality. J Adolesc Health 2021; 68 (02) 426-428
• 52 Pageler NM, Webber EC, Lund DP. Implications of the 21st Century Cures Act in Pediatrics. Pediatrics 2021; 147 (03) e2020034199
• 53 HL7. . HL7 Implementation Guide: Data Segmentation for Privacy (DS4P 14. Accessed December 14, 2022 at: https://www.hl7.org/implement/standards/product_brief.cfm?product_id=354
• 54 Bedgood M, Kuelbs CL, Jones VG, Pageler N. Organizational perspectives on technical capabilities and barriers related to pediatric data sharing and confidentiality. JAMA Netw Open 2022; 5 (07) e2219692
• 55 San Diego Health Connect. . ONC LEAP Computable Consent Project. Accessed December 14, 2022 at: https://sdhealthconnect.github.io/leap/
• 56 Stewards of Change Institute. . Modernizing consent to advance health and equity: a national survey of key technologies, legal issues and promising practices. Accessed December 14, 2022 at: https://stewardsofchange.org/13479-2/
• 57 Open ID. . What is the heart WG ? Accessed December 14, 2022 at: https://openid.net/wg/heart/
• 58 The Gravity Project. . The gravity project website; 2022. Accessed December 14, 2022 at: https://thegravityproject.net/overview/
• 59 Xie J, Hogan A, McPherson T, Pageler N, Lee TC, Carlson J. Adolescent privacy and the electronic health record - creating a guardrail system to ensure appropriate activation of adolescent portal accounts. Appl Clin Inform 2023; 14 (02) 258-268

Publication History

Received: 17 January 2023

Accepted: 19 April 2023

Article published online:
19 July 2023