adolescent privacy: solve this problem or i’ll text you · medical director, connexin...
TRANSCRIPT
1
Adolescent Privacy: Solve This Problem Or I’llText You
Session #75, March 6, 2018 2:30 PM
Susan J. Kressly, MD, FAAP
2
Susan J. Kressly, MD, FAAP
• In the past 12 months, I have had the following financial relationships with the manufacturer(s) of any commercial product(s) and/or provider(s) of commercial service(s):
Medical Director, Connexin Software/Office Practicum
• I do not intent to discuss an unapproved/investigative use of a commercial product/device in my presentation.
Conflict of Interest
3
Agenda• Frame the conversation using real adolescent case-based scenarios
• Review some examples of current implemented solutions
• Discuss one privacy solution and compare to current standards work
• Call to action
4
Learning Objectives• Identify unique challenges in adolescent privacy through case-
based examples
• Describe the implications of the current state of privacy functionality on the care of adolescents
• Discuss one approach to addressing adolescent privacy concerns with data management in the EHR
• Compare solutions within 2015 Edition Health IT Certification Criteria specifications to the entire spectrum of needed functionality and identify remaining gaps
• Formulate a call to action for appropriate stakeholders to solve this problem
5
Confessions of a Pediatrician…..
6
Audience Poll….
7
Text…..
Hey Dr. K……can you face time me?
My college roommate is really drunk and I think she’s breathing funny and I’m scared. You said I could always call you if I needed you.
I need you, can you FaceTime me?
8
Cell phone…..Hey Dr. K…..(from the bedroom closet so mom won’t hear because she is downstairs)
…..the condom broke….I forget what you told me to do?
9
In the office….Hey Dr. K…..I want to go on the pill.
My mom doesn’t know me and my boyfriend are having sex, and I’m not ready to tell her. Can you help?
….(BTW……the mom happens to be another provider in my practice)
HIPAA disclaimer: not my current practice
10
And more…• Can I text you a picture of this funny spot I have on my penis?
• My twin brother is selling my ADD meds.
• I know I have girl parts but I’m a boy.
11
Facetime from college..• A problem waiting for an innovator to solve
• Don’t have the patience to log on to a secure portal
• Don’t want to contact a remote telehealth provider whom they don’t know
• Want access to a trusted profession…easily, immediately
12
And the outcome?• Provide Healthcare
• Remove barriers
• Patient centered: meet them where they are
• Quick, easy, free
13
Adolescents and mHealth Apps
MAKE IT EASY!!!!
14
Adolescent calling from her closet• Send eRx?
– Data goes to pharmacy, who sends to payer which gets sent to parents via EOB
• Inside the office:
– Document the conversation & protect her privacy?
– Put on medication list?
– Gets sent to HIE, ACO, patient portal, record transfer
15
Responsible patient (parent = MD)• Part of a well visit
– Hide the whole visit? Billing staff needs to process the claim
– Who in the office should see except me?
• What about QI team?
– Will now show up in denominator for chlamydia screening metric
• Medication list?
– HIE, patient portal, ACO, etc……
16
Current Solutions• Hide everything to the outside world beginning at age 12, 13, 18?
• Stop information and communication unless teen signs their own release of information/consent?
• Remove patient portal functionality for all patients at age 12,13, 18?
17
Examples: State of Current Functionality• Providers can request HIM department to mark a specific note
confidential.
• Patient portal account remains active after the 12th birthday, but it is forever a snapshot of the day before the birthday. Parents can still send and receive messages but that is all. They can schedule appointments but not see them on the schedule. No clinical summaries, no “Open Notes,” no new lab results, immunizations, etc. All of the labs, vaccines and vital signs from before are still accessible.
18
Examples: State of Current Functionality• Patient portal: technically we could allow adolescents to have their
own portal access but our legal counsel is worried that parents would coerce their children to give them the passwords and we would be regularly breaching confidentiality, which would expose the organization to too much risk.
• At the 13th birthday the adolescent has to sign their own release of information. So if you are co-managing a child with a chronic disease like diabetes and getting reports from the endocrinologist, once the patient is 13 you don’t even get reports from specialists anymore unless the teen signs their own release of information
19
ACOG Position
https://www.acog.org/Resources-And-Publications/Committee-
Opinions/Committee-on-Adolescent-Health-Care/Adolescent-
Confidentiality-and-Electronic-Health-Records
20
AAP Policy
http://pediatrics.aappublications.org/content/pediatrics/130/5/987.full.p
df
21
Privacy: not just an adolescent problem• Adult children acting as healthcare proxy for their aging parents or
siblings
• Spouses having access in emergent scenarios
22
2015 Edition Certification Criteria• Data Segmentation for Privacy - Send (optional): Tags re-
disclosure limitations at the C-CDA document level.
• Data Segmentation for Privacy - Receive (optional): Allows EHR to receive C-CDA tagged with a non-disclosure and allow users to separate from other documents yet view it without having to incorporate any data from the document into the chart.
• Accounting of Disclosures (optional): Maintain a record of disclosures made for treatment, payment, and health care operations
23
That’s only the C-CDA, what else?• Data exchange through e-Rx (including new data elements such as
diagnosis)
• Lab results
• Data reporting to HIEs, ACOs, clinical data repositories
• Data reports pulling from sections of the database
• Chart transfers
• Claims information to payers which then shows up on EOBs/ERAs to families
24
C-CDA 2.1 Criteria
C-CDA Creation - allows for a confidentiality flag to be set at the section level.
25
Proposed Solution• Standards for tagging privacy at granular data element level
• Standards for staff “role” on privacy settings
• Allows for safer transfer of information
26
Granular Data Privacy Tagging• Problem
• Medication
• Allergy
• Lab order and result
• Counseling section of note
• Entire note
• Addenda
• Scanned documents
• Messages
• Consents
• Care Plans
• Referrals
27
Example of privacy levels• Any staff member (default)
• Clinical staff only
• Providers only
• Physicians only
• Author only
28
Difficult problems• How transmit claim if restrict note visibility to clinical staff only?
• If hide note, does it interfere with clinical decision support? (For example, if sensitive information in a well visit and you hide the note, does it also get removed from the care plan/clinical decision support for an annual well visit?)
• If restrict visibility of an entire note, and a “patient representative” is aware visit occurred (parent, healthcare proxy), does it raise questions? What about MU required patient exit notes?
29
Implementation Challenges• Should protected information be automatically displayed based on
the logged in user’s role or require a definitive end user action?
• Does it matter based on physical environment or device?
• How should you indicate to a user that there is some private information which has been specifically withheld? Should you?
30
Call to Action
Does our failure to solve privacy in data
capture & sharing, constitute data
blocking?
