Privacy & Security Tiger Team: Policy implementation issues regarding minors

1. Privacy & Security Tiger Team: Policy implementation issues regarding minors June 23, 2014

2. Agenda • De-brief on HITPC re: recommendations on DS4P • Review background on minors under the HIPAA Privacy Rule • Minors and personal representatives • Exceptions to HIPAA Privacy Rule • Discretion to covered entities • 42 CFR Part 2 re: minors • State variations in ages of consent for treatment • Review previous public comments on minors • Discuss framing of policy implementation issues regarding minors Office of the National Coordinator for Health Information Technology

3. Minors and Personal Representatives Under the Privacy Rule • With respect to general treatment situations, a parent, guardian, or other person acting in loco parentis (in place of the parent) usually is the personal representative of the minor child, and a health care provider is permitted to share patient information with a patient’s personal representative under the Privacy Rule. HIPAA Privacy Rule and Sharing Information Related to Mental Health, http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/mhguidance.html Office of the National Coordinator for Health Information Technology

4. Exceptions to Parents as Personal Representatives (1 of 2) • The HIPAA Privacy Rule provides that the parent is not the minor’s personal representative in the following three circumstances: • when state or other law does not require the consent of a parent or other person before a minor can obtain a particular health care service, and the minor consents to the health care service; • when a court determines or other law authorizes someone other than the parent to make treatment decisions for a minor; or • when a parent agrees to a confidential relationship between the minor and the health care provider. Privacy and Security Solutions for Interoperable Health Information Exchange, 2009, http://www.healthit.gov/sites/default/files/290-05-0015-state-law-access-report-1.pdf Office of the National Coordinator for Health Information Technology

5. Exceptions to Parents as Personal Representatives (2 of 2) • When a minor obtains health care services under any of these three exceptions, the minor generally has the authority to control the health information related to such services. • This does not mean that the minor has total control over this health information. • For example, a covered entity is permitted to disclose to a parent, or provide the parent with access to, a minor child’s PHI when and to the extent it is expressly permitted or required by State or other laws—regardless of whether the parent is a personal rep. Privacy and Security Solutions for Interoperable Health Information Exchange, 2009, http://www.healthit.gov/sites/default/files/290-05-0015-state-law-access-report-1.pdf Office of the National Coordinator for Health Information Technology

6. Discretion to Covered Entities Regarding Minors • In cases in which State or other applicable law is silent concerning disclosing a minor’s protected health information to a parent, and the parent is not the personal representative of the minor child based on one of the exceptional circumstances, a covered entity has discretion to provide or deny a parent access to the minor’s health information, if doing so is consistent with State or other applicable law, and the decision is made by a licensed health care professional in the exercise of professional judgment. • Under the Privacy Rule, a provider is permitted to share a patient’s health information with friends and family aiding in their care, if the patient does not object. There are no special provisions re: minors and thus, providers may share a minor’s health information with friends and family, including parents, even if the minor has the right to consent to treatment under State law—provided that the minor does not object. HIPAA Privacy Rule and Sharing Information Related to Mental Health, http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/mhguidance.html See also back-up slides on 42 CFR Part 2 provisions regarding minors Office of the National Coordinator for Health Information Technology

7. 42 CFR Part 2 re: Minors (1 of 2) • If a minor patient acting alone has the legal capacity under the applicable State law to apply for and obtain alcohol or drug abuse treatment: • any written consent for disclosure may be given only by the minor patient • includes, but is not limited to, any disclosure of patient identifying information to the parent or guardian of a minor patient for the purpose of obtaining financial reimbursement. U.S Government Printing Office, Code of Federal Regulations. http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr;sid=1bf6dac6a8cae994fda789471d9c3408;rgn=div5;view=text;node=42%3A1.0.1.1.2;idno=42;cc=ecfr#42:1.0.1.1.2.2.1.4 Office of the National Coordinator for Health Information Technology

8. 42 CFR Part 2 re: Minors (2 of 2) • Where State law requires consent of a parent, guardian, or other person for a minor to obtain alcohol or drug abuse treatment: • Any written consent for disclosuremust be given by both the minor and their parent, guardian, or other person authorized under State law to act in the minor’s behalf. • The fact of a minor’s application for treatment may be communicated to the minor’s parent, guardian, or other person authorized under State law to act in the minor’s behalf only if: • The minor has given written consent to the disclosure or • The minor lacks the capacity to make a rational choice regarding such consent as judged by the program director Note: Additional detail in backup. U.S Government Printing Office, Code of Federal Regulations. http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr;sid=1bf6dac6a8cae994fda789471d9c3408;rgn=div5;view=text;node=42%3A1.0.1.1.2;idno=42;cc=ecfr#42:1.0.1.1.2.2.1.4 Office of the National Coordinator for Health Information Technology

9. Age of Consent for Treatment Variations • The age at which a person may lawfully consent to care varies with the health condition at issue. • Minors in all states have the right to consent to testing and treatment for a sexually transmitted disease (STD). • In many states, minors also have the right to consent to: • Outpatient treatment for mental health issues; • Prenatal care; • Contraceptive services; and/or • Alcohol and substance abuse. • The age of consent for these various conditions may vary not only among states, but also within a given state. For example, in one state the age of consent is 12 years for treatment for an STD and 14 years for substance abuse. See back-up slides for age at which person may generally consent to healthcare Privacy and Security Solutions for Interoperable Health Information Exchange, 2009, http://www.healthit.gov/sites/default/files/290-05-0015-state-law-access-report-1.pdf California HealthCare Foundation, Manatt Health Solutions, January 2013. http://www.chcf.org/~/media/MEDIA%20LIBRARY%20Files/PDF/P/PDF%20PrivacyPleaseHealthConsentMinors.pdf Office of the National Coordinator for Health Information Technology

10. Previous Public Comments on Minors (1 of 2) • Health IT Buzz Blog Post: “Seeking Your Input: Personal Representatives and V, D, & T” • Posted on 2/3/2014 • Comments on minors focused on the following themes: • Pediatric Patients: Concern that there must be automatic shut-off of records once patient reaches 18; mistakes in accidental disclosure are a risk, otherwise. • Adult Children: Individuals 18+ who are still included on the insurance of their parents (up to age 26). • Custodial Challenges: Which parent should have access to the children’s patient portals in the event of divorce (discussion of legal vs. physical custody)? • Health IT Buzz Blog Comments, 2014, http://www.healthit.gov/buzz-blog/privacy-and-security-of-ehrs/seeking-input-personal-representatives/ Office of the National Coordinator for Health Information Technology

11. Previous Public Comments on Minors (2 of 2) • Themes Continued: • EHR Vendor Limitations: Perception that few vendors have set up the record to allow for granular control to protect parental access to labs, appointments, provider notes and medications • Exceptions: How to segregate PHI for the following cases: • A minor female for all health information related to birth control and abortion or a pregnancy, • A minor for all information related to sexually transmitted disease • A minor over the age of 12 who independently seeks mental health care, for all information related to that care • A minor for information related to treatment for alcohol or drug abuse. • Health IT Buzz Blog Comments, 2014, http://www.healthit.gov/buzz-blog/privacy-and-security-of-ehrs/seeking-input-personal-representatives/ Office of the National Coordinator for Health Information Technology

12. Framing Policy Issues for Minors : Scope • Focus on children and teens under 18 years old; adults were addressed separately • Possible use cases for focus: • access to PHI through Stage 2 view/download/transmit capability • re-disclosure issues resulting from provider-to-provider health information exchange (eg, transitions of care, other use cases)" • related regulations such as Title X and FERPA • Others? Office of the National Coordinator for Health Information Technology

13. Back-Up Slides Office of the National Coordinator for Health Information Technology

14. Age at Which Person May Generally Consent to Healthcare Treatment* 1 2 3 4 (1) Age of majority is 19. Minors 14 and older may consent to any medical, dental, or mental health service. (2) Age of majority is 18. Minors 15 and older may consent to hospital care, medical, dental, or surgical diagnosis, or treatment. (3) Age of majority is 18. Minors 16 and older may consent to all health services other than operations. (4) ) Mississippi: General age of majority is 21. Persons 18 or older are considered adults for consenting to health care services; Pennsylvania: Age of majority is 21. Minors 18 and older may consent to medical, dental, and health services; Puerto Rico: Persons 18 and older may consent for mental health and substance abuse treatment. *Information known as of 2009. Privacy and Security Solutions for Interoperable Health Information Exchange, 2009, Appendix A8a, http://www.healthit.gov/sites/default/files/appa8-1.pdf Additional ages of consent for various health conditions can be found in back up. Office of the National Coordinator for Health Information Technology

15. Previous Recommendations: Personal Representatives, Family & Friends • When a patient makes a request for VDT access for a friend or family member, the Tiger Team recommends the following best practices: • The provider should have the ability to fulfill the request either in person or remotely (for example, over the phone, through VDT if that functionality is provided, via e-mail, etc.) • Providers should document the request (the capability to store this documentation electronically would be helpful). • Out-of-band notification can be used to notify/confirm changes in VDT access with patients. This is particularly important when a patient’s request for proxy access is made remotely or through software acting on the patient’s behalf. HITPC Transmittal Letter, June 10, 2014. http://www.healthit.gov/facas/sites/faca/files/PSTT_personal_reps_VDT_Transmittal%20Letter_2014-06-10_01.pdf Office of the National Coordinator for Health Information Technology

16. Previous Recommendations: Personal Representatives, Family & Friends (2) • When a friend or family members makes the request for VDT access, access must be confirmed with the patient, such as through out-of-band confirmation. If the patient is incapacitated, the provider will need to consider whether providing access to VDT is appropriate; it should be remembered that HIPAA permits the sharing of information with friends or family in such a case, but the information that can be shared is limited to that which is relevant to treatment. HITPC Transmittal Letter, June 10, 2014. http://www.healthit.gov/facas/sites/faca/files/PSTT_personal_reps_VDT_Transmittal%20Letter_2014-06-10_01.pdf Office of the National Coordinator for Health Information Technology

17. Previous Recommendations: Personal Representatives, Family & Friends (3) • ONC should disseminate best practices to providers, to help them to establish (and turn off) proxy access to VDT accounts consistent with the law and patient needs. This includes: • planning for scenarios such as a patient’s change in preference, • change in personal representative status, or • the patient’s death—In which event, some proxy access should be restricted or disabled, for example, the proxy’s ability to fill prescriptions. • ONC’s VDT proxy access educational materials should be developed in a way that is broadly applicable to providers and other office staff who may play a role in informing patients about the benefits/risks of proxy access or in managing patient proxy access. HITPC Transmittal Letter, June 10, 2014. http://www.healthit.gov/facas/sites/faca/files/PSTT_personal_reps_VDT_Transmittal%20Letter_2014-06-10_01.pdf Office of the National Coordinator for Health Information Technology

18. Previous Recommendations: Personal Representatives, Family & Friends (4) • Providers should educate their patients on the risks and benefits of VDT, consistent with the HITPC’s prior recommendations, and such education should include: • the risks/benefits of proxy access, • what information is accessible to friends and family (e.g., family history), and • what functions are available to friends and family in the portal, including (if applicable) download and transmit. • Given the enormity of the task of educating patients, ONC may also want to consider using available communications channels—such as publicly available videos—to educate patients on the benefits and risks of permitting proxy access. HITPC Transmittal Letter, June 10, 2014. http://www.healthit.gov/facas/sites/faca/files/PSTT_personal_reps_VDT_Transmittal%20Letter_2014-06-10_01.pdf Office of the National Coordinator for Health Information Technology

19. Additional FAQs on Minors • As a general rule, parents have the right of access to the medical records of their minor children. • The issue becomes more complicated when the minor lawfully consents to his or her own treatment. • When this is the case, the HIPAA Privacy Rule defers to state law as to whether a health care provider may or may not notify parents of such treatment and whether the parents have right of access to the medical records associated with such treatment. • State law in this area varies greatly regarding the conditions under which a minor may consent to his or her own health care and whether the health care provider may notify the parents of such treatment. Privacy and Security Solutions for Interoperable Health Information Exchange, 2009, http://www.healthit.gov/sites/default/files/290-05-0015-state-law-access-report-1.pdf Office of the National Coordinator for Health Information Technology

20. Additional FAQs on Minors (2) • Regardless of whether the parent is otherwise considered a personal representative, the Privacy Rule defers to State or other applicable laws that expressly address the ability of the parent to obtain health information about the minor child. In doing so, the Privacy Rule permits a covered entity to disclose to a parent, or provide the parent with access to, a minor child’s protected health information when and to the extent it is permitted or required by State or other laws (including relevant case law). • Likewise, the Privacy Rule prohibits a covered entity from disclosing a minor child’s protected health information to a parent when and to the extent it is prohibited under State or other laws (including relevant case law). See 45 CFR 164.502(g)(3)(ii). See 42 USC § 290dd–2; 42 CFR 2.11, et. seq. HIPAA Privacy Rule and Sharing Information Related to Mental Health, http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/mhguidance.html Office of the National Coordinator for Health Information Technology

21. Additional FAQs on Minors (3) • Does a parent have a right to receive a copy of psychotherapy notes about a child’s mental health treatment? • No. The Privacy Rule distinguishes between mental health information in a mental health professional’s private notes and that contained in the medical record. It does not provide a right of access to psychotherapy notes, which the Privacy Rule defines as notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or a group, joint, or family counseling session and that are separate from the rest of the patient’s medical record. See 45 CFR 164.501. Psychotherapy notes are primarily for personal use by the treating professional and generally are not disclosed for other purposes. Thus, the Privacy Rule includes an exception to an individual’s (or personal representative’s) right of access for psychotherapy notes. See 45 CFR 164.524(a)(1)(i). • However, parents generally are the personal representatives of their minor child and, as such, are able to receive a copy of their child’s mental health information contained in the medical record, including information about diagnosis, symptoms, treatment plans, etc. Further, although the Privacy Rule does not provide a right for a patient or personal representative to access psychotherapy notes regarding the patient, HIPAA generally gives providers discretion to disclose the individual’s own protected health information (including psychotherapy notes) directly to the individual or the individual’s personal representative. As any such disclosure is purely permissive under the Privacy Rule, mental health providers should consult applicable State law for any prohibitions or conditions before making such disclosures. HIPAA Privacy Rule and Sharing Information Related to Mental Health, http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/mhguidance.html Office of the National Coordinator for Health Information Technology

22. Information on Children’s EHR Format Initiative • In 2013, the Agency for Healthcare Research and Quality announced an EHR format intended to improve pediatric care “by guiding EHR developers to understand the types of information that should be included in EHRs for children.” New Children's Electronic Health Record Format Announced . February 2013. Agency for Healthcare Research and Quality, Rockville, MD. http://www.ahrq.gov/news/newsroom/press-releases/2013/childehrpr.html Office of the National Coordinator for Health Information Technology

23. 42 CFR Part 2 Provisions Regarding Minors • §2.14   Minor Patients • Definition of minor: Aperson who has not attained the age of majority specified in the applicable State law, or if no age of majority is specified in the applicable State law, the age of eighteen years. • State law not requiring parental consent to treatment: If a minor patient acting alone has the legal capacity under the applicable State law to apply for and obtain alcohol or drug abuse treatment, any written consent for disclosure authorized under subpart C of these regulations may be given only by the minor patient. • This restriction includes, but is not limited to, any disclosure of patient identifying information to the parent or guardian of a minor patient for the purpose of obtaining financial reimbursement. • These regulations do not prohibit a program from refusing to provide treatment until the minor patient consents to the disclosure necessary to obtain reimbursement, but refusal to provide treatment may be prohibited under a State or local law requiring the program to furnish the service irrespective of ability to pay. U.S Government Printing Office, Code of Federal Regulations. http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr;sid=1bf6dac6a8cae994fda789471d9c3408;rgn=div5;view=text;node=42%3A1.0.1.1.2;idno=42;cc=ecfr#42:1.0.1.1.2.2.1.4 Office of the National Coordinator for Health Information Technology

24. 42 CFR Part 2 Provisions Regarding Minors (2) • §2.14   Minor Patients • State law requiring parental consent to treatment: • Where State law requires consent of a parent, guardian, or other person for a minor to obtain alcohol or drug abuse treatment, any written consent for disclosure authorized under subpart C of these regulations must be given by both the minor and his or her parent, guardian, or other person authorized under State law to act in the minor's behalf. • Where State law requires parental consent to treatment the fact of a minor's application for treatment may be communicated to the minor's parent, guardian, or other person authorized under State law to act in the minor's behalf only if: • (i) The minor has given written consent to the disclosure in accordance with subpart C of these regulations or • (ii) The minor lacks the capacity to make a rational choice regarding such consent as judged by the program director under paragraph (d) of this section. U.S Government Printing Office, Code of Federal Regulations. http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr;sid=1bf6dac6a8cae994fda789471d9c3408;rgn=div5;view=text;node=42%3A1.0.1.1.2;idno=42;cc=ecfr#42:1.0.1.1.2.2.1.4 Office of the National Coordinator for Health Information Technology

25. 42 CFR Part 2 Provisions Regarding Minors (3) • §2.14   Minor Patients • Minor applicant for services lacks capacity for rational choice: Facts relevant to reducing a threat to the life or physical well being of the applicant or any other individual may be disclosed to the parent, guardian, or other person authorized under State law to act in the minor's behalf if the program director judges that: • A minor applicant for services lacks capacity because of extreme youth or mental or physical condition to make a rational decision on whether to consent to a disclosure under subpart C of these regulations to his or her parent, guardian, or other person authorized under State law to act in the minor's behalf, and • The applicant's situation poses a substantial threat to the life or physical well being of the applicant or any other individual which may be reduced by communicating relevant facts to the minor's parent, guardian, or other person authorized under State law to act in the minor's behalf. U.S Government Printing Office, Code of Federal Regulations. http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr;sid=1bf6dac6a8cae994fda789471d9c3408;rgn=div5;view=text;node=42%3A1.0.1.1.2;idno=42;cc=ecfr#42:1.0.1.1.2.2.1.4 Office of the National Coordinator for Health Information Technology

26. Minimum Age for MU Requirements • Commenters suggested that patients under the age of 18 should not have access to the same information to which adult patients have access and requested a separate list of required elements for patients under the age of 18. • Response: An EP may decide that online access is not appropriate forum for certain health information for patients under the age of 18. Within the confines of the laws governing guardian access to medical record for patients under the age of 18, we would defer to the EP’s judgment regarding which information should be withheld for such patients. In lieu of providing online access to patients under the age of 18, EPs could provide online access to guardians for patients under the age of 18, in accordance with state and local laws, in order to meet the measure of this objective. Public Comment on EP Meaningful Use Core Measures, 2013: http://www.citizensmemorial.com/_common/workfiles/infocare-network/meaningful-use/Electronic%20Access%20EP%20Comments.pdf See also: http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/downloads/Stage2_EPCore_7_PatientElectronicAccess.pdf Office of the National Coordinator for Health Information Technology

27. Family Educational Rights and Privacy Act • The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. • FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students." U.S. Department of Education. http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html Office of the National Coordinator for Health Information Technology

28. Family Educational Rights and Privacy Act (2) • Parents or eligible students have the right to inspect and review the student's education records maintained by the school. • Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. • Schools may charge a fee for copies. • Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. • If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. • After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information. U.S. Department of Education. http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html Office of the National Coordinator for Health Information Technology

29. Family Educational Rights and Privacy Act (3) • Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31): • School officials with legitimate educational interest; • Other schools to which a student is transferring; • Specified officials for audit or evaluation purposes; • Appropriate parties in connection with financial aid to a student; • Organizations conducting certain studies for or on behalf of the school; • Accrediting organizations; • To comply with a judicial order or lawfully issued subpoena;  • Appropriate officials in cases of health and safety emergencies; and • State and local authorities, within a juvenile justice system, pursuant to specific State law. U.S. Department of Education. http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html Office of the National Coordinator for Health Information Technology

30. Title X Family Planning Program • Title X is a federal grant program dedicated solely to providing individuals with comprehensive family planning and related preventive health services • Consent & Confidentiality with Title X Services • Federal regulations require that Title X-funded services be made available to all adolescents, regardless of age. Courts have held that this means minors of any age may consent to services when funded in full or in part by Title X. Title X services cannot be conditioned on parental consent or notification. • Title X regulations require that Title X-funded providers keep confidential “all information as to personal facts and circumstances [about patients] obtained by the project staff.” Release requires a patient’s written authorization. National Center for Youth Law, 2011. http://www.youthlaw.org/publications/yln/2011/jan_mar_2011/the_federal_title_x_family_planning_program_privacy_and_access_rules_for_adolescents/ See also: 42 C.F.R. § 59.11. http://www.gpo.gov/fdsys/pkg/CFR-2007-title42-vol1/pdf/CFR-2007-title42-vol1-sec59-11.pdf Office of the National Coordinator for Health Information Technology

31. ONC Work Regarding Minors • NoMoreClipBoard, an ONC sponsored project, presents a HIE use case regarding minors: “We determined that as a minor patient approaches the age of thirteen, we must obtain consent from both the parent and the minor to allow information from the HIE to continue to flow,” said Short. “We developed very specific consent language for both the parent or guardian and the minor, and absent that consent, we advised that access to health information should be cut off at age 13.” NoMoreClipboardbegan working on modifications to its platform to support this approach. “We recognized that the health information of most minor children is managed by their parents, and NoMoreClipboardsupports multiple family members in a single PHR account,” said Donnell. NoMoreClipboardwill begin sending emails to the primary account holder a few months in advance of the minor’s thirteenth birthday, notifying them that additional consent is required to ensure the ongoing flow of HIE information. That consent is collected electronically from both the parent and the minor child within the PHR. In the event that consent is not obtained prior to the birth date, a message will be sent to HealthBridge indicating that data for the minor should no longer be made available, leveraging a “shut-off valve” feature put in place as part of the overall project architecture. Case Study: Identification, Authentication, and Matching to Support Consumer Access to HIE Data, 2013. https://www.nomoreclipboard.com/wiki/images/a/ac/NMC_Case_Study_MMCH.pdf Office of the National Coordinator for Health Information Technology

32. State Laws Granting Minors the Right to Consent Without Parental Permission • A-8a. Overview: State Laws Expressly Granting Minors the Right to Consent to Health Care without Parental Permission and Addressing Disclosure of Related Health Information to Parents—Sexually Transmitted Disease and HIV/AIDS • A-8b. Overview: State Laws Expressly Granting Minors the Right to Consent to Health Care without Parental Permission and Addressing Disclosure of Related Health Information to Parents—Outpatient Mental Health • A-8c. Overview: State Laws Expressly Granting Minors the Right to Consent to Health Care without Parental Permission and Addressing Disclosure of Related Health Information to Parents—Outpatient Alcohol and Substance Abuse • A-9a. State Laws Expressly Granting Minors the Right to Consent to Health Care without Parental Permission and Addressing Disclosure of Related Health Information to Parents Based on Life Circumstances or Status • A-9b. State Laws Expressly Granting Minors the Right to Consent to Health Care without Parental Permission and Addressing Disclosure of Related Health Information to Parents Based on Sexually Transmitted Disease and HIV/AIDS • A-9c. State Laws Expressly Granting Minors the Right to Consent to Health Care without Parental Permission and Addressing Disclosure of Related Health Information to Parents Based on Outpatient Mental Health • A-9d. State Laws Expressly Granting Minors the Right to Consent to Health Care without Parental Permission and Addressing Disclosure of Related Health Information to Parents Based on Outpatient Alcohol and Substance Abuse Privacy and Security Solutions for Interoperable Health Information Exchange, 2009, http://www.healthit.gov/sites/default/files/290-05-0015-state-law-access-report-1.pdf Office of the National Coordinator for Health Information Technology