One of the parents was Gregg Wolfe, owner of a court reporting and litigation support company in Pennsylvania, who told how his 21-year-old son, Justin, a college student, died of a heroin overdose in December.
“Though doctors knew since May 2011, no one in our family was aware that Justin was using heroin,” according to Wolfe's testimony (PDF) before the subcommittee on investigations and oversight of the House Energy and Commerce Committee. Wolfe said HIPAA was “valuable,” but added there was a “dire need to change the HIPAA law regarding minors and legally emancipated adults who either have a mental disorder, disability or drug and/or alcohol addiction.”
Since the Patient Protection and Affordable Care Act allows parents to retain health insurance coverage for their children until age 26, Wolfe asked that “an exception be added to HIPAA.” Wolfe would give parents access to their adult offspring's medical records if the child has a mental disorder or addiction and maintains legal residence in their parents' homes or lives under the auspices of their parents' care and insurance coverage.
Also testifying, Leon Rodriguez, head of the Office for Civil Rights at HHS (PDF), the chief HIPAA enforcement agency, said that unless the patient objects, healthcare information may be disclosed to parents if the patient is “not present or is incapacitated.” If the patient objects, the rule “respects an individual's wishes to the extent practical and appropriate. (According to Wolfe, his son took pains to hide his addiction from his parents.)
“The ability to assure individuals that their personal health information will remain private is particularly critical in the area of mental health care, where concerns around the negative attitudes associated with mental illnesses may affect individuals' willingness to seek needed treatment,” Rodriguez said.
But Rodriguez also said the law authorizes providers “to alert appropriate persons” if a patient “poses a serious an imminent threat to himself or herself, or to another person,” including a parent or another person “who are reasonably able to prevent the serious and imminent threat,” provided the disclosure is “consistent with applicable law and standards of ethical conduct.”
Providers still need “lots more guidance,” in clear language and “in places where people can find it” about what's allowable under HIPAA, said witness Deven McGraw, a lawyer who heads the Health Privacy Project at the Center for Democracy and Technology, a Washington think tank.
Follow Joseph Conn on Twitter: @MHJConn
