From Medscape Medical News

American Academy of Pediatrics Issues Policy Statement on HIPAA and Child Abuse

Fran Lowry

December 22, 2009 — The Committee on Child Abuse and Neglect of the American Academy of Pediatrics has issued a new policy statement to guide pediatricians through the federal Health Insurance Portability and Accountability Act (HIPAA) regulations regarding their responsibilities in releasing or reviewing patient health information without knowledge or consent when child abuse or neglect is suspected.

The policy statement, which recommends that pediatricians become familiar with their state laws and HIPAA regulations, appears in the January issue of Pediatrics and was published online December 21.

The committee writes that HIPAA has significantly affected clinical practice, particularly with regard to how patient information is shared. It addresses the security and privacy of patient health data to ensure that information is released appropriately and with patient or guardian consent and knowledge.

However, HIPAA permits disclosure of information without the consent of a legal guardian in matters that relate to abuse, neglect, public health, and safety of children.

All states mandate that physicians report suspected cases of abuse or neglect to the appropriate agencies, which in most states include child protective services and law enforcement agencies.

The committee recommends that pediatricians become familiar with their state laws in this regard and for them to also know when HIPAA or state laws take precedence. They should know which agencies are authorized to receive and investigate reports of child abuse and the laws that govern release of protected health information after investigation.

Highlights of the recommendations include the following:

• The pediatrician must report and may disclose a child’s protected health information to child protective services and law enforcement agencies without parental consent.
• When abuse has been reported and is being investigated, the pediatrician may disclose information to appropriate investigative agencies without notifying the parent, or without the parent’s consent.
• The pediatrician must try to inform the parent that such disclosures have been made, unless doing so could endanger the child.
• The pediatrician must recognize situations that require disclosure of information immediately, and in which delay might jeopardize the child’s safety.
• The pediatrician can withhold the child’s information from the parent if the parent is the abuser, or if the parent is protective of a suspected abuser.

The American Academy of Pediatrics has developed a HIPAA tool kit for medical practices with regard to HIPAA rules. This tool kit can be found on their Web site.

Pediatrics. Published online December 21, 2009.