Confidentiality is almost universally accepted as a fundamental principle underlying the provision of health care. Nonetheless, the health insurance billing and claims processing procedures widely used today—notably the practice of sending "explanation of benefits" forms (EOBs) to a policyholder whenever care is provided under his or her policy—unintentionally but routinely violate this basic guarantee for anyone enrolled as a dependent on someone else’s policy. Although this may cause problems for any dependent seeking care, the issue may be especially acute for individuals seeking sensitive services, such as mental health, substance abuse and reproductive health care.

Already this breach of privacy impacts a huge swath of the population, including nearly all teens and the many young adults covered under their parents' policies, as well as the millions of married adults insured through their spouse. And, health care reform—both by increasing the number of insured individuals and potentially by broadening the group eligible to be covered as dependents—could greatly expand the size of the affected group. As a result, it is critical to develop payment methodologies that can preserve the integrity of the billing process while ensuring the provision of confidential care when needed.

A Fundamental Principle

With roots going back to the Hippocratic Oath itself, the obligation to assure confidentiality is one of the oldest codified moral commitments in health care. According to a 1983 statement by the congressionally mandated President's Commission for the Study of Ethical Problems in Medicine and Biomedical and Behavioral Research, respect for patients' privacy "is an important part of ethical health care practices, as well as the foundation on which a relationship of mutual trust and benefit can be built between patient and professional."

The American Medical Association's Code of Medical Ethics mandates that information disclosed to a physician in the course of the patient-physician relationship be held confidential "to the utmost degree." According to the AMA's Council on Ethical and Judicial Affairs, this guarantee is necessary "to allow the patient to feel free to make a full and frank disclosure of information," a dialogue that enables physicians to diagnose conditions properly and treat patients appropriately. This basic principle is repeated in the standards developed by the medical specialist associations whose members provide sensitive services, for which confidentiality is particularly critical: mental health professionals, obstetricians and gynecologists, and adolescent health care providers.

Federal law provides safeguards as well. Since the early 1970s, federal regulations have ensured that the medical records of anyone seeking federally funded substance abuse treatment will be considered confidential. More recently, the so-called privacy rule issued following the passage of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) established, for the first time, national standards for the protection of certain health information. This federal regulation seeks to assure that individuals' health information is properly protected, while allowing the flow of data needed for the delivery of high-quality health care. Finally, both the states and the federal government have long recognized the importance of ensuring access to confidential care for minors, at least under some circumstances (see box).

Exigencies of Payment

However venerated, these privacy guarantees may be at odds with the ability of health care providers to be compensated for the care they deliver. Accordingly, federal regulations permit providers to use protected health information to secure payment, provided that patients consent. As a result, patients are routinely asked to sign a consent form authorizing disclosure of necessary information "to obtain payment from insurance companies." Once that information goes to an insurer, disclosure is virtually inevitable—at least for individuals covered as a dependent on someone else's insurance policy.

This disclosure, it must be noted, does not stem from a nefarious desire to breach patients' privacy. Instead, it comes largely from attempts on the part of states and insurers to reduce insurance fraud and abuse. In fact, most states require insurers to inform policyholders of claims made for anyone covered under their policy. EOBs generally identify the recipient, provider and type of care obtained, as well as the total charge, the amount reimbursed by the insurer and any remaining financial obligation on the part of the policyholder.

States and insurers routinely exhort policyholders to review these forms carefully and alert insurers of any inaccuracies. According to the Blue Cross Blue Shield Association, reviewing EOBs "is a big step in preventing healthcare fraud and medical identity theft." However benign the motivation, the disclosure is nonetheless real, and essentially precludes confidentiality for the millions of Americans covered as dependents.

Who's Affected

Even now, a sizable group of Americans receive their health insurance through a family member's policy. Virtually all adolescents who have private health insurance are covered under a parent's policy. In 2005, fully half of all full-time college students were insured through a parent, as were nearly one in five 19–23-year-olds who were not students, according to the Commonwealth Fund. And, according to the Kaiser Family Foundation, 25% of adult women are insured as a dependent, compared with 13% of adult men.

Health care reform could significantly expand this group. First and foremost, it would expand coverage in general, and many newly insured individuals likely would be covered as dependents through either a parent or a spouse. More specifically, health care reform could significantly broaden the group of young adults eligible to be covered under a parent's policy. Provisions being discussed would extend eligibility for dependent coverage to many young adults who previously would have "aged out" of coverage through a parent. The legislation passed by the House of Representatives on November 7, as well as the bill approved by the Senate health committee, would extend the age limit for coverage as dependents through age 26, regardless of whether they are full-time students.

Extending the age limit for dependent coverage would be in line with the steps many states have been taking over the last 15 years. In 1994, Utah moved to allow coverage for unmarried dependents to continue up to age 26, regardless of school enrollment status. Since then, according to the National Conference of State Legislatures, 22 additional states have adopted similar provisions. But although expanding coverage has the potential to bring health care to millions, it would also grow the group inadvertently denied confidentiality.

Potential for Harm

The inability to access confidential services may have serious consequences. The absence of privacy may make a person less likely to seek substance abuse treatment or mental health services. According to the Family Violence Prevention Fund, a woman's safety may be threatened if an abusive spouse finds out that his victim has disclosed violence to a health care provider. (This may deepen a woman's reluctance to seek care for fear that health care providers might be obligated to file reports of potential intimate partner violence with law enforcement authorities.)

The potential for harm when it comes to reproductive health services is considerable. For example, someone who foregoes or even delays testing and treatment for STIs puts not only himself or herself at risk, but his or her partners as well. In addition, a pregnant woman who is concerned about telling her husband that she is pregnant may delay entry into prenatal care, with potentially serious consequences.

Fear of disclosure may lead many women to decline to use their insurance coverage to pay for an abortion. Lack of confidentiality under private insurance plans is tantamount to a de facto parental notification requirement, provisions clearly shown to create serious impediments for many teens. State laws that deny teens confidential abortion services delay access to the procedure, reducing safety and resulting in later, more costly abortions.

Privacy is certainly important when it comes to contraceptive services. Married women may not want their husbands to know about their contraceptive use. Moreover, the resulting specter of parental notification could have serious implications for teens. A nationwide study of adolescents attending family planning clinics found that 60% under 18 said their parents knew they used a clinic for sexual health services—typically because they had told parents themselves or their parents had suggested it. Among teens who said they had not already discussed their clinic visit with a parent, 70% said they would not seek family planning services and a quarter said they would have unsafe sex if they were unable to obtain confidential care.

In fact, national data show that many insured teens and young adults aged 20–24 already appear unwilling to use their insurance coverage to pay for their contraceptive care. According to a Guttmacher Institute analysis of data from the National Survey of Family Growth, only 68% of privately insured teens and 76% of privately insured young adults who obtained contraceptive services used their coverage to pay for their care, compared with 90% of insured women over 30.

Feeling that they are unable to use their coverage, teens and other dependents seeking contraceptive services often turn to publicly funded family planning centers from which affordable, confidential care is available. Although this can provide critical access to care, it does so at the price of putting an additional burden on already-stretched public dollars and placing a severe drain on the resources available under programs such as Title X. Insurers, meanwhile, are left to reap a windfall from having factored the cost of care into the premiums they charge without actually being asked to pay for the services delivered.

Possible Approaches

It is clear that the basic claims payment procedures commonly used by insurers conflict with the ability of individuals insured as dependents to obtain confidential care. Fortunately, however, several avenues for addressing the situation—drawing on the federal HIPAA law and implementing regulations, existing state Medicaid procedures, and current state laws and policies—can be explored.

Confidential communications under HIPAA. Under the privacy rule, the federal regulation implementing HIPAA, individuals have the right to request that insurers keep communications about their health care confidential. For a married person, this includes a request that information not be provided to spouse. For a minor lawfully obtaining health care on his or her own, this includes a request that information not be divulged to a parent. Plans are required to agree to a reasonable request for confidentiality if the person making the request states that disclosing the information would "endanger" him or her.

Significantly, the preamble to the rule initially promulgated to implement the statute made clear that this protection can be used to mitigate the threat posed by EOBs: "For example, if an individual requests that a health plan send explanations of benefits about particular services to the individual's work rather than home address because the individual is concerned that a member of the individual's household (e.g., the named insured) might read the explanation of benefits and become abusive towards the individual, the health plan must accommodate the request." Although this rule was subsequently revised and reissued, the later version made clear that changes were not being made to the provision on confidential communications.

The ultimate usefulness of this provision in providing access to confidential care for someone seeking reproductive health services will depend on an interpretation of "endanger" that would include the threat to a woman's health (such as through an inability to access contraceptive services, STI or HIV testing and treatment, or even prenatal care). It will also depend on ensuring that individuals are made aware that they have the right to request confidential communications, and insurers having clear procedures for individuals to exercise this right. Finally, insurers will need to extend this privacy protection to information made available on the Internet, since plans are increasingly relying on Web-based communication with policyholders rather than "snail mail."

Medicaid procedures. State Medicaid programs have been wrestling with these confidentiality issues over a considerable period of time. Moreover, they have given specific attention to the treatment of sensitive services, including family planning.

Federal regulations require that states have a method for verifying whether the services paid for by Medicaid were actually provided, but they do not specifically require that Medicaid managed care plans use EOBs (although they do require that enrollees be notified when claims are denied). In fact, a review of state Medicaid policies on EOBs conducted by the National Alliance to Advance Adolescent Health (formerly, Incenter Strategies) found that state policies vary: Some do not use EOBs at all, some send EOBs only when a claim is denied and some send EOBs monthly or quarterly, rather than every time care is obtained.

Significantly, many states expressly exclude information related to sensitive services received by Medicaid recipients, regardless of age, from EOBs. Of the 42 states whose policies were studied by the National Alliance to Advance Adolescent Health, 24 excluded information on family planning and 12 excluded information on STI services. The Minnesota Health Care Programs Provider Manual, for example, specifically requires that information on family planning "not appear on any explanations of medical benefits to the recipient or the recipient's family."

Specific state protections. States generally require insurers to provide policyholders with EOBs when services are provided under their policies. But some state requirements contain exceptions that might provide a pathway to confidential care for dependents when the patient pays any required copayment at the time of service and the balance of the provider's fee will be paid directly by the insurer, leaving the policyholder with no direct financial exposure. A directive from the New York State Insurance Department carves out an exception to the EOB requirement when reimbursement for the claim, aside from a copayment made at the time of service, goes directly from the insurer to the provider. Similarly, a fact sheet from the Wisconsin Insurance Commissioner says that EOBs are not required "if the insured has no liability for payment or is liable only for a copayment." For its part, CIGNA, a major national insurer, informs enrollees that "you will receive an EOB…only when you owe money beyond your normal copayment."

Most significantly, some states have specifically addressed the issue of ensuring confidentiality for dependents seeking medical care; these laws may be useful models for a comprehensive approach to the issue of providing confidentiality in the context of payment for medical care. Three states—Connecticut, Delaware and Florida—prohibit billing procedures from breaching confidentiality for minors seeking testing and treatment for STIs; Connecticut also specifically extends this protection to minors seeking testing and treatment for HIV/AIDS.

The wording of the laws is very similar across all three states: They require that information about the medical care obtained by the minor be kept confidential and not "divulged in any direct or indirect manner, such as sending a bill for services rendered to a parent or guardian." A fourth state, Wisconsin, provides similar protections for minors seeking inpatient care for substance abuse; in that case, the statute requires the physician or health care facility to obtain the minor's consent before billing a third party.

Next Steps

At the end of the day, few would begrudge health care providers the right to be compensated appropriately for the care they render, and all would agree that reducing fraud and abuse is a laudable goal. But, as the president's bioethics commission cautioned decades ago, when information about an individual's medical care is disclosed to a third party, "based upon a general consent by a patient (for example, permission for a hospital to send records to a third-party payor), no more information should be disclosed than is necessary for the functions to be performed by the third party."

Although walking this fine line will be difficult, current policy and practice offer potentially useful models for ways to move forward. An avenue based on one or an amalgam of these approaches must be found to ensure that dependents can obtain the confidential care that they need and that plan procedures, including the posting of information on plan Web sites, do not violate patients' privacy. Failure to do so will erect roadblocks for individuals needing services, continue to inflate insurer profits and exacerbate an already serious funding situation for safety-net providers that rely on scarce public resources.