Like other members of society, young adults age eighteen and up have typically expected and enjoyed privacy in their health care, not only from their families but also from the world at large. Yet, the Patient Protection and Affordable Care Act of 2010 (ACA) has inadvertently altered that expectation and enjoyment of privacy for young adults via a popular provision that requires some insurers to permit young adults up to age twenty-six to remain on their family's health plans (hereinafter Age 26 Provision). This Age 26 Provision has proven integral to reducing uninsured rates in a population that has historically struggled to obtain healthcare coverage. But being covered under a parent's health plan comes at a price: young adults' healthcare consumption becomes known to the parent or parents through Explanation of Benefits documents (EOBs).
EOBs perform several necessary functions by helping healthcare consumers to understand which healthcare services they have used and how much out-of-pocket expenses they may owe, while also deterring healthcare fraud. EOBs are directed to the policy holder on the insurance plan, typically the parent who purchased the plan or received it through his or her employer. These EOBs may expose young adults' private healthcare matters to their families, often against their wishes. Rebecca's story is indicative of the many kinds of medical information that young adults may want to keep private from their parents: mental health treatment, addiction recovery services, pregnancy, sexual assault examinations, treatment for sexually transmitted infections (STIs), or other sensitive health-related matters.
The privacy implications raised by the Age 26 Provision are not fully addressed by the Health Insurance Portability and Accountability Act (HIPAA) and other laws that guard medical privacy. HIPAA was drafted long before the Age 26 Provision, at a time when most young adults were envisioned to be on plans separate from their parents. The law contemplates that all adults, age eighteen and up, have the ability to control their information and to choose whether to keep it private from their families or to share it. With the Age 26 Provision, private healthcare information may regularly pass from insurer to parent, meaning that a whole group of young adults, age eighteen to twenty-six, will now experience frequent privacy breaches unanticipated by the law.
The right to have privacy in one's health care has long been recognized as critical to furthering the goals of healthcare access. The Age 26 Provision implicates these same concerns and must be studied for its effect on young peoples' access to sensitive medical care. But we argue that important questions may also be raised about the effect of the Age 26 Provision on young adults' autonomy and independence from their families and that these also merit further study. Age eighteen demarcates many important rights and responsibilities: going off to college, beginning full-time work, being able to vote, and the freedom and responsibility to make one's own medical decisions and to keep such decisions private. While healthcare decision-making and privacy may not be a celebrated event for many young people, family law theories and doctrines suggest that privacy in the family unit is a well-recognized way of developing and preserving autonomy in young adults. Family functions to cultivate autonomy, and then promotes it by, somewhat conversely, leaving the young adult free to make decisions apart from the parents. Thus parents help develop autonomy by first engaging, and then later, disengaging in their child's decision-making. Notably, the Age 26 Provision takes medical privacy out of reach for young adults at a critical time, when most young people have only just attained independence from their families and it places it back into the hands of parents--the very people from whom they have just gained this independence. The Age 26 Provision, in this way, may threaten young adults' identity, independence, and autonomy from their family. If this is true, then the Age 26 Provision needs further study to examine its impact on young adults--both on their liberty and on their conceptions of reaching adulthood and its rights and responsibilities.
Part I of this article discusses the purpose and background of the Age 26 Provision of the ACA, how it affects health privacy, and how the law falls short in protecting the privacy breaches caused by this mandate. Part II examines why health privacy matters in the context of the parent-child relationship, even in the case of young adults. This section suggests that the harm of eroding privacy for young adults may be to undercut their exercise of autonomy by permitting parental influence. The article ends suggesting that further research will be needed, not just to monitor the impact of the Age 26 Provision on young adults' access to sensitive medical care, but also to monitor how these privacy breaches affect their ability to make informed medical decisions and their preferences with respect to privacy in the family unit.
I. The ACA's Mandate to Provide Heath Insurance Coverage for Young Adults Under Age Twenty-Six
The ACA's Age 26 Provision fulfills significant health policy goals of increasing insured rates among eighteen-to-twenty-six-year-olds who are particularly vulnerable to being uninsured, and, in turn, the provision provides support for young adults' transition to economic independence. This provision may well be necessary to ensure young peoples' access to medical care. Yet, the Age 26 Provision comes at the expense of compromising young adults' healthcare privacy in the family unit.
A. Background of the ACA's Age 26 Provision
One of the ACA's more popular provisions, the Age 26 Provision, permits young adults to remain on a parent's health insurance plan until the age of twenty-six. Prior to the ACA, young adults only qualified for family insurance if they were dependent on the family in some way, typically up until age nineteen unless they were students and then only until they had completed an undergraduate degree. The Age 26 Provision of the ACA removes this dependency requirement. Young adults qualify for family benefits until they are twenty-six years old regardless of whether they are tax dependents, whether they live at home, whether they are students, or whether they are married.
The rationale behind this popular provision becomes clearer when one looks at historical uninsured rates of this group. Prior to the adoption of the ACA, young adults made up about one-fifth of the overall population of uninsured persons. One reason for the high uninsured rates was a growing inability to live financially independently from one's family until well into one's twenties, a situation that was made worse, perhaps, by economic recessions, low-wage jobs, and high educational debt. Other reasons include the inability to qualify for the types of positions that offer employee benefits or not yet being eligible for such benefits while pursuing education. Furthermore, some young people may act as "young invincibles," choosing not to purchase health insurance even if they can afford it because they do not perceive themselves as likely to need healthcare resources now or in the future.
The ACA's Age 26 Provision was motivated by a desire to reduce the overall uninsured rate and to help provide better access to health care for young adults, but this provision also brought these healthier young people into the insurance pool to offset the increasing costs associated with provisions that guaranteed access to care for older people and those with preexisting conditions (as mandated by other provisions of the ACA).
The Age 26 Provision has been successful in reducing uninsured rates among eighteen- to twenty-five-year-olds from 22.1% in 2013 to 14.5% in 2015. Large numbers of young people are on their parents' plans; one study suggests that nearly half of all young women are on a parent's plan. This is unsurprising given the problems this population has had with gaining insurance in the past, though it's important to note that young adults do not have to acquire their insurance through family plans. They are free to purchase insurance outright, though this can be costly, or they may acquire it through school or their employer. And insurance via a family plan may not be free for these young adults. Their family members may wind up paying higher premiums for family plans and may or may not ask the young adults to help cover those increased expenses. Given the historical uninsured rates among this group, it is unsurprising though that many may take advantage of the opportunity to remain on a family plan. Moreover, not everyone is eligible the benefits of this expansion. The Age 26 mandate only reaches private insurance plans, for example, plans that parents receive from their employer or by purchase on the federal and state insurance exchanges. Young adults are left to fend for themselves if their families receive health care via public programs like Medicare or Medicaid because their parents are disabled, elderly, or low-income.
While the ACA has been under significant political threat, the Age 26 Provision or something similar is likely to remain despite any future changes to the healthcare system. Many states had already acted to cover some young adults prior to the implementation of the ACA, and those state laws would likely stand even if the ACA or parts of it were repealed. Moreover, the Age 26 Provision remains highly popular with the public and both political parties. Prior to the most recent attempt to "repeal and replace" portions of the ACA, the House and Senate versions of changes left the Age 26 Provision intact. With the Age 26 Provision firmly embedded in the fabric of the healthcare system, it is important to consider its impact on health privacy for young adults.
B. How Does the ACA's Age 26 Provision Affect Health Privacy?
The extension of coverage of young adults into family plans up until age twenty-six has produced an unwanted side effect--the potential exposure of sensitive medical information to parents without young adults' permission. The culprit for this inadvertent parental disclosure of young adults' healthcare consumption is the EOB. When physicians provide services, they bill insurers, who then alert the policy holder of the plan, the parent. This process occurs, as mentioned above, with the permission of the patient who is receiving such services, usually accomplished through a standard waiver patients sign when they first visit the doctor's office. EOBs typically provide the name of the patient, the service rendered, the provider, and other basic information about the healthcare encounter.
EOBs are seen as necessary for a number of key reasons. First, they help to inform insureds about their level of healthcare consumption. This is an increasingly important function, as consumers are increasingly forced to buy plans that have high cost-sharing requirements. Savvy insureds will want to monitor how much of their deductible they have paid to determine whether they want to pursue an elective procedure or postpone it until the next benefit year. Second, they also may want to monitor total healthcare expenses to predict their most suitable plan for the next plan year. Third, and most importantly, they may have out-of-pocket expenses that they need to pay that the insurer will not cover.
EOBs are also widely assumed to be an important tool in reducing healthcare fraud. Consumers can monitor their plans and alert insurers to services that they did not actually seek. This is an important goal, given the longstanding loss of social resources through healthcare fraud, which is projected to cost the healthcare system between $10 billion and $100 billion annually.
However, EOBs can compromise medical privacy by permitting the policyholder of the insurance plan to discover which services were used by other members of the family plan. While this article focuses on the Age 26 Provision and its impact on young adults, EOBs have frequently been criticized in other contexts too--for instance, by exposing a wife's healthcare services to her husband, or even by exposing the whereabouts of a domestic violence victim to her abusive partner. Such disclosures are problematic, but we focus here on young adults because the exposure of large amounts of medical information of independent, young adults to their families is fairly novel and arguably presents issues that are different from or additional to those raised by the sharing of private information among other groups.
News articles are littered with examples like that of Rebecca, offered at the beginning of this article, about family members who learned about highly sensitive information. Suicide attempts, pregnancies, miscarriages, abortions, addiction, and mental health services have all been inadvertently shared with family members against the young adult's wishes or without their knowledge. While all healthcare information may be seen as sensitive, young adults are frequent users of services that are typically seen as highly sensitive. Early adulthood and college age is when many people begin their first sexual experiences and have their first pregnancies. This is also a time when mental health and addiction challenges can first appear. For example, young adults use mental health services at rates fifty percent higher than other age groups.
Moreover, this is likely the first time that many young adults are choosing their own healthcare providers, making their own appointments, and taking responsibility for their own general physical and mental well- being. In this process, many young adults place a high priority on privacy, especially with regard to their parents. Many may be unaware of the fact that EOBs will be sent to their parents. They may not wish for their parents to see what types of healthcare procedures they receive at all, or they may at least want advanced warning so they can be the one, rather than the insurer, to inform their family members about sensitive healthcare matters.
Some scholars and policymakers have advocated for changes to address the privacy challenges of the Age 26 Provision. For example, insurers could issue generic EOBs that provide billing codes instead of specific information about the types of services rendered while still offering some information on the expense of the service and who is responsible for paying it. This may help to combat fraud and notify the lead beneficiary of any financial responsibility, but it is an imperfect remedy, as the family is still being notified that some service occurred, which may prompt uncomfortable questioning by parents. Another option would be for young adults covered as dependents to be able to expressly give or withhold consent for the sending of information to the policyholder or they could be allowed to request that the information be sent directly to them instead of the policyholder. These options, however, do not completely further the goals of informing policyholders about outstanding balances or protecting against fraud, and policyholders arguably have a right to this information, as they are the ones with financial obligations to pay the premiums and other expenses.
Another alternative would be to minimize EOBs, for example, by not sending them unless entirely necessary. For example, currently under the ACA, preventive care services do not require copays or deductibles, so there is no need to inform policyholders about delivery of such services. The Health Information Technology for Clinical and Economic Health Act (HITECH), a statute governing healthcare privacy, has also required that information be kept private, where requested, if the services have been paid for out-of-pocket. However, there will still be many private and sensitive matters that are billable and that will go before parental eyes.
Educating both parents and young adults about the importance of privacy has also been examined as a potential means to reinforce the idea that confidential health provider visits are a key component in the transition to adulthood.
Though there are a number of proposals to improve privacy measures for young adults still on their parents' health plans, many of the solutions still pose some threat to privacy or they protect privacy so much that they remove any of the benefits of EOBs. Not only are there no easy solutions to the problems posed by EOBs, but the popularity of the Age 26 Provision itself and the failed attempts to repeal or replace the ACA in whole or in part suggests that it is very likely here to stay. A better understanding of why privacy is so important will be necessary to fully promote young adults' interests in this regard. The next section explores why health privacy is so important generally; after this discussion, the importance of health privacy in the context of parent-adult child relationships will be discussed.
C. Insufficient Legal Protections
Privacy rights in medical information have been codified in HIPAA. The Standards for Privacy of Individually Identifiable Health Information (Privacy Rule), issued by the Department of Health and Human Services (HHS), implement the HIPAA requirements. HIPAA is designed to protect consumers by allowing them to have greater access to their medical information and also to have greater control over privacy and who can or cannot access their medical information without their permission. HIPAA seeks to balance the increasing need for protecting the privacy of patient health information while not interfering with an individual's access to or quality of health care.
HIPAA provides some guidance about privacy of medical information in the family unit. Parents are typically able to access the protected health information (PHI) of their children until they reach the age of eighteen. A few exceptions exist; access is not permitted for example, if the minor is emancipated or if disclosure of the PHI could place the minor in risk of serious harm. Upon a child turning age eighteen, however, the parent is typically no longer entitled to access such information without the child's consent. HIPAA provides that PHI may only be disclosed to an individual's family or friends if the provider receives a patient's informal permission, and even then, only if the information is directly relevant to that person's involvement in the patient's care or payment for care. Thus, parents function as the guardians of their child's medical information until the child reaches the age of eighteen, at which point the young adult can choose whether to include family in medical decision-making or not.
The goal or expectation of HIPAA in this context is to enable young adults to be the keepers of their own medical privacy, but this goal is thwarted in practice by the Age 26 Provision and the sharing of health insurance between parent and child. While young adults may want to have complete privacy over their information, in reality, they typically sign blanket waivers that provide their consent to share medical information with insurers for the purpose of billing. In this way, patients like Rebecca do not typically realize that such information can then be passed on from insurer to family in the form of EOBs.
D. The Harms Resulting from Loss of Health Privacy
Individuals have a variety of interests in not having their medical information shared with both the broader society, and with their families. Privacy is necessary to guard the social and economic well-being of the individual. Negative health information can expose patients to discrimination in critical aspects of their lives. Their financial well- being, for example, may be at risk; disclosed healthcare information may jeopardize their efforts to gain and maintain employment, achieve valuable promotions, pursue an education, and get sufficient life and health insurance coverage. Privacy is also integral to protecting individuals from interpersonal harms. Individuals with negative health histories may face stigma in romantic and personal relationships. This can be true within the family unit, too, if family members stigmatize or judge a particular individual because of some aspect of his or her health history.
Privacy is also necessary to achieve public health goals of ensuring timely and adequate medical care. Because of the Hippocratic Oath, physicians have been honor-bound to keep the secrets of their patients. These protections are vital to ensure trusting and impactful relationships between patients and the medical establishment. A medical system that does not guarantee privacy may find its patients reluctant to seek out medical care at all or to divulge private matters that are critical for identifying and treating their medical conditions. This is in part because of the various social harms that one can suffer when medical information is widely known.
The affront to medical privacy by the Age 26 expansion may be producing such harms. The sharing of young adults' medical information with family may raise narrower concerns; presumably parents are not sharing such information with their children's employers or educators, for example. However, other harms are still possible in the parent-child context. At minimum, the Age 26 Provision and the threat of parents knowing one's health information could compromise young adults' willingness to seek medical care.
Early evidence suggests that young adults will go to extreme lengths to avoid loss of privacy. For example, they may avoid seeking health care altogether to keep privacy intact, defeating much of the purpose of the Age 26 mandate. Or, they may willingly pay out of pocket in order to avoid the insurance billing process if they can afford to do so. This may pose equity problems, leading poorer young adults to have greater exposure to privacy risks than their wealthier counterparts, and it may also lead to harmful and unproductive postponement or avoidance of necessary medical care. These young people may also turn to safety net clinics, which will not bill them but which are designed to serve the uninsured, not those with access to private insurance. Lastly, sympathetic providers may simply provide the services and not bill insurers, with the cost falling on either the provider or taxpayers if they handle these services as uncompensated care. Alternatively, young adults may be unaware that insurance comes with these privacy costs, and they may experience distress and surprise when family members are alerted to their sensitive healthcare information against their wishes.
All of these efforts by young adults to keep medical information private have consequences that run counter to the larger goals of the Age 26 mandate to reduce uninsured rates, improve access to care, and have young adults participate in the general insurance market. But they also demonstrate how the Age 26 Provision may compromise not just young adults' privacy but, relatedly, their autonomy in medical decision-making. Young adults, out of fear of parental knowledge or intervention, may avoid care or change the ways in which they seek it, subjugating their values and preferences to preserve their privacy. Given the progression of autonomy within the family unit toward the ultimate goal of developing independent young adults, family law principles do not necessarily directly address the regression that occurs when autonomous medical-decision making is threatened. But family law may help further explain the values at stake when young adults lose their medical privacy within the family unit.