Organizational Perspectives on Technical Capabilities and Barriers Related to Pediatric Data Sharing and Confidentiality.

Introduction

Based on the Information Blocking Final Rule of the 21st Century Cures Act, the Office of the National Coordinator for Health Information Technology mandated that patients have immediate and electronic access to portions of their medical data.[1] In pediatric care, distinct challenges to information sharing include the intertwined nature of maternal and newborn birth history, medical child abuse, differential proxy access for guardians of children, and varying state laws on adolescent consent and confidentiality rights.[2,3,4]

To address the challenges of pediatric data sharing, pediatric informaticists within the state of California created a statewide pediatric work group called the California Pediatric Informatics Collaborative. This research letter describes the formation and activities of this work group and provides results from a semistructured interview investigating final decisions of participating health care organizations, their technical capabilities, and barriers to implementation.

Methods

This qualitative study conducted semistructured interviews via video teleconference between April 7 and September 30, 2021. The study was approved by Stanford University with a waiver of informed consent because it was considered non–human participant research. This study followed the Standards for Reporting Qualitative Research (SRQR) reporting guideline for qualitative studies.

The California Pediatric Informatics Collaborative comprises 16 organizations that provide care to children and adolescents. The unified goal of the work group is to develop strategies to share pediatric health data with patients and their proxies while appropriately protecting patient confidentiality per state minor consent laws.[5,6] The work group met monthly using a semistructured open forum that included presentations by individual members who elaborated on innovative methods for electronic sharing of information.

One of the authors (M.B.) conducted the interviews and performed the data analysis. Questions were divided into general topics regarding portal configuration (including configurations for children aged <12 years and adolescents aged 12-17 years), ability to technically parse data elements to block access, and implementation challenges (eMethods in the Supplement).

Results

Our study had an 81% response rate (13 of 16 organizations). Final participants included 5 stand-alone children’s hospitals, 3 large integrated delivery networks, 3 safety-net health care systems, 1 community health care system, and 1 federally qualified community health center. All 13 participants agreed about which information should be electronically released to pediatric patients younger than 12 years and their proxies in an ideal state of data sharing. The implemented portal release patterns were compared for adolescents and their proxies (Figure). Within all content (including sensitive content), variance was observed in the components that organizations could technically segment, with 12 organizations (92%) creating a sensitive note type, 11 (85%) segmenting sensitive laboratory studies, and 8 (62%) withholding sensitive imaging results. Segmentation of sensitive problems (6 organizations [46%]), medications (2 organizations [15%]), and immunizations (1 organization [8%]) was lower. All institutions recognized technical infeasibility as a barrier and were only able to electronically release a partial list of sensitive and nonsensitive content from each category. We identified 6 crosscutting themes and challenges to implementation (Table).

Figure.

Pattern of Implemented State Release to Portal Accounts of Adolescents and Their Proxies

Table.

Recurrent Themes Identified as Barriers to Implementation and Associated Challenges

Theme	Challenges
Technical infeasibility	Inability to segment components of data, such as specific laboratory results, medications, or problems, on a granular level when they are deemed confidential. Inability to set different release patterns for the patient and the patient’s proxy. EHR vendors provide support for interpreting law but have not yet released many technical build upgrades.
Sensitive information leak	Understanding where pitfalls are in protecting sensitive information, such as smart links pulling an extensive list of medications or problems into the EHR note, which may unknowingly release confidential information. Billing information is difficult to protect for health care confidentiality. Confidential information could be incidentally shared with third party applications, then passed along to patients’ proxies. Sensitive maternal history relevant to a newborn may be accessed by the patient or a proxy.
Permissive release of information	Ability to turn on sharing of confidential information when the adolescent patient has provided informed consent to do so.
Concern for inappropriate proxy access	Concern that adolescent patients’ accounts are being accessed by parents or patients’ proxies. Workflows are needed that will allow deactivation of adolescent accounts when it appears that the proxy has control of information. Institutions must start over in enrolling adolescents and their proxies to verify account holders more accurately.
Cultural awareness and education	Continued education of health care professionals about laws surrounding confidentiality and training on workflows for documentation.
Legal complexity	Clarification of what a psychotherapy note in the EHR can and cannot include, guided by state laws. Local interpretation of the law by independent organizations varies.

Abbreviation: EHR, electronic health record.

Discussion

The creation of the California Pediatric Informatics Collaborative promoted early collaboration among important stakeholders across the state with regard to deciphering the 21st Century Cures Act final rule in the context of California state laws on adolescent consent. Participating organizations praised the sharing of both the general approach to data sharing and specifics about the technical capabilities of the data sharing portal. Our interviews suggested that participating health care institutions in California agreed about which information should be released to patients younger than 12 years, adolescent patients, and patients’ proxies. However, given difficulties with data segmentation and technical infeasibility, no institution, regardless of organizational type, has yet to successfully implement its entire ideal state of data sharing.

Study limitations include a predominance of Epic Systems electronic health records and difficulties in ascertaining granular details of confidential data sharing. Continued collaboration is necessary to identify a unified approach to health information sharing that will empower patients while protecting adolescent confidentiality. The creation of novel technical capabilities by electronic health record vendors to allow granular segmentation of data release will be important in this process. Future research is warranted to address the technical limitations of pediatric information sharing.