The Privacy of Minors within Patient-Centered eHealth Systems

E-health has become a central feature in the agenda of many European legislators. Health information technologies open up new legal issues in the transition from a paper-based framework to a digital one. The paper focus on a specific issue emerging in this transition, the treatment of the so-called «supersensitive data» of minors processed within the legal framework of the «Fascicolo Sanitario Elettronico» (FSE), a patient-centred ehealth system that has been recently defined and regulated in Italian law. After having outlined the general discipline of this system, the paper shows how the right to control their information (in some cases even against the parents’ right to access these information) recognized to minors by a growing body of sources of law and case law interpretations is challenged in this new scenario and need to be taken in account when designing the rules and the information flows permitted by FSE systems. In conclusion, some recommendations to ensure the proper design and implementation of a FSE system according to the minors’ right to control their information are provided.

challenge, but it is also raising new legal issues.In fact, technology does not always involve a simple translation of an "analogue" artifact into the digital language, preserving the same set of rules and the rationale of its pre-digital discipline [Pascuzzi, 2010].In the balance of rights and interests to the new scenario.
In this sense, the legal framework of the so-called "minors' supersensitive data" (that is, information related to sexuality or other health related stigmatising conditions) within a patient-centred health system is a paradigmatic case.
In Italy, a growing body of statutory law and case law interpretations recognises some "areas" of privacy for individuals between the ages of 14 and 18, allowing these latter to operate autonomously and without parental consent in certain circumstances relating to their private lives.The rationale for these provisions is farsighted: in some cases concerning the most intimate and personal aspects of life, adolescents may be discouraged from approaching the public health service, fearing that parents may learn peculiar "supersensitive" information revealing habits or life-styles which would entail the risk of negative reactions toward their sons (for instance, a teenager may fear the punitive reaction from her father learning that she is on birth control).
Therefore, the protection of privacy and the protection of health go hand in hand when it came to minors, at least in some specific situations.
Such a space for autonomy and confidentiality was ontologically protected in the pre-digital healthcare context because of the nature and the informational shortcomings of paper documents.How can such principles be upheld in a digital environment?How can certain data be hidden in a system where in principle everything is traced?Considering that parental authority today implies gaining access to the minor's EHR, how can the previous level of privacy for "supersensitive" data be preserved in the new context up by e-Health?
By adopting a problem-solving approach and focusing on the comparison between the analogic and the digital perspectives, the goal of this paper is to highlight some critical issues that arise in the attempt to balance the privacy protection of the minor and the need to preserve the legal prerogative of parental authority, in the context of the new technologic possibilities of e-health systems.All these factors must be taken into account in the design and implementation of the EHR architecture.
Before getting to the heart of the matter, we have to briefly outline the legal and technological framework of this investigation, i.e. the "Fascicolo sanitario elettronico" (FSE), a patient-centred ehealth system that has been recently defined and regulated in Italian law.Therefore, the FSE is not a prerogative of the professionals contributing to the patient's care.As can be seen in practice, even at an international level, information technology is gradually creating new virtual spaces for patient participation in the management of their clinical data and is restructuring the process of care around the patient.Thanks to the digital architecture, in fact, the subject can participate more consciously in the decision process regarding their care.In this sense, the patient is becoming "the centre of gravity" of the system of management of their health [Guarda, 2011].This trend toward the person-centred care is the distinctive feature of a Personal Health Record (PHR) system, where the patient actively participates in the control and management of the flow of health data.

The "Fascicolo
The FSE offers many advantages for the support of an integrated system of health care.The information can be easily shared between authorised users and the different professionals can manage the decision-making process concerning treatment choices in a coordinated way.The more accurate is the collection of data, as long as they are accessible and correctly transposed, the greater will be the goals that the system will be able to achieve.
We have to consider one last point.The advent of the FSE has been accompanied by some buzzwords in these times of crisis: efficiency, savings and quality.The digitisation of the Italian healthcare system not only has helped optimise services and reduce medical errors, it would also save somewhere between 12. Autonomous Provinces, must take care of the design and implementation of the national infrastructure for the interoperability of the regional FSE.

The legal issues in the paper-based context
After these remarks on the FSE, we can now better understand the context of the issue concerning the processing of the so-called "supersensitive" data of the minor.However, such an issue needs to be addressed firstly by taking into account the "analogue" legal framework around the minor and the protection of their privacy.
With the decline of medical and parental paternalism and the contextual recognition of an area of autonomy of the child, the doctrine and the case law has gradually eroded the traditional statutory view (according to which the minor is completely unable to manage their own interests and, therefore, absolutely incapable of acting), recognising the adolescent's right to self-determination.
In Italy, this principle has been recognised for the first time in ruling no.132/1992 of the Constitutional Court.In the opinion, the Supreme Judge affirms: "Parental control is recognised by Article 30 §1 and §2 of the Constitution not as a personal freedom, but as a right and a duty that finds its function and limit in the to HIV testing by the child" adopted by the Piedmont Region.
According to such Guidelines, the healthcare provider, after examining the ability of a child of at least sixteen years of age, may override the traditional preclusion and retain as valid the consent given by the minor.
Such a recommendation is based on the distinction between therapeutic and diagnostic treatment: if the former can potentially affect the psycho-physics sphere of the child -thus legitimising the intervention of parents and its legal precipitate -the latter does not involve a similar degree of invasiveness, rather consisting in an improvement, at least on a cognitive level, of the situation of the subject.and Autonomous Provinces of Trento and Bolzano.After pointing out how important it is "to promote the access of minors to the HIV test if there are possible situations of risk" and that "the question of the validity of the consent to the test, provided by the minor without the consent of the responsible parties, must be resolved in the light of the constitutional principles relating to the protection of health", the document arrives at conclusions both uncorrelated with the premise and contradictory to each other, affirming that " parental authorisation is necessary in order to proceed with the HIV test" and at the same time that "we need to define practices that facilitate access to the test especially for "older minors", i.e. from sixteen years of age".
Therefore, Law 135/90 is receiving a patchy application: at some latitudes the child, if capable of discernment, can have a sphere of intimacy and privacy that finds expression in the form of a corresponding decision-making autonomy; while at others he or she is considered absolutely incompetent.It is clear how this situation turns out to be non-compliant with the constitutional principle of equality, as well as the right to health.
In the abovementioned hypothesis of "early selfdetermination", the child not only can personally and autonomously consent to the medical treatment, but he or she may also ask for healthcare services, overriding parental consent (see Article 12 of Law no.194 of 1978), provided that pathological conditions do not arise that make it necessary to inform the parent.According to Vercellone, in fact: "in the case of drug addiction and HIVpositivity, it seems logical to allow operators to disclose the situation to parents when their cooperation is deemed necessary for obtaining useful results.Article 622 of the Criminal Code penalises the violation of privacy only if done without a just cause, and a just cause seems to be contributing to saving a child" [Vercellone, 2002].
The recognition of the minor's privacy has also found a recent confirmation in the Italian "Code of the minor's right to health and health services" (2013).In particular, Article 17 provides that: "The child, at any age, has the right to privacy.All operators who take care of him or her are obliged to maintain professional secrecy on all that concerns him or her during and after hospitalisation [...] The adolescent has the right to seek and receive assistance and advice from healthcare professionals, within the limits of the law in force, even without the knowledge of their parents or guardian".
The common rationale, underlying the recognition both of the "early self-determination" of the minor in medical treatment and of a sphere of privacy with regard to the processing of health data concerning him or her in the particular contexts already mentioned, is the need to remove a legal requirement that, if unfailingly followed, would cause the child to take evasive strategies, which are followed not only to avoid approaching healthcare services, but also to conceal and hide a pathological state.
In this respect, it is easy to note the link between the self-

The right to data protection and the right to health within the FSE
As already mentioned, in general the minor cannot consent to medical treatment, cannot pick up medical reports, or view the results of an examination.On the digital side, this means that the minor cannot get access and consult the FSE, as these powers belong to the parent.
From the technical and information technology perspective, this goal can be achieved by connecting the FSEs of the child and of those responsible for him/her.In other words, the parent with his/her credentials (ID and password) and through his/her control screen should have access to and manage the child's FSE.
However, such conclusions need a clarification.If, as we have seen, the law recognises that a child could ask for medical treatment or a diagnostic test without parental consent in certain cases, two consequences follow: firstly, the child can have access to that data through his/her FSE; secondly, it is necessary to ensure that the health data concerning the minor, produced in that "supersensitive" context, could not be made available to the parent through the connection of the FSEs.
The minor's right to self-determination in relation to therapeutic choices finds its correspondent, on the digital side, in the principle of informational self-determination, that is, the power to control the information produced in those particular situations.
In the cases where the minor can act independently without parental consent, the same level of privacy from parental intervention should be ensured, which was easily secured in paper transactions when the medical report was delivered directly to the person concerned.
In addition to these cases, we should also consider those types of data for which it is possible to choose anonymity.
Therefore, in the digital context of the FSE it is desirable to implement a policy of selective data hiding, in order to shield those particular categories of information in this paper defined as "supersensitive", which could be exemplified as follows: In addition to these types of data, we have to consider also a type of information, which could be defined "supersensitive per relationem".Such information is a sort of "spy" data, because it is derived from analysis or examinations carried out outside of structures clearly and in advance identifiable as "sensitive", but they are related to the same plan of assistance (for example, a blood test carried out in a laboratory before prescribing a birth-control pill); so, these data may reveal to the parents a situation that the child has decide not to include such information in the FSE/dossier, or, as an alternative, to include them only after a specific manifestation of the will of the person, who may also legitimately ask that the information be consulted only by some subjects, authorised by him or her (e.g.his/her current clinician)".
Therefore, according to the recommendation, the information architecture should be designed implementing a choice of the data controller: on the one hand, it can prevent that the data set, subject to a special legal regime of anonymity, freely converge within the FSE; or, on the other hand, it can allow the data subject to choose which data can populate the FSE and who is authorised to see it.
The second option seems to be a more suitable solution, considering both the purpose of the FSE and the right to selfdetermination.However, we have to take into account that the mentioned recommendation is not precisely referred to the minor: the rationale of the provision is to protect the confidentiality of the adult, disabling the visualisation of certain information to all or some health professionals.On the contrary, in the case of minors, the data hiding should be functional to the protection of the right to privacy (preventing the parent from having knowledge of the information that we have classified as "supersensitive" data) and, through it, of the right to health.
Given this premise, we imagine a more flexible solution for the management of minors' supersensitive data.We suggest a modular access to the minor's FSE, obscuring to the parent exclusively certain types of information from particular departments (obstetrics, gynaecology, family planning counselling and drug services).But for the abovementioned reasons, also the so-called "supersensitive data per relationem" should benefit from the same treatment.It would be necessary to hide all data produced within the entire process of care or counselling, not only considering the formal aspect of the information (i.e.prescription of a contraceptive pill), but above all evaluating it in a dynamic and functional perspective (a blood test is preliminary to the administration of a contraceptive pill by family planning counselling).
In order to avoid general automatism which will simplify the balancing of the different interests in the administration of healthcare services to the minor, it would be preferable to map the "supersensitive" health data produced by the providers according to objective parameters such as type of disease, intervention and purpose.
The data so classified should be concealed or not depending on the will of the person concerned: if the minor can validly consent to treatment, the data so produced should be controlled and managed by the same.
Therefore, the EHR system should not only help prevent visualisation of supersensitive data by the parent, but also by other professionals (e.g. the family doctor) who are not expressly authorised by the person concerned.It would be conceivable to introduce a flagging system, which is activated by the healthcare professional with the permission of the minor: in this way, the latter can choose which data to insert in his or her own FSE, but at the same time can decide whether to inhibit the visualisation of those data by the parent.
On the information technology side, this should translate into a modular regime of access: certain information contained in the minor's FSE should be displayed depending on the user's profile.So, the minor, logging in with his/her own user name and password, should be able to view the "pure" supersensitive data and the supersensitive data per relationem, as in the paper context he or she would be able to consent to the treatment and examine the pertinent medical records.However, at the same time he or she could not have access to the rest of his/her health data, according to the general principles.
The parent, instead, may log in with his/her credentials and view all the FSE of the minor with the exception of those data hidden through the "flag".To ensure an effective confidentiality, parents not only should be prevented from gaining access to that content, but they should not be authorized to view even a single trace of the metadata.In other words, they ought not to know that the minor has hid certain data: this is the "hiding of the hiding" principle.
In any case, it is important to stress that the data hiding is not an impassable wall: the source and the limit of the minor's sphere of autonomy is always the right to health.That means that parents should be informed if their child is facing a pathological situation which requires prolonged treatments or interventions that might permanently reduce their physical and mental integrity, or represent a potential danger for the people who come in contact with them (consider, for example, the case of HIV infection or The Trento Lawtech Research Paper Series is published since Fall 2010 has become a central feature in the agenda of many European legislators.The transition from a paper-based healthcare management to a digital one is a crucial technological and economic many cases, it strengthens the potentiality of the paper-based regulations, eliminating or reducing their limitations.In other cases, technology creates new problems and frictions unknown to the predigital world.Legal scholars need to investigate whether and to what extent these innovations are compatible with the guarantees and checks provided by the law, developing strategies that can adapt * Although this study is the result of a joint reflection carried out by the authors in the framework of the project "TREC: La Cartella Clinica del Cittadino", coordinated by the Fondazione Bruno Kessler of Trento, with the financing of the Autonomous Province of Trento, Umberto Izzo is the exclusive author of paragraph 1, while Rossana Ducato is the author of paragraphs 2, 3, 4, 5. † This paper has been presented at the VI International Conference on Information Law and Ethics (ICIL 2014), held in Thessaloniki (Greece) on the 30th and 31st of May, 2014.The paper will appear in the Conference Proceedings.

5 and 15 billion
Euros.It is no coincidence that in the last two years the legislature has accelerated the gestation of the regulatory framework that will guide the action of the Italian Regions and Autonomous Provinces, which are required to adapt and establish an interoperable FSE system by 30 June 2015; while by 31 December 2015 the AgID (the Italian Agency for the Digital Agenda) in accordance with the Ministry of Health, the Regions and the interest of the child.The Constitution has overturned the idea of the subjection of the child to an absolute and uncontrolled power, by affirming the right of the child to the full development of his or her personality and functionally linking to such interest the duties, even before the inherent rights, inherent to the exercise of parental control".[SeeBucciante, 1997;Moro, 2008].This role of the minor has also been recognised at an international level and in domestic legislation.The right of a child's self-determination has been affirmed, for example, in the field of clinical trials: Article 4 of Legislative Decree 211/2003 emphasises the conscious involvement of minors.In fact, the principal investigator must take into account the explicit will of the child to refuse participation in the clinical trial or withdraw from it at any time, if the child is able to form an opinion and evaluate the information[Vercellone, 2002].Information provided to children is also emphasised in the case of removal and transplant of stem cells from bone marrow, peripheral blood and umbilical cord [Linee-guida in tema di raccolta, manipolazione e impiego clinico delle cellule staminali emopoietiche (CSE), (Agreement 10 July 2003)].More recently, the Italian Data Protection Authority has considered the will of the minor in relation to the control of his/her information in the delicate matter of genetic data.According to the General Authorisation no.8/2013, "considering his or her age and degree of maturity, the opinion of the minor is, as much as possible, taken into consideration; in any case, the interest of the minor remains pre-eminent".Also in the context of medical care, in the wake of numerous decisions pronounced in various subject areas, it the selfdetermination of the discerning minor is now generally recognised [La Forgia, 2004; Turri, 2005; Piccinni, 2007; Buffone, 2009; Mastrangelo, 2010; Lenti, 2011].In front of a discerning minor, the clinician has to inform the minor about the medical treatment, involving him/her in the informational exchange once exclusively reserved to parents or guardians.Legal scholars and Courts agree on the participatory role of minors in the decision-making process regarding their health, as well as the progressive recognition of their opinion (in proportion to their age and degree of maturity) in existential-therapeutic situations.As a rule, the child cannot undergo medical treatment unbeknownst to the parents or against their will.In the light of the responsibility and the consequent obligations of surveillance and protection, the parent has the right/duty to know the health conditions of the minor, as well the correlative power to make decisions in the interest of the child[Bonamini, 2011].Nevertheless, in some cases the Legislator explicitly recognises a sort of legal capacity to the minor who is capable of forming his or her own views.This involves: a) administration of the means for responsible procreation (Article 2.3, Law no.194 of 1978); b) voluntary termination of pregnancy (Article 12, Law no.194 of 1978); diagnosis and treatment that may be necessary as a result of the use of drugs (Article 120, Decree of the President of the Republic no.309 of 1990); c) donation of hematopoietic stem cells, placenta and umbilical cord blood (Article 3, Law no.219 of 2005).A really hot topic in this perspective is the applicability of Law no.135 from 1990 regarding the prevention and the fight against AIDS.The law does not establish a specific provision if the person interested in the diagnostic assessment is a minor.It simply affirms: "the communication of the results of diagnostic tests for the detection of the HIV infection can be given exclusively to the person to whom such tests concern".Literally interpreting the Italian legal principles (and specifically Article 2 and Article 316 of the Civil Code), we should conclude that parental consent is needed in order to perform the HIV test.However, some scholars warn against the potential consequences of such a conclusion[Piccinni, 2007;Prestileo et al., 2008].In fact, the involvement of the parent might dissuade the minor from contacting healthcare providers, thereby compromising the effective exercise of the right to health of the minor and any third parties.This concern was echoed in the Guidelines "Consent of the subject and the privacy and protection afforded by Article 32 of the Italian Constitution (Right to Health) to all individuals.The right to health thus becomes a qualified constitutional referent, susceptible to innovating the traditional private law view regarding the self-determination and confidentiality of the minor.
a) examination, prescriptions and administration of drugs relating to responsible procreation (contraceptives, morning-after pill); b) gynaecological examinations and diagnostic tests (e.g., Pap test), termination of pregnancy in the presence of judicial permission (when, therefore, the consent of the parents or the guardians is not needed, considering the existence of serious reasons that prevent or advise against parental consultation or tests and therapeutic interventions / rehabilitation of a minor who faces personal and non-medical use of drugs; e) diagnostic tests related to HIV.
the interest to keep private.Such information, being supersensitive by reflex, should enjoy the same discipline of protection and the same possibility of concealing the data, as we have seen within the supersensitive data tout court.Thinking about possible solutions in the design phase of the FSE's information system, a first option would be to preclude, at the time of their creation, the entry in the FSE of all types of medical data related to situations sub a), b), c), d), e), as established by the law.Such a solution would be partially consistent with the Guidelines on FSE, enacted by the Italian Data Protection Authority in 2009.Section 5 provides that: "the data controller, in the establishment of the FSE and in the identification of the type of information that can be inserted even later, must comply with the regulations protecting the anonymity of the person, including those for the protection of victims of sexual violence or child abuse (Law of 15th February 1996, no.66; Law of 3rd August 1998, no.269, and Law of 6th February 2006, no.38), of people affected by HIV or AIDS (Law of 5th June 1990, no. 135), of those addicted to narcotics, psychotropic substances and alcohol (Decree of the President of the Republic of 9th October 1990, n. 309), women who undergo an intervention of voluntary termination of pregnancy or who decide to give birth anonymously (Law of 22nd May 1978 no.194; Ministerial Decree of 16th July 2001, no.349), as well as with reference to the services offered by family planning clinics (Law of 29th July 1975, no.405).Therefore, the data controller may

Sanitario Elettronico": the Italian EHR system
"FSE" is a current topic in the Italian legal and political debate.After a first recognition through the publication of the "Guidelines on the Electronic Health Record and the Health File"