Guardian Patient Portal Access Impacts Adolescent Patient Privacy

Over 64 percent of parents or guardians have accessed their child’s patient portal and viewed outbound messages at least once, showing a need to address adolescent patient privacy and confidentiality concerns, according to a study published recently in JAMA Network Open.

Researchers analyzed over 25,000 outbound messages from 3,400 adolescent patient portal accounts across three academic children’s hospitals. The accounts belonged to patients between the ages of 13 and 18.

Many health systems have implemented separate adolescent patient portal accounts to maintain confidentiality and privacy while encouraging younger patients to comfortably share health concerns with their providers.  

“The adolescent account often supports appointment scheduling, record sharing, and communication with health care clinicians as a way to promote self-management and engagement as adolescents transition into adulthood,” the study explained.

“Confidential communication is necessary for many adolescents to feel comfortable seeking care for sensitive health needs (e.g., pregnancy, sexually transmitted diseases, substance use).”

Under the HIPAA Privacy Rule, providers are permitted to share patient information with parents or guardians, as long as the guardian is recognized as the patient’s designated personal representative, the HHS website states.

But there are some key exceptions to this rule. A parent cannot be treated as the patient’s personal representative if “state or other law does not require the consent of a parent or other person before a minor can obtain a particular [healthcare] service, the minor consents to the [healthcare] service, and the minor child has not requested the parent be treated as a personal representative,” HHS explains.

In addition, guardians have no right to view confidential patient information if the minor authorized someone else to serve as their personal representative and provide consent for certain health services. If a parent agrees to a confidential patient-provider relationship for a particular healthcare service, the parent also forfeits their ability to obtain patient information.

“For example, if State law provides an adolescent the right to obtain mental health treatment without parental consent, and the adolescent consents to such treatment, the parent would not be the personal representative of the adolescent with respect to that mental health treatment information,” HHS concludes.

To combat this issue, some health systems provide proxy portal accounts for legal guardians with separate login credentials to access parts of their child’s medical records. However, researchers found evidence that guardians may be directly messaging providers from their child’s account instead of using their designated proxy account.

All three hospitals in the study permitted adolescents and guardians to have their own separate accounts. The researchers developed an algorithm to determine which messages may have been written by guardians. Any message that made a third-person reference to the patient, used phrases such as “my son” and “my daughter,” or contained a signature matching the name of the guardian on file were flagged.

The study revealed that most guardians had accessed their child’s account at least once, but there was a decrease in parental access as the patients aged.

“Pediatric institutions often rely on separate adolescent portal accounts with differential information access for this purpose, as recommended by several national organizations,” the study stated.

“Our study suggests that this practice may be insufficient to fully protect adolescent confidentiality.”

The researchers hypothesized that guardians may access adolescent portal accounts due to a misunderstanding of portal account design, institutional workflow issues, adolescents voluntarily sharing their access, and guardians coercively accessing their child’s account.

The study also revealed that only one-tenth of adolescent accounts were also associated with proxy accounts, showing a lack of awareness among patients and their guardians and a lack of communication between patients and providers.

“Based on these findings, it may be useful for health care systems to examine the current use of adolescent patient portals by guardians and develop strategies to promote proper portal access,” the study concluded.

“It is necessary to educate adolescents and their guardians on the concepts of patient portals and proxy accounts, as well as the benefits and limitations of electronic communications, especially given that many adolescents are not familiar with patient portals.”