Balancing Patient Portal Privacy and Access for Pediatric Care

Considerations for proxy access to patient portals

Proxy access is at the core of portal adoption because it legally allows guardians to access and manage a child’s patient portal. Gaining proxy access, something a guardian can usually do in the doctor’s office or through extensive online verification, is critical for pediatric patient portals until the child begins managing it on her own.

According to David West, MD, medical director of Nemours Health Informatics, this process is necessary because the health data stored in a pediatric patient portal doesn’t actually belong to the custodian of the portal.

“Adult portals are a bit easier on enrollment because the patient and guardian are one in the same,” West explained. “In pediatrics, there is always more friction at the point of trying to make an account because you have to verify that the person you’re giving that account to is in fact a legal guardian.”

Per HIPAA privacy regulations, parents and legal guardians must request proxy access. However, the details of proxy and personal representative access may vary by state. Additionally, the defining characteristics of guardianship may vary by state, HIPAA rules say.

Because healthcare organizations must verify that an individual is in fact a pediatric patient’s legal guardian, patient portal recruitment is complicated.

“It keeps us from being able to just do things like mail activation codes on a postcard,” West explained. “We can’t do that because we’d lose that ability to verify that we’re actually getting a guardian involved. That’s a unique dimension of pediatrics in general.”

Instead, organizations rely heavily on their office staff to make patient portal signups as seamless as possible. Person-to-person communication tends to be the most effective recruitment strategy, West said, especially because it allows for easier guardianship verification and emphasizes the importance of the portal.

“The strategy that has the highest conversion rate for families is when the clinicians talk to the family and say, ‘this is the way we communicate effectively between visits. This is how you can ask me questions,’” West said. “If the clinician comes to the table advocating it as a main means for them to have a relationship, we have a pretty good conversion rate.”

Despite proven benefits of the patient portal, guardians can be slow to adopt. In a July 2016 study, researchers introduced a patient portal to over 9,000 families with a child managing asthma. Of those participants, only 237, or 2.59 percent, actually adopted it.

Among those who did adopt the portal, the researchers saw increases in asthma controller medication prescriptions, refills, and treatment adjustments, indicating improvements to chronic disease management.

The researchers hypothesized that low uptake was due to perceived high levels of health. Since a majority of patients were already on an asthma controller medication at the study’s onset, they and their parents may have thought they were in good enough health that did not need further management or engagement.

According to West, providers can encourage more regular portal use by emphasizing the tool as a communication method. Providers who consistently respond to messages and requests in a reasonable time frame are better able to keep patients coming back to the portal.

“When families and patients ask questions or ask for something, it can’t get lost in the queue of things that take a week or longer,” he emphasized. “If patients don’t learn that this is a reliable method of communication, use will dissipate.”

Dig Deeper:

• Stakeholder Collaboration Can Boost Patient Portal Enrollment

Patient portals and the age of consent

As cumbersome as guardian authentication and proxy access may be, patient portals become even more complicated when patients reach adolescence. At this point, most pediatric providers begin to shift portal management to the child and retract some guardian privileges.

Healthcare organizations typically make this shift when patients reach the each of consent. While laws surrounding the age vary state by state, age 12 or 13 is the usual threshold. When patients reach the age of consent, they gain full control of the patient portal, while their legal guardians are transferred to  a limited view of the portal.

Guardians may no longer see some or all secure messages between the patient and the provider, some appointments (although HIPAA rules state that some health services still require guardian consent until the age of 18), and medication lists. In most cases, these protocols are geared toward protecting adolescent patient privacy with regard to reproductive health, although they may apply to other forms of healthcare, as well.

According to the American Academy for Family Physicians, allowing for patient privacy once children reach adolescence is critical for ensuring patients feel comfortable utilizing healthcare services. If an adolescent feels as though their privacy may be breached, even with their parents, they may not access necessary and potentially life-saving services.

“Concerns about confidentiality may create barriers to open communication between patient and physician and may thus discourage adolescents from seeking necessary medical care and counseling,” the organization says.

Researchers at The University of Florida Health found that giving teens access to their own patient portals – and not their guardians – was not only critical for open patient-provider communication, but was just as productive as parent control of the tool.

When the health system introduced the patient portal to a group of teenage patients, they found that patients clicked thru the portals just as often as parents of young children did. Although teens didn’t message their doctors as often as parents (37 percent versus 84 percent, respectively), the researchers were still pleasantly surprised by the results.

According to the researchers, teen control of the patient portal goes beyond legality.

"We understand how uncomfortable and new it is, having part of an appointment without a parent," said Lindsay A. Thompson, an associate professor of pediatrics at the University. "But not only is it legally correct, it’s also a good learning experience for teens."

"Learning to ask a question and process the response in an email format that is protected is ideal, because in this day and age, that is how teens seek information anyway," Thompson continued. "I think one of the biggest barriers to transition to adult services is figuring out how to access preventive care. Young adults don’t see their physicians for preventive care as often as they should and this could improve that."

Dig Deeper:

• Privacy Issues, Distrust Keep Patients from Health IT Engagement
• ​Are Secure Patient Portals a Necessary Step for Providers?

Encouraging adolescent patients to share info with guardians

Although most pediatric hospitals and clinics shift patient portal control from parents to patients once a child reaches adolescence, providers still have a responsibility to encourage open communication between both parties.

“Health care professionals should support effective communication between adolescents and their parents or other caretakers,” says the Society for Adolescent Health and Medicine, an organization dedicated to improving health for young adult and pediatric patients. “Participation of parents in the health care of their adolescents should usually be encouraged, but should not be mandated.”

At Nemours, providers are likewise told to encourage patients to communicate with their parents about their health and grant them full access to their portals.

“It’s analogous to us saying that we encourage adolescents to discuss any health issues with their parents,” West said. “We want that relationship to be open and dynamic. We try to encourage patients to talk to their parents, for the same reasons that we encourage adolescents to have their family involved and be an adequately informed support structure for them.”

Nemours has a legal framework to allow patients to collaborate with their parents via the portal. Once patients reach the age of consent, they can then assent their parents back onto the portal as a third-party viewer, allowing them whatever level of access the patient feels comfortable with.

This process requires acknowledgement from both the patient and the provider, and can be revised at any time.

“When the adolescent gives assent that the parent can have full access, we can restore the full access that the parent had before the child turned twelve,” West explained. “It does require an independent signature from the adolescent, and the physician has to put in an order that says that they’ve had a conversation with the adolescent where the discussion occurs about what this means and what it could reveal.”

Of course, this is not something providers can force patients to do, and in some cases they protect patients from having to disclose any health information to their parents. Some patients feel extremely uncomfortable sharing their patient portal data with their parents, and Nemours providers work to ensure these patients can get the most out of their care by protecting their privacy.

“It is the rare adolescent that comes in who feels threatened, at risk, or in danger if they were to divulge certain things to their parents,” West noted. “We treat them accordingly with sensitivity. We don’t divulge in those settings. Certainly we try to do anything that we can to get them into a supportive setting.”

HIPAA rules account for patients who feel threatened disclosing health information to their parents, even allowing providers to use their discretion if they feel a patient is in an abusive or otherwise dangerous situation.

Those exceptions notwithstanding, it is on the provider to ensure the patient portal is used as a fundamental patient engagement tool.

Between advocating for its use amongst parents and young patients under the age of consent and patients aging into adolescence and early adulthood, these tools can be used to teach patients how to take care of themselves. In the long run, pediatric clinicians can use patient portals to build a fully engaged patient population for the years ahead.

Dig Deeper:

• How Patient Portals Improve Patient Engagement
• ​How Patient Health Data Access Drives Patient Engagement