The Office of the National Coordinator for Health Information Technology Patient Engagement Playbook

Chapter 3

Allow access for caregivers

Providers often struggle to navigate federal and state laws related to proxy access (allowing someone other than the patient to see a patient’s health information). Laws like the Health Insurance Portability and Accountability Act (HIPAA) are designed to keep patients’ medical records and personal health information private and secure — but there are many situations in which a family member or other caregiver may need this information.

Examples include:

  • A parent of a child or adolescent
  • An adult child or caregiver of an elderly parent
  • A home health aide to a chronically ill patient
  • A health care power of attorney responsible for an incapacitated patient’s medical decisions and care
  • Someone else the patient wants involved, like a spouse43

Under HIPAA, a patient’s personal representative (someone authorized under state or other applicable law to act on behalf of the patient) has a right to access the patient’s personal health information. The patient also has a right to allow their personal representative to share this information with someone else, like a doctor or hospital.44

Many patient portals still offer a one-size-fits-all approach to information access — anyone with the right login can see the full medical record. Some patients share their own login credentials with their caregivers, which gives them unlimited access to the patient’s information and compromises security (it’s more difficult to track who has logged into a patient’s portal). This model ignores the reality for many patients: they need an informed representative to help manage their care, but they also have a right to privacy.

For adolescent patients (ages 12 to 17), this can be particularly tricky. Adolescents may want to keep their health care decisions and medical information private. Some state laws allow minors to receive specific kinds of health care, like mental or sexual health services, without their parents knowing or consenting. Others say that minors can make decisions on their own if they have an “adult status,” like being married or in the military. The age when a person is considered an adult and able to make their own health care decisions varies from state to state.45

Parents may also want to keep certain information, like a family history of disease, between only themselves and their adolescent’s provider.

Tips for Practice Administrators46

Practice administrators can take steps to enable caregivers’ access.

  • Work with your EHR vendor to make sure you can give each personal representative a unique, secure login to access the patient’s portal
  • See if your EHR vendor allows providers to set varying levels of access to a patient’s portal information

Tips for Providers

Providers play an important role in managing caregivers’ access.

  • Talk with your patient to find out who’s involved in their care
  • Ask about your patient’s preferences for giving caregivers access to their health information (Unless the patient objects, HIPAA generally allows a provider to share health information with family members or friends involved in the patient’s care)47
  • Customize caregivers’ access to your patient’s portal information, if possible

Allow Access for Caregivers

Infographic 3 poster

Use the portal as a tool to balance the competing needs of patient privacy and caregiver access. Allow patients and their representatives to see different portal information, depending on a patient’s needs and characteristics and relevant law.

Boston Children’s Hospital48 | From the field

Boston Children’s Hospital (BCH) advocates for patient portals with flexible access that providers can tailor to meet patients’ and parents’ needs and to comply with relevant federal and state law.

Specifically, BCH recommends a portal that gives adolescents and parents access to different types of information. Following this model:

  • Adolescents can see nearly all of their medical information, including anything sensitive — like a birth control pill prescription or chlamydia test results. They can’t see any information that their parents have asked to keep private.
  • Parents can see information they’ve shared with their adolescent’s provider and general information about their adolescent’s health.

Adolescent MyChart49 | From the field

The University of California at San Francisco (UCSF) has customized MyChart — the patient portal offered through their EHR vendor, Epic — to offer appropriate patient and representative access that meets Meaningful Use requirements. The result is Adolescent MyChart.

Adolescent MyChart gives each audience access to distinct portal information.

Adolescent MyChart proxy access policy
Content Parent Proxy
0-11 years
Parent Proxy
12-17 years
Adolescent
12-17 years
Labs YES SELECTED SELECTED
Immunizations YES YES YES
Allergies YES YES YES
Growth Chart YES YES YES
Messaging to and from provider * YES YES YES
Appointment Request YES YES YES
Appointment View YES NO YES
Problem List/Summary YES NO YES
Medications/refill request YES NO YES
* Parent and teen can send private messages to the provider.

At UCSF, parents have limited portal access to potentially sensitive information about their teen children. This lines up with California law, which allows teens between ages 12 and 17 years to keep care for medical needs like sexually transmitted disease testing, contraception, and pregnancy care private. For example, parents can’t access lab results from a pregnancy test or OB ultrasound.

Through Adolescent MyChart, UCSF can more successfully engage teens in their care while also protecting their privacy.

“We made the decision to give teens their own access, and to make them able to see their full record, because we think it’s the right thing to do and it’s where we see patient-centered health information technology going.”

— Dr. Carolyn Jasik, Assistant Professor of Pediatrics, UCSF

Chapter 3 Recap

  • Meet patient and caregiver needs by setting up varying levels of portal access.

Join the conversation.

Let us know how we can improve and expand on Chapter 3: Allow access for caregivers.

Content last updated on: September 22, 2016