In the age of the electronic health record (EHR), how can we balance adolescent confidentiality with the need to involve parents in adolescents' care? This was the question faced by the clinical and management staff of the Institute for Family Health, a network of federally qualified health centers in New York, when it sought to provide adolescent patients access to their health information through an online portal. (See “About the Institute for Family Health.”)

The Institute uses a portal tied to its EHR (Epic), which allows patients to securely view their medical records and communicate privately with staff. Portals differ in terms of their technological capabilities. The Institute's portal, unlike some, allows users to customize proxy access by age and content, which was key to achieving goals and complying with the organization's policies. This article describes the process used to develop and implement access policies for adolescents.

Consent laws and portal policies

Under most state and federal laws, for a minor to obtain health care services, the minor's parent or legal guardian must consent to such services. However, under certain circumstances, state laws and HIPAA permit minors to consent to care on their own. These circumstances vary from state to state but generally fall into two categories: laws that permit certain categories of minors to consent to their own care (e.g., emancipated or pregnant minors) and laws that permit all minors to consent to certain types of care (e.g., reproductive or mental health care). The Guttmacher Institute publishes an updated summary of minors' consent laws by state.

For the most part, under HIPAA, anyone who has the right to consent for a minor to receive health care services may authorize the disclosure of information relating to such services.² However, the regulations also say a minor can control disclosure of health care information if the state doesn't require parental consent to a health care service and the minor receives such services without parental consent, if a court or other law authorizes someone other than the parent or guardian to make treatment decisions for a minor, or if the parent or guardian agrees to a confidential relationship between the minor and a health care provider.²

The Institute serves adolescent patients from a wide range of ethnic backgrounds and socioeconomic levels. For most aspects of their care, they must have consent from a parent or legal guardian. However, in certain circumstances and for certain services, including reproductive health, mental health, and prenatal care, these patients can provide their own consent. By New York state law, information about those services is confidential and cannot be shared with an adolescent's parent or guardian without the adolescent's consent.

Accordingly, adolescents seeking these types of care may require special arrangements to protect their confidentiality. For example, if an adolescent has commercial health insurance through his or her parents, the Institute cannot bill that carrier without risking an “explanation of benefits” statement going to the parents and violating the adolescent's confidentiality. Protecting confidentiality becomes even more complicated when access to the adolescent's health record is available electronically through a portal.

Institute staff developed and implemented the adolescent portal access policy in March 2011 with the assistance of legal counsel to ensure it complied with applicable laws and regulations. Below are its key elements:

Portal access to all patients age 10 or older. The first issue was setting a minimum age for portal access that made sense for the Institute's practice. According to the Guttmacher Institute, 10 percent of all U.S. births are by girls who are age 19 or younger.³ In the areas that make up the Hudson River Valley, the birth rate per 1,000 females ages 10 to 14 ranged from 0.2 to 0.7 between 2008 and 2010.⁴

Recognizing that puberty and sexual activity can begin as early as age 10, the New York eHealth Collaborative, the public-private partnership responsible for developing the Statewide Health Information Network of New York, established a policy that permits the exchange of health information about minors younger than age 10 with the consent of a parent or legal guardian.⁵ For minors age 10 and older, the exchange of information occurs with the minor's consent. The Institute's minimum age for access is consistent with this policy. Nationwide, age cut-off for minors' consent ranges from age 10 to 16, according to state laws and practice policies.

Limitations on parental access. The Institute's portal allows a third party, such as a parent, spouse, or caretaker, to view a patient's health records or interact with the patient's health care team through proxy electronic access. Parents or guardians must provide proof of legal custody of the adolescent. If the Institute is notified that an adult's legal rights have changed, it can verify that information and terminate that individual's proxy access to the adolescent's medical record.

Before a child turns 10, a proxy may see and interact with every section of the child's medical record online. This includes diagnoses, medications, test results, messaging, immunization record, scheduling, and summaries of past office visits. However, once the child turns 10, a proxy may see only the child's immunization record and messages between the proxy and Institute staff members. The proxy may use the portal to schedule appointments but can no longer see summaries of past office visits. For example, a 15-year-old girl who came into the office for birth control would be able to see the after-visit summary for that visit, including instructions for the use of her birth control pill, through her own portal account. However, her mother would not be able to see these sections. Note, the Institute doesn't completely shut off parents' access to their children's records. Parents can get a printed copy of all information in the child's chart, excluding the areas that are legally restricted.

Restricting online proxy access in this way is critical to avoid unlawful disclosure of sensitive information. The Institute's management agreed that restricted access must begin at the earliest possible age when sensitive information might appear in a child's health record and that this restriction must be implemented automatically. If the Institute had to manually restrict access, the risk of transmitting legally protected information would be too high. In some families, the consequences of unwittingly releasing sensitive information could be dire. In addition, if the switch to restricted access was not age-based and automatic, it could serve as a signal that a child has received care of a sensitive type. Adolescents will not trust the Institute to provide reproductive or mental health services unless they know that their care is confidential.

Initially, the small group of administrators and clinicians that comprise the Institute's portal team decided there should be no exceptions to this age-related limitation. However, several clinical leaders objected to a blanket restriction. They argued that in some circumstances, such as in the case of a minor with complex medical problems, a parent or guardian should maintain full proxy access even after the patient turns 10. For example, the parent of an adolescent with severe asthma may use the portal frequently to send messages, request medication refills, and check results. If that patient's chart contained no sensitive information that must be protected, the automatic restrictions that occur when the patient turns 10 might be counterproductive.

In cases like these, Institute management can extend a parent or guardian's full proxy access for one year at a time with a written agreement signed by the minor, the parent or guardian, and the minor's primary care provider. Before signing such an agreement, the primary care provider must consider whether such access would give the parent or guardian access to sensitive information. If so, then the provider will not agree to provide full proxy access. This is admittedly a tricky situation given that a provider's denial would signal that the patient is receiving sensitive treatment. However, the Institute does not openly advertise the possibility of full access, and providers can use their discretion on whether to raise the issue with adolescent patients and their parents or guardians.

Full proxy access can be renewed every year until the patient turns 18, if necessary, by written agreement. If at any time the patient or the primary care provider determines that full proxy access should be rescinded, the parent or guardian's access will revert to the restricted level. To protect adolescents from parental pressure, once full access is rescinded for any reason, it cannot be re-established.

Implementation. The Institute strived to educate all staff members before proxy access for parents or guardians of adolescent patients began. Staff members reviewed the new policies and procedures with all health centers' nurse managers, office managers, and medical directors over several months. In several of the Institute's practice sites, the only concern was the delay in getting proxy access started and the potential extra workload for office managers.

Results

Since implementation, 1,534 adolescent patients have activated a portal account. Not counting patients who have since transitioned to adult accounts or otherwise left the system, the Institute currently has more than 500 adolescent users. Of these users, 223 have logged in more than five times in the past 12 months. An additional 163 users have logged in two to five times. Fewer than one-third of the adolescent users have logged in only once.

Overall, only 11 percent of patients ages 10 to 17 have activated a portal, compared with 31 percent of the general patient population. Although this number of activated accounts may seem low, it is important to remember that this is a fairly new service, and the Institute will be promoting it more actively in the future. The most frequently used portal feature for adolescents is messaging. The second- and third-most used features are appointment scheduling and review of lab test results, respectively.

From the time proxy access became available to parents and guardians, 97 have registered to gain access to their child's medical record. Among these, 78 are parents or guardians who have children younger than age 10, while 19 have limited access accounts for their children who are 10 or older.

To date, the Institute staff has not received any complaints from parents or guardians about restricted access to the records of children age 10 or older, nor has the staff had any complaints from adolescents about confidentiality concerns related to portal access. Anecdotally, parents who have signed up for proxy access said they appreciate its convenience. Some parents use the portal regularly to ask questions about their children's minor illnesses and to request medication refills. At this point, no parent or guardian has requested extension of unrestricted proxy access. The primary source of confusion about proxy access has been about how to establish it, which is typically solved by explaining where to obtain the proxy access request forms.

In developing the policies governing portal access to adolescent data, the Institute aimed to balance adolescents' rights to confidentiality with parents' needs to coordinate their children's care. The program has not encountered any problems in its first three years. This suggests that, with appropriate planning and carefully thought-out policies designed to comply with applicable laws and regulations, it is possible to provide adolescents and their patients or guardians with appropriate and convenient electronic access to health records.