Parental Proxy Access via Web Portals: Ensuring Compliance and Quality Documentation

by Sheila Green-Shook, MHA, RHIA, CHP

Many organizations are investing in a variety of secure-access Web portals, such as portals that give providers access to patient records and employee portals that allow staff the opportunity to work remotely. Patient portals offer consumers the ability to e-mail securely with physicians, complete registration forms prior to appointments, and access their health records.

Patients who experience the convenience of having online access to their medical records—whether to check the date of their last mammogram or the level of their recent cholesterol test, make an appointment with their primary care provider, or refill medications—will soon become hooked. Those patients with children will then want access to their children’s records, which seems like a simple request.

After all, organizations with patient portals have already gone through the steps to ensure a compliant release of information process and implemented security safeguards such as patient user IDs, passwords, and a picture ID to identify the patient. The organization has also hopefully ironed out all communication issues with physicians to manage the message boxes and decided when e-mail messages become part of the permanent medical record.

However, allowing parental proxy access to a child’s records is not quite as easy as it may sound. An organization is not just releasing information to the patient, it is releasing information about a patient to another individual. Organizations must address a number of issues before allowing parents to access their children’s medical records via Web portals.

Age-specific State Rights

In many states, minors have privacy rights specific to sexual reproduction, sexually transmitted diseases, and mental health and substance abuse treatment. These rights require a signed authorization by the patient before information can be released to a parent.

In these states, organizations may need to confine parental proxy access to a childhood age range that respects those privacy rights. For general medical information, except in the case of emancipated minors, parents normally have access to their children’s records until their eighteenth birthday. In states where children have reproductive and substance abuse rights at the age of 14, organizations may choose to allow parental access up to a predefined time, such as 30 days prior to the child’s fourteenth birthday.

Relationship Validation

Laws recognize several categories of parent. These include:

• Legal guardian
• Married biological parents
• Separated or divorced biological parents
• Step parents
• Adoptive parents
• Foster parents
• Grandparents (children living with grandparents who are not legal guardians)
• Other, such as a parent in the service or overseas who has transferred guardianship to a relative or friend with whom the child is temporarily living

Organizations must work closely with legal counsel to determine how the parent-child relationship will be validated, particularly with divorced parents, step parents, and other caretakers who are not legal guardians but are caring for the child for an extended period of time. This can be challenging.

An important part of the planning phase includes provisions to protect health information confidentiality. For release of information purposes, medical record documentation should capture parent or guardian names. A portal’s disclosure processes should align with the organization’s release of information policies and practices.

Organizations must also conduct a medical record review to detect circumstances, court orders, or parenting plans that would prohibit a guardian or parent from having access to the child’s medical record.

Defining Services, Available Information

Organizations must also outline what services and information will be available to parents via proxy access, including:

• Appointment scheduling
• E-mail exchange to the child’s primary care provider, pediatrician, or specialist
• Access to visit notes, including assessment and plan
• Immunization information
• Medication information
• Lab results
• Other services

One of the portal services parents appreciate most is proxy access to a child’s immunization records. This is also a popular service with release of information staff, particularly on that frantic first day of school, the last day to sign up for sports, and other such emergent situations where immunization information is sought at the last minute.

Many parents also value access to secure e-mail messaging with the pediatrician or primary care provider.

Physician Champions Needed

As with any major initiative, it is imperative to have physician champions. The organization needs physicians to be ambassadors who promote the advantages of proxy access to families who can benefit from it. There is no better time to talk to guardians or parents than when they are in the exam room.

Some providers may be skeptical initially, but after implementation they should be rewarded with more control over their schedule and their day. Instead of being interrupted for telephone calls, they can batch their e-mails and respond either once or twice a day, depending on volume.

Once parental proxy access has been implemented it may be helpful to block a portion of the physician’s schedule each day to respond to e-mail messages. That blocked time should be determined based on incoming e-mail volume.

Organizations also must educate parents or guardians on using secure e-mail. Although the portal e-mail service is often marketed as secure messaging and people think of it as regular e-mail, in reality it is legal medical record documentation. Guardians or parents need to understand that a patient-provider e-mail will become part of the child’s medical record.

For this reason, parents should also understand that they must send two separate e-mail messages if they have more than one child, one for the first child’s medical record and the other message for the second child’s medical record. If the parent addresses both children in one message, the provider’s response will only reside in one child’s medical record.

This can become a patient care issue if the second child presents in the ED or urgent care and there is no documentation of the e-mail exchange between the provider and parent. It also can lead to privacy breaches when health information about a second individual is inappropriately placed in a record and later released incidentally along with records of the first patient.

Authorizing Access

Finally organizations must determine the who, when, where, and how of the parental proxy access authorization form and its process. Organizations will want to consult their legal counsel, but one initial consideration is creating an authorization or validation form that the guardian or parent must complete prior to access.

Questions that will help define processes include the following:

• Will the provider or the release of information staff give the authorization form to the parent?
• When will the authorization form be available (e.g., at the time of the visit with the provider or anytime by release of information staff)? How long is the authorization valid?
• Where will the forms be stored after completion? Will they be scanned or filed in the paper medical record?
• How will the form be validated (e.g., picture ID of parent or guardian, validation of the parental relationship)? Who will validate the form?

Some organizations have already created authorization requirements and forms, such as Froedtert and the Medical College of Wisconsin.^1,2 The Cleveland Clinic’s authorization form offers another example.³

HIM professionals play a strong role in successful implementation of a patient portal and parent proxy access to children’s records because they understand the complexity of state privacy laws, authorizations, release of information, and medical record documentation principles.

Proxy access requests will continue to grow, particularly as the population ages and Baby Boomers help with aging parents and grandchildren. As more providers move toward electronic health records and access to online medical records becomes more commonplace, parents of children and aging adults will look to proxy access as an expectation, not an option.

Notes

1. Froedtert, and Medical College of Wisconsin. “MyChart Family Access Proxy Availability and Paperwork Requirements.” Available online at https://www.mychartlink.com/mychart/en-us/docs/ProxyRequirements.pdf.
2. Froedtert, and Medical College of Wisconsin. “Parental Access to Electronic Medical Record of a Child Under 12 Request Form.” Available online at https://www.mychartlink.com/mychart/en-us/docs/ChildProxyRequest.pdf.
3. Cleveland Clinic. “Cleveland Clinic MyChart Proxy Access Request Authorization Form, Pediatrics.” Available online at http://my.clevelandclinic.org/Documents/eClevelandClinic/MyChartPediatricCaregiverApplication.pdf.

Sheila Green-Shook (sgreen-shook@evergreenhealthcare.org) is director of health information management at Evergreen Healthcare.