The Patient Portal Message That Mentions a Family Member
You are an EHR support analyst at a multi-specialty clinic. A patient, Maria Alvarez, sends a portal message to her primary care provider stating: 'My husband Jorge has been having chest pain and shortness of breath for two days. He is your patient too. Can you look at his chart and tell me if he should go to the ER? He refuses to call.' Jorge is 58 and has a history of hypertension and a prior myocardial infarction. Maria is not listed as Jorge's authorized representative, and Jorge has not signed a release permitting discussion of his care with Maria. The message arrives at 9:15 AM; the provider is in procedures until noon.
1. What are the privacy and clinical considerations in responding to Maria's message, and what should you do first?
Read the worked answer
Privacy considerations:
- Jorge's PHI is protected; Maria is not an authorized representative and has no release on file, so you cannot disclose Jorge's clinical information to her.
- Acknowledging that Jorge is a patient or discussing his chart would itself be a disclosure.
Clinical considerations:
- Chest pain and shortness of breath for two days in a patient with prior MI and hypertension is a potentially life-threatening presentation. This is a time-sensitive safety issue.
First action: Route the message to the provider's clinical triage queue immediately and flag it as urgent, because the clinical risk is high even though the privacy constraint limits what can be said to Maria. Do not wait until noon. If the practice has a nurse triage protocol, escalate to the triage nurse now.
2. Draft a response to Maria that respects privacy while addressing the safety concern.
Read the worked answer
A compliant response would:
- Thank Maria for reaching out and express concern for the situation.
- Avoid confirming or denying that Jorge is a patient, and avoid any reference to his chart, history, or medications.
- Give general, non-patient-specific guidance: 'Chest pain with shortness of breath can be a medical emergency. Please call 911 or go to the nearest emergency department immediately, especially if symptoms are ongoing.'
- Encourage Jorge to contact the clinic himself or to authorize communication.
- Offer to have the provider follow up with Jorge directly if he calls.
Example wording: 'Thank you for your message. I'm concerned about what you're describing. Chest pain with shortness of breath should be evaluated emergently - please call 911 or go to the ER now. I cannot discuss another adult's care without their authorization, but if Jorge calls us, we can help him right away.'
This addresses the safety issue without disclosing PHI.
3. Jorge later calls and says, 'My wife told me to call. Can you tell her what's going on after my visit?' What must happen before any information can be shared with Maria?
Read the worked answer
Before sharing any information with Maria, the practice must obtain Jorge's authorization. Options:
- Jorge signs a HIPAA-compliant authorization naming Maria as someone to whom PHI may be disclosed, specifying the scope and duration.
- Jorge adds Maria as an authorized representative or portal proxy in the EHR, if the practice supports that.
- Jorge may give a verbal authorization during a call, but the practice should document it per policy and confirm scope.
Until then, staff may speak with Jorge directly but must not confirm his patient status or discuss his care with Maria. The authorization should be documented in the EHR and the portal proxy settings updated so future messages are handled consistently.