The Patient Portal Request from a Family Member
A 71-year-old patient with early-stage dementia attends a follow-up appointment with her adult daughter present. During the visit the daughter answers most questions and states she 'handles everything now.' After the visit the daughter calls the clinic's patient portal helpdesk, says she has her mother's login credentials, and asks the helpdesk to reset the password to an email address she controls so she can 'keep an eye on appointments and results.' The helpdesk agent can see the patient has a documented healthcare proxy, but the proxy document is a general financial power of attorney that does not mention health information. The patient has never been assessed for decision-making capacity. The clinic's portal policy permits proxy access only with a signed authorisation form.
1. Should the helpdesk agent reset the password? Analyse the competing obligations.
Read the worked answer
No - the agent should not reset the password to an address the daughter controls. Several distinct issues must be separated:
- Authentication vs. authorisation. Possession of credentials does not establish a right of access. Resetting credentials to a third party's email converts the daughter into the account holder and locks the patient out - this is an access-control decision, not a convenience request.
- The proxy document is inadequate. A financial power of attorney does not, by itself, authorise access to health information. The clinic's own policy requires a signed health-information authorisation, which has not been provided.
- Capacity has not been assessed. The patient's apparent reliance on her daughter in the visit is not evidence of incapacity. Until a capacity assessment is documented, the default is that the patient controls her own information.
- Coercion risk. Early dementia raises a real risk of undue influence; the clinic has a duty to protect the patient, not merely to satisfy the family.
Correct action: decline the reset, explain the proxy process, offer to help the patient complete the authorisation form at her next visit (with capacity-appropriate support), and document the call. Escalate to the privacy officer if the daughter persists.
2. The daughter becomes angry and says, 'I have a legal right to her records - I'm her power of attorney.' How should the agent respond, and what should be documented?
Read the worked answer
Response (scripted, calm, non-accusatory): 'I understand you're trying to help your mother, and I want to make sure we do this correctly. A financial power of attorney doesn't automatically cover health information. We need either a health-specific authorisation signed by your mother, or a documented capacity assessment and a health care proxy. I can't change her portal access today, but I can book a short appointment to set this up properly.'
Key points of the response:
- Do not argue law with the caller; state the clinic's requirement and the path forward.
- Do not confirm or deny specific clinical information during the call.
- Offer a concrete next step rather than a flat refusal.
Documentation should record: date/time, caller identity and relationship, the exact request, that the request was declined and why, the documents reviewed (and the gap in the POA), the patient's capacity status as 'not assessed', the information given to the caller, and any escalation to the privacy officer. Record facts, not judgements about the daughter's motives. If the daughter later obtains valid authorisation, that should be a separate, dated entry.