Proxy Access, a 16-Year-Old, and a Waiting Room

Contain, then design.

• Own the disclosure. The privacy officer and legal run the disclosure analysis; risk management and the treating clinician contact the family. Preserve portal access logs and the result-release record. Do not alter the chart to tidy the story.
• Do not shut off proxy access network-wide as the reflex. That penalizes every family for one failure, damages engagement, and would itself remove access from parents who are lawful personal representatives for non-sensitive care. It also invites a different complaint.
• Do apply a targeted restriction within days. Hold sensitive result categories - STI, pregnancy-related, designated mental health results - from release to proxy accounts until configuration is designed. Label it a temporary control with an owner and a review date, not a permanent policy.
• Convene the right group: privacy officer, legal, HIM, ambulatory clinical leadership, the portal analyst, and someone who can credibly speak for adolescents. This is not an IT-only decision, and the analyst should not be deciding what counts as confidential.
• Get the state rules confirmed in writing before designing anything. If the network operates across state lines, the design must be jurisdiction-aware from the start rather than retrofitted later.

Age-tiered, category-based, and legally anchored.

• Age tiers: full proxy access roughly 0–11; limited access 12–14 covering appointments, immunizations, chronic-care medication and allergy lists, and messaging, with sensitive categories suppressed; much narrower access 15–17, defaulting to suppression of the categories the state places under the minor's control, restored only if the minor consents.
• Category-level suppression, not whole-chart blocking: sensitive diagnoses and problem-list entries, the medications tied to them, results, visit notes and after-visit summaries, referrals, and secure messages on sensitive topics. Then test the leakage paths - the AVS document, message attachments, and interface feeds are where suppression usually fails even when the portal screen looks correct.
• Decision rights: clinicians and legal decide what is sensitive and what the law requires, recorded in written policy. IT configures what policy says. Building this the other way around is how you get an analyst making a legal judgment at 5pm on a Friday.
• Two identities, one relationship: the adolescent needs their own portal account with age-appropriate identity proofing, plus a proxy grant the minor can give or revoke.
• The awkward case: the parent is often the subscriber and will see billing detail. Decide the policy and write the front-desk script, because staff will be asked directly.

Validate with scenarios, not unit tests. Build test patients at ages 11, 13, 16, and 18 in each sensitive category. For each one, verify what the mother's proxy sees, what the father's proxy sees, what the adolescent's own account sees, and what leaves the building through the after-visit summary, the health information exchange feed, and any external API.

Scenarios that catch real failures: legacy data (did suppression apply retroactively or only to new results?), a minor who consents to share, a minor who later revokes, a guardian or foster-care arrangement, and the help-desk script read aloud by someone who has never seen the policy.

Ongoing measures:

• Unauthorized-disclosure incidents and complaints, with time to resolution.
• Percent of adolescent charts with the correct confidentiality configuration, sampled monthly.
• Positive control: percent of sensitive results correctly withheld from proxy view.
• Negative control: percent of non-sensitive results still delivered - over-suppression is the quieter failure, and it drives families away.
• Adolescent portal account activations and use.
• Parent satisfaction and help-desk volume, to catch usability fallout early.
• Front-desk spot checks: can staff explain the policy correctly to a parent who is angry?