Variability in adolescent portal privacy features: how the unique privacy needs of the adolescent patient create a complex decision-making process

Abstract

Objective

Medical privacy policies, which are clear-cut for adults and young children, become ambiguous during adolescence. Yet medical organizations must establish unambiguous rules about patient and parental access to electronic patient portals. We conducted a national interview study to characterize the diversity in adolescent portal policies across a range of institutions and determine the factors influencing decisions about these policies.

Methods

Within a sampling framework that ensured diversity of geography and medical organization type, we used purposive and snowball sampling to identify key informants. Semi-structured interviews were conducted and analyzed with inductive thematic analysis, followed by a member check.

Results

We interviewed informants from 25 medical organizations. Policies established different degrees of adolescent access (from none to partial to complete), access ages (from 10 to 18 years), degrees of parental access, and types of information considered sensitive. Federal and state law did not dominate policy decisions. Other factors in the decision process were: technology capabilities; differing patient population needs; resources; community expectations; balance between information access and privacy; balance between promoting autonomy and promoting family shared decision-making; and tension between teen privacy and parental preferences. Some informants believed that clearer standards would simplify policy-making; others worried that standards could restrict high-quality polices.

Conclusions

In the absence of universally accepted standards, medical organizations typically undergo an arduous decision-making process to develop teen portal policies, weighing legal, economic, social, clinical, and technological factors. As a result, portal access policies are highly inconsistent across the United States and within individual states.

Introduction

Electronic health records (EHRs) and electronic patient portals could provide adolescent patients with opportunities for improved access to medical providers and personal health information.¹ Although portals can enable adolescents to take a participatory role in their healthcare, complex policies and confidentiality issues unique to adolescents raise serious concerns regarding adolescent privacy and access to care.²

Adolescence is a time when patients are approaching autonomy, both developmentally and legally. Yet as minors, they are likely to encounter contradictions between situations in which they are treated as children and adults. Clinically, adolescents are likely to have new and potentially sensitive medical needs, such as sexual and reproductive healthcare (eg, menstrual disorders, pregnancy and pregnancy prevention, sexually transmitted infection (STI) management, and sexual abuse).^3–5 Mental health visits also increase in prevalence during adolescence, as anxiety, major depression, bipolar disorder, and eating disorders often emerge during these years.⁶ Although parents have primary responsibility for their children’s health and well-being, studies have also found that adolescents need privacy and confidentiality when deciding whether or not to receive medical care, and how open to be with their providers.^7–11

For example, in a 2002 survey of over 1000 adolescent patients seeking prescribed contraceptives, more than half (59%) responded that they would stop seeking all sexual health services if their parents were notified. Importantly, of patients who would end health services, 99% said they would continue to be sexually active.¹² For reasons such as these, the Society for Adolescent Health and Medicine (SAHM) states that EHRs and patient portals need to take into account the unique privacy needs of the adolescent patient.¹³ The American Academy of Pediatrics (AAP) criticized current health information systems for insufficient protection of privacy and security of minors’ health information.¹⁴

In general, medical confidentiality requires that a provider may not reveal confidential information about a patient without the permission of the person who consented to the treatment.¹⁵ But privacy laws vary at the state level and are sometimes ambiguous about whether adolescents can control personal information.¹⁶ In some states, adolescents may consent to sensitive medical treatment and have privacy rights similar to those of adults, but the age of the adolescent, the types of treatments that the adolescent can consent to, and the limitations of their privacy may differ significantly. Other states may require parental control of consent and mandatory parental notification yet lack guidance on ways to protect adolescent privacy. In these ambiguous cases, community standards may ultimately dictate policies.¹⁶ Furthermore, many state laws were written before electronic patient portals routinely enabled patients to access their own medical records.

These differing state laws create a complex backdrop for portal policy decision-making. For example, according to New York law, minors may consent to all contraceptive services and STI services, except for HIV/AIDS treatment. In Alabama, minors over the age of 14 may consent to contraceptive services, and minors over the age of 12 may consent to STI services, including HIV/AIDS testing and treatment. The physician may, but is not required to, inform the minor’s parents of any STI services. In South Carolina, “mature” minors 15 and younger and all minors 16 and older may consent to all contraceptive services and all STI services, including HIV/AIDS. In Ohio, there is no relevant policy or case law dictating the minor’s ability to consent to contraceptive services; however, all minors may consent to STI services, including HIV/AIDS testing and treatment (the physician must report a positive test result to the parents if the minor is younger than 12).¹⁶

In addition to law, the needs of different patient populations factor into adolescent portal implementation decisions. For example, centers catering to patients with complicated health needs may expect family co-management more often than autonomous management. Britto et al.¹⁷ found that parents of children with a chronic disease felt that patient portals were beneficial, provided easier communication with care providers, increased their sense of control, and provided reassurance. Another factor in implementation decisions is the adolescent’s developmental capabilities and the ability to manage online health information. Adolescent patients new to managing their own health care may need guidance on how to manage this information appropriately. Parental and adolescent attitudes are important to consider as well. Gaskin et al.¹⁸ found that parents may be supportive of allowing their adolescents to have secure online access to their own health information. Bergman and colleagues¹⁹ found that parents and teens have “mixed feelings” about taking more control over their healthcare and want clinicians to take an active role in educating them on confidentiality.

Objective

The variability in medical organization policies governing adolescent access to electronic patient portals, even within a single state, prompted us to ask how different medical organizations across the United States are managing their adolescent patient portal access, and determine factors that influence the decision-making process for the implementation of patient portal access features. We also sought informants’ views on how organizational decisions about adolescent portal policy could be made easier.

Methods

We planned a semi-structured interview study. The eligibility criteria for key informants included having (a) direct knowledge of privacy-related clinical informatics policy at a medical center or large healthcare organization, and (b) experience serving in a leadership, contributory, or implementation role in that policy. We developed a sampling frame to ensure representation from the 4 census regions of the country (Northeast, Southeast, Midwest, and West) and different organizational types (pediatric vs non-pediatric hospital, academic vs non-academic medical center, public hospital, community health center, and ambulatory practice). We then used direct outreach to potentially eligible informants within the authors’ own professional networks and the AMIA membership database, with additional snowball sampling.

The semi-structured interview guide was developed with reference to the AAP 2012 policy statement on ideal principles for EHRs for minors and adolescents.¹⁴ It is focused on patient portal features that protect adolescent privacy and confidentiality. This guide includes questions on (a) medical organization type and patient population, (b) informants’ experience with electronic medical records and patient portals, (c) portal access policy for adolescents and family members, and (d) the decision-making processes through which each medical organization developed its policy. (Supplementary Appendix 1)

Interviews were conducted by telephone between February 3, 2017 and May 23, 2017. Interviewer 1 (MS) led all interviews, interviewer 2 (JSA) participated in approximately one third of the interviews, and interviewer 3 (LW) participated in one of the interviews. These interviews were audio recorded, and professionally transcribed. The 4 co-authors conducted thematic analyses of the transcripts,²⁰ first meeting as a group to review initial transcripts to develop a preliminary codebook. The authors subsequently met in pairs to review each transcript, followed by group meetings to resolve disagreements, revise the codebook in a constant comparative fashion, and interpret findings. In accordance with best practices in qualitative research, we conducted data collection and thematic analysis in tandem and concluded that thematic saturation had been reached after 25 medical organizations had been interviewed.^21,22 The preliminary results were presented back in memo format to all informants who indicated they wanted to participate in the member check;²³ representatives of 23 of the 25 organizations reviewed the results, made comments, and confirmed interpretations.

Informants representing 25 different medical organizations were interviewed, including 19 chief medical information officers; 1 informatics fellow; 4 physician portal directors; 3 adolescent medicine specialists; 1 nurse team manager; 1 privacy officer (a lawyer); 1 senior analyst, and 2 program managers. Medical organizations represented in interviews are listed in Supplementary Appendix 2.

This study was approved as minimal risk by the Weill Cornell IRB and determined to be exempt by the Georgia Tech IRB.

Results

Overview

The first section of the results looks at the variability of adolescent portal features implemented at the represented medical centers. After collecting and analyzing the information from the interviews, we created a table with various features of patient portal systems, such as the “age of adolescence” in the context of portal access; whether or not there is any access enabled during adolescence; and whether or not proxy access is permitted. We then completed the table for each of the medical centers represented in our study. The second section of the results looks into the decision-making process involved in the implementation of adolescent portals. The third section addresses potential sources of support in this complex process.

Variability of portal access features

Our analyses revealed tremendous diversity in policies governing adolescent portal access. Figure 1 provides information on the portal features implemented at the medical organizations interviewed in our study. This information was validated through the member check process with feedback from representatives of 23 medical organizations. The variability of portal features implementation is clearly demonstrated by the mosaicism in this table. There was variation in the level and control of access for the adolescent and the parent, and in the types of medical information included in the portal.

Figure 1.

Variability of portal access features.

A flowchart of portal access features implemented by the medical organizations interviewed is provided in Figure 2. Although most organizations offered some level of portal access during adolescence, 4 out of 25 organizations did not provide any type of portal access during adolescent years

Figure 2.

Flowchart of adolescent portal access features implemented by the medical organizations included in this study.

Although all organizations defined the age of adulthood at 18, the ages at which adolescent portal policies began were varied: the youngest age was 10 (n = 1); the oldest was 14 (n = 3); many used 13 (n = 8), while the most common age used was 12 (n = 13). One organization had two levels of adolescent access, one at 12 and another at 16.

Among the medical organizations that provided portal access during adolescence (n = 21), 1 prevented adolescents from obtaining their own portal account, and 1 allowed only a joint account between the parent and the adolescent. Of the 20 organizations that allowed adolescent accounts, 15 did not require parental permission for the adolescent to obtain portal access. In 12 of these, the medical information provided to the adolescent portal was more limited than in an adult portal, with the redaction of certain sensitive health information.

All 21 of the organizations with any portal access during adolescence allowed some access for the parents to their adolescent’s online medical information. There was notable variability in whether or not the parent needed permission from the adolescent to gain access and whether or not they would see the same content as the adolescent. Most of the organizations with adolescent accounts (n = 20) allowed the parent some level of access (n = 19), with only 1 center denying all access to the parent. Of the centers that allowed parental access, there was an almost even split between those that required adolescent permission or assent (ie, acknowledgement that the parent has access) (n = 9) and those that did not (n = 10). Of those that did not, all of them had very limited access for the parent, with most medical information redacted from view. However, a few of them allowed a higher level of access to the parents if permitted by the adolescent (n = 3). Interestingly, the representative from one medical center felt that it was unfair to put the adolescent in the position of having to decide on parental access at all.

Underlying themes in the adolescent portal access decision-making process

In order to understand how such dramatic diversity was found, our study enumerated the issues involved in the complex decision-making process regarding adolescent portal implementation. After conducting thematic analysis of our interviews, we identified multiple issues involved in this process.

We found that medical organization leadership were keenly aware of federal and state laws relevant to this issue, but that laws did not provide sufficient clarity to completely dominate decision-making about patient portal access. Instead, the legal environment was one of the 8 decision factors weighed.

Compliance with state and federal laws

Laws governing adolescent patient privacy were often referred to as factors in the decision-making process. The variation in privacy and confidentiality laws from state to state make it challenging to ensure legal compliance, especially considering that these laws were typically written before EHR’s became common use. Even within medical centers, patients covered by public insurance or federal funding may have different privacy guarantees than those covered by commercial insurance. When state laws and federal laws conflict, federal law generally applies if the visit is funded by a federal Title X program.

“It’s a complex patchwork from state to state. You have to figure out how federal law interacts with state law.”(Interview10)

When determining a medical center’s portal policies, those responsible for determining portal implementation find that state laws may or may not be compatible with current attitudes. One informant found that the applicable state law supported the medical organization’s adolescent access policies, while another informant, in a different state, felt that state laws were too restrictive.

“I really appreciate being in a place where we acknowledge the need for confidential care for our teens.”(Interview4)

“It is [state] law that provides a pretty uncomfortable backdrop for access to records issues for adolescents.”(Interview3)

Technology capabilities

Differing technology capabilities of EHR systems can determine the accessibility and potential implementation of various portal privacy features. Informants experienced different levels of communication with vendor representatives. Organizations can determine what features they would like to implement; however, if their EHR vendor cannot support these features, then they would need to re-establish more realistic goals. Informants often cited the need for more granular control and the ability to identify sensitive issues more clearly.

“It’s the technology that’s limiting us, not the hospitals trying to keep parents out.”(Interview18)

Adaptation to differing patient population needs

The needs of patient populations differ at different medical centers. A center primarily addressing sensitive health care for adolescent patients, such as STI testing and treatment, may be more oriented towards protecting patient privacy and fostering autonomy. However, a center caring for patients with complex chronic diseases, such as cystic fibrosis or diabetes, may be more focused on parental involvement and family co-management. These differing patient populations influence portal privacy decisions.

One of the medical organizations we interviewed was located in an urban setting with a high-risk patient population and felt that confidentiality at a younger age was essential to ensure that patients return for necessary sensitive health care.

“I know for a huge proportion of young people, they either don’t feel comfortable or they don’t feel safe that they can have that conversation in their family. If we don’t have that safety guard, we don’t make it possible for them to access that care. I wish that everyone would really be empowering the young person.”(Interview4)

Medical organizations caring for patients with complicated medical conditions, such as diabetes, focus on family co-management and the opportunity to use the portal as a tool to learn how to manage complicated medical conditions. For families relying on co-management for complex medical needs, any loss of access could have significant effects on the health management of the patient.

“We worked with our sub-specialists around empowering our kids with chronic disease. We use the patient portal as a way for teens to start learning about their condition.”(Interview18)

“The adolescent patients who most benefit from their parents having portal access are the chronic disease patients.”(Interview8)

We also heard from informants discussing the needs of particular patient populations, such as those in the foster care system, or those with significant developmental delays.

“I've been approached by our foster care system… about special healthcare information needs that population has because of their fragmented lives.”(Interview6)

Availability of resources (financial, time, and staff)

Since the decision-making process can be time and labor intensive, the limited availability of necessary resources, or the inability to prioritize resources into this decision-making process were cited as factors in a center’s ability to provide access to adolescent portals.

“The barriers are technology and manpower, not our lack of interest in getting adolescents on the portal.”(Interview11)

Community expectations

Expectations of community members can factor into how various privacy policies are interpreted and acted upon. These can vary depending on the particular community and the particular patient population.

“Those are very specific issues that each organization has to grapple with based on their culture, and their understanding of what state laws provide.”(Interview9)

Balance between access to and privacy of medical information

Being able to provide access to accurate and comprehensive medical information, while protecting the patient’s confidentiality was a commonly cited challenge. Although there are privacy issues inherent in all patients, particularly pertaining to sensitive medical information such as mental health and substance abuse, there are additional, unique privacy needs of the adolescent patient relating to parent proxy access and the specific state laws.

“Our guiding principle is the medical record as a communication tool between the patients and their doctors. To limit the availability of information doesn’t make sense.”(Interview8)

“We did not require the teen to consent for parental access because we spent months reconfiguring the [portal] so there’s nothing in there the teen would need to worry about.”(Interview18)

Safety and quality of care

Although it is vital to protect certain sensitive medical information, it also important to provide comprehensive medical information to the clinicians caring for the patient. For example, a mental health visit may be blocked from the portal; however, if a new medication is not included, that could have important implications in the patient’s care.

“We thought it was unsafe to have an incomplete medication list, allergy list or not a true representation of where you’ve been in the hospital.”(Interview8)

Health information exchange

With increased use of health information exchange, having varying policies on adolescent privacy leads to inconsistent management of sensitive medical information. This could result in an unintended breach of privacy.

“If we had to send [information] out of state where they were not required to stick to the same rules regarding confidentiality… that would be a risk.”(Interview4)

Congruity with paper record access policies

One subtheme was the need to avoid inconsistency between how privacy issues are handled in the EHR and how they are handled through printed medical records.

“It makes no sense to build a system where the adolescent has portal access and the parent does not, but the parent can walk to medical records and say, ‘Give me this record.’”(Interview12)

Balance of autonomy and family shared decision-making

Autonomy and empowerment of the adolescent patient are often considered ideals to strive for in patient medical access, however family shared decision-making has an important role as well. Differing developmental phases can factor into this balance.

“It’s about including the parent but empowering the teen, and excluding the parent when it’s appropriate.”(Interview18)

“We’re going to encourage you to take ownership of this and control it. If you want your parent to co-manage your disease with you then this is your way to say yes.”(Interview8)

“I mean gosh, we all know 16-year-olds who really shouldn’t be in charge of anything.”(Interview20)

Tension between teen privacy and parental preferences

Parents are not always aware of the multiple issues involved in adolescent privacy and can be frustrated and confused by changes in the portal access once the patient becomes an adolescent. There can be different expectations and tolerances of an adolescent’s right to privacy, and parents may have strong personal opinions on how access should be managed. One medical organization cited the pressure of parents demanding access to their teens’ portals as the reason for not having any portal access during adolescence.

“That could set up a vertical hierarchy in terms of the pressures coming from the parents that adolescents give them their passwords. So ultimately, we put it to bed and just said, ‘there isn’t any access.”(Interview2)

“I did some focus groups with parents. I heard the whole spectrum. Some saying, ‘I hope that my teen will come and talk to me, but if they don’t, I want them to talk to their doctor, they need to know it’s a confidential conversation.’ And the other end saying, ‘I want to be the first person who knows if my teen is depressed. If it’s a question of figuring out what their password is, I will do that.”(Interview25)

Potential sources of support during the decision-making process (Table 1)

Table 1.

Underlying themes and potential sources of support in the decision-making process

	Underlying Themes in the Decision-Making Process
1	Compliance with state and federal laws
2	Technology capabilities
3	Adaptation to differing patient population needs
4	Availability of resources
5	Community expectations
6	Balance between access to and privacy of medical information
	a. Safety and quality of care
	b. Health information exchange
	c. Congruity with paper medical records access policies
7	Balance of autonomy and family shared decision-making
8	Tension between teen privacy and parental preferences

	Potential Sources of Support in the Decision-Making Process
1	Policies and guidelines
	a. State versus federal
	b. Panel members
	c. Guideline concerns
2	Other medical organizations
3	Functional standards
4	Technology innovations
	a. Granular control of information
	b. Clear identification of sensitive information
	c. Guarantee of privacy control
5	Research
6	Education and communication
	a. Parental and community education
	b. Medical staff education and communication with EHR vendors
	c. Dissemination of best practices among medical organizations

During our interviews, we asked informants about possible sources of support in this decision-making process. We asked if additional guidelines would be helpful, and who should be trusted with creating them. We learned about current sources of support, such as nearby medical centers and policy statements from medical associations. Other potential sources of support include functional standards, technological innovations, research and education, along with improved communication.

Policies and guidelines

Although current policy statements, such as those from the Society for Adolescent Health and Medicine and the American Academy of Pediatrics, were mentioned as helpful resources by several informants to help guide this portal access decision process, most informants reported that more guidance on portal system implementation could make this decision-making process easier.²⁴

“We did a review of the literature. I put a lot of weight into guidelines published by the Society for Adolescent Medicine, I feel like our approach is in line with what they advocate.”(Interview5)

“We’re all making this up as we go along.”(Interview11)

Although many informants believed that clearer standards could simplify their own organizational policy-making, there were also concerns about such guidelines. There were doubts about the ability to reconcile varying patient population needs and state laws; questions as to who should be entrusted to create the guidelines; and concerns about how they would impact their own medical organization. Some centers would welcome them while others thought that their own process had helped them establish an optimal policy, which might be undermined by national standards.

State versus federal guidelines

Although many informants felt that national guidelines could be helpful, they also felt that these guidelines would be challenging to create due to the wide variation in state laws.

“There could be policies to ease the burden on the clinicians so they can actually get their work done within the constraints of the law.”(Interview1)

“I mean you’re not going to take those laws in California and try to apply them in Montana; it’s not going to work.”(Interview20)

Panel members

The informants were asked whose perspectives should be included to determine policy. Suggestions included pediatricians, adolescent specialists, psychologists, nurses, administrators, medical associations, patients, patient rights advocates, parents, legal representatives, privacy experts, vendor representatives, informaticists, government representatives from the Office for Civil Rights and the Office of the National Coordinator for Health Information Technology (ONC), the Society for Participatory Medicine, and the American Civil Liberties Union (ACLU).

“Pediatricians, informaticists and privacy experts would probably be the best, and we’ll need some governmental representatives from both the Office of Civil Rights as well as the ONC because we’re struggling with this.” (Interview2)

Guideline concerns

Several informants voiced concerns regarding mandatory national guidelines. These included concerns that guideline policies would conflict with current medical organization policies; that guidelines would just be ignored without “teeth” (eg, certification requirements); and that the level of detail dictated by the guidelines would be too overwhelming for medical centers with limited resources.

“These have to be thoroughly vetted because the people involved in the care of these patients feel strongly about how they should be implemented.”(Interview6)

Other medical organizations

Several informants reported looking to other centers for models of successful portal systems. These organizations were at times larger, more academic, had a larger pediatric population, or had particular features they wanted to implement.

“They [a nearby medical organization] did a lot of the legwork establishing the boundaries that were appropriate for state guidelines, so it made it a lot easier for the rest of us.”(Interview3)

Functional standards

Creating a standards body for EHR vendors was cited as a way to provide long-term consistency.

“The ultimate thing would be to put it out there from a standards body. This way it will live forever.”(Interview9)

Technology innovations

Many informants felt frustrated by the lack of necessary technology support to be able to granularly control the information in the portal and thereby control sensitive information and guarantee privacy for their patients.

“If [you could say to your EHR vendor] “Yes, I want teen access feature”, and then it sets it up in the right way for your bucket of states, that would be a dream.”(Interview22)

Granular control of information

The ability to granularly control which information is allowed into the patient portal is crucial to be able to limit the release of sensitive information.

“We’d like to have more granularity, but it’s a complex thing. The technology hasn’t caught up with the dynamic changes in this.”(Interview17)

Clear identification of sensitive information

We heard from several informants that not only is it difficult to reliably filter out sensitive medical information, it is also difficult to know which information needs to be filtered out since a clear list of sensitive data for the adolescent patient does not exist.

“We have had our setup since 2003 and we do not have it set up with the ability to identify sensitive information…If they didn’t want any alcohol, substance abuse, mental health, HIV related information, there would be very little we could send because it is deeply entwined within the charts.”(Interview4)

“We don’t have a way to inform them that this data element is, to us, a sensitive data element. There’s no agreement on what a sensitive lab is. You can’t find that.”(Interview9)

Guarantee of privacy control

Even if sensitive information has been reliably identified and controlled, there is still a need to control who has access to the information.

“Sharing through health information exchange is very difficult, because you can’t say, ‘I want to share this with this audience, but I don’t want to share this.’”(Interview10)

Research on benefits of adolescent portal access

There is a need for further research to evaluate the benefits of portal access for adolescents and to evaluate the benefits of particular portal access features for the patient and the patient’s family. This research could help justify the efforts of the medical organizations to establish appropriate portal access for their adolescent patients.

“We looked at the literature around adolescent portal use quality metrics - I could find almost no literature on that. Many of us feel like it’s the right thing to do. There’s just no literature to back that up.”(Interview5)

Education and communication

Due to the complexity of providing effective portal access while addressing privacy concerns unique to adolescent patients, education is paramount to ensure that portal access policies are understood. This includes outreach to the community, education among medical center staff and effective communication with the EHR vendor. Communication among different medical centers could help promote a more unified approach to this challenging issue.

Parental and community education

Educational outreach to the community could foster a better understanding of the complexity inherent in adolescent privacy, differing portal features, optimizing patient portal usage, and others.

“We’re not - as an organization, but also as a society – explaining opportunities, constraints, law, all those things.”(Interview12)

“I don’t see enough attention on how to use this access to information to empower them to be involved in their health care.”(Interview25)

Medical staff education/communication with the vendors

Communication between the medical staff and the EHR vendors could encourage informed decisions when implementing patient portal systems.

“There’s a base model, but then there’re many revisions. No one knows that they exist. People that are most vested in adolescent health and confidentiality don’t even know.”(Interview23)

Dissemination of best practices between various medical organizations

Promoting communication among medical centers can help foster consistency in adolescent portal access and provide support for centers looking for guidance in the decision process.

“Initially we had a lot of people reach out to us and we helped them, and then later we’re reaching out to them because they’ve implemented some really great feature that we don’t have yet. Establishing relationships like that can be really important to build. ” (Interview19)

“Trying to find other centers that had given some amount of access to either proxies or parents or teens, and wanting to learn from their process. We had a hard time finding places. It was kind of a snowball sample, although it didn’t snowball very far.”(Interview25)

Discussion

In the setting of limited national policy and guidelines on privacy and confidentiality goals for the implementation of adolescent portals, medical centers must negotiate the challenges of providing the appropriate level of access on their own. Due to the unique privacy needs of the adolescent patient, these challenges are complex, and the decision-making process demands significant resource allocation in time, staff and technology. In this context, it is not surprising that the centers ended up establishing extremely variable policies. As enumerated in our paper, there are multiple issues involved in this process beyond varying state and federal laws.

Due to this complex process, along with little national guidance, the portal policies implemented in medical centers across the United States vary widely. Adolescents could have full access to their own account, partial access to certain data elements and functions, or no access. Similarly, parents could have full access to the adolescent medical record, partial access to certain types of data, or no access at all. Some organizations, concerned about the complexities of the issue and the potential for confidentiality breaches, preferred to shut down electronic portal access altogether during the adolescent years. Medical organizations struggled to define which types of information were “sensitive” and in need of higher privacy standards during adolescence, and ultimately the organizations ended up with quite different lists. It is interesting to note that, despite the focus on patient privacy features in our interview guide, many informants still commented on the value of providing access to medical information for the parents as well the adolescent patient.

This variability of portal implementation in the setting of a lack of education and communication could have significant implications for adolescent patients and their families. Inconsistent privacy protection can leave the adolescent vulnerable to breaches of privacy. Conversely, such inconsistencies could threaten adolescent well-being by preventing access to parents who have legitimate needs to access their children’s records.

Unfortunately, most EHR systems do not provide sufficient granular control over sensitive medical information to enable the privacy protection necessary for sensitive medical care.^25–29 This creates a difficult situation for medical organizations who do not have the technological capabilities to support adequate privacy control.²⁶ A clearer understanding of technology options through education and communication between providers and vendor representatives is needed. Some informants at organizations with limited or no teen portal access felt that enforceable guidelines and increased vendor support would enable them to implement an updated portal system with better privacy protection for their patients.

Privacy issues related to portal access implementation and the need for greater granular control are not limited to the adolescent population. This is particularly apparent in the area of mental health care which has regulations providing additional confidentiality protection to psychotherapy notes. It is very important for medical centers to reliably identify and control the disclosure of mental health notes for all patients,³⁰ especially considering the broadening use of OpenNotes. According to one study on OpenNotes, approximately one third of patients had concerns about a loss of privacy when accessing visit notes through patient portals; however, those concerns did not deter them from accessing their information online.³¹

The lack of standardization of functionality in portal implementation can be found in all patient populations, with a wide variety in portal policies and decision-making structures.^32,33 Additional research and financial support is needed to fully realize the potential benefits of online access to health information.³⁴ Considerations regarding the type of information to release in a patient portal and the timing of this release must take into account potential harm to patients and their families.³⁵ There is currently a lack of consistency in the sensitive data that are made available and the time frame for releasing these data to patients.³⁶ There is also a need to protect the parent’s health information in the adolescent portal considering that family history may include information about sensitive family genetic history, substance abuse, or STI’s.²⁹ Until professional standards are developed and technology reliably protects patient privacy, professionals within organizations must take on the responsibility of privacy protection.³⁰

The implementation of the patient portal for pediatric patients is still in its early stages and, considering the additional privacy issues inherent in this portal system, has yet to be used for outcome measurements.³⁷ There has been little research looking at the effects of differing portal systems on the usage and quality of care for the adolescent patient. A recent article by Thompson et al.³⁸ categorized portal system as designed to promote either confidentiality, family engagement, or parent orientation. With a specific patient portal designed to maximize adolescent confidentiality, adolescents readily used the portal system.

In the absence of education and clear explanations of adolescent portal policy, parents may be surprised and even outraged when they abruptly lose access to their child’s patient portal account. For an adolescent with complicated medical needs who relies on parent co-management, this could have serious health consequences for the patient. Parents are likely to encounter inconsistent policies from one medical organization to another and may or may not agree with laws governing teen privacy control.

Electronic health information exchange could create novel problems, since medical information traveling between different medical organizations and crossing state lines may be subject to different policies on privacy. An adolescent patient may disclose sensitive medical information with a provider in one setting, only to find that this information is no longer protected in a different setting. This could place the adolescent in a dangerous situation and undermine his or her trust in the medical system.

Although many of our informants would eagerly accept more formal assistance in this process, they conceded that this would not be an easy goal to accomplish. Due to the varying state laws and community expectations, overarching national guidelines would be difficult to create. When asked who would be best to address this issue, our informants offered an extensive list of potential stakeholders. Several also reported that these guidelines would need to be vetted thoroughly by those involved in adolescent care and be adaptive enough to accommodate differing state laws and community expectations.

Further evidence and discussion is needed to determine basic, common goals of privacy for the adolescent in the context of patient portal access. A stronger evidence base around the risks and benefits of adolescent confidentiality could potentially support efforts to align portal systems with recommendations from medical associations, state laws, community expectations, and patient population needs.

Our study has several limitations. Our research group determined that we had achieved thematic saturation on the decision-making process after interviewing 25 medical organizations; a larger sample size may have revealed additional factors. The use of snowball recruitment might have referred us to informants with similar views, and we could have missed accessing informants with more varied attitudes. This recruitment approach also limited the expanse of our geographic area with overrepresentation in certain areas, such as Ohio and California. We also had a limited representation of EHR software, with Epic representing two-thirds of our EHR systems. Also, it would have been helpful to have a categorization of the medical centers based on the length of their experiences implementing portal systems. As with any qualitative study, findings should be considered descriptive rather than causal.

Conclusion

Patient portals offer promise for helping adolescent patients become engaged in their health and their healthcare. However, there is no centralized guidance about adolescent portal access, and medical organizations weigh at least 8 factors to develop policies appropriate for their own patient populations and situations. Not surprisingly, there is striking variation in the way portal access in adolescence is handled across the country. The resulting diverse and complex privacy policies could have important implications for patients, parents, providers, and medical organizations. With the increased use of patient portals and health information exchange, addressing inconsistency in privacy policies is important in order to prevent inadvertent breaches of adolescent privacy and to increase adolescent and parental trust in the medical system. Differing access policies can leave adolescents and parents feeling frustrated, and abrupt changes in access levels can adversely affect the health management of the patient.

There is no simple way to reconcile the diversity of adolescent portal access in the United States. Differing patient populations and medical organization resources, incompatible state laws, and varied community standards dictate privacy policies. Communication, education, research and technological support are essential to the process of handling this diversity. As a society, we may need to delineate basic goals of privacy protection for the adolescent patient and educate both parents and adolescents in this rapidly evolving landscape of electronic health records, mobile health technology, and health information exchange.

Funding

This work was supported by AHRQ K01 grant number HS021531 (PI: JS Ancker) and by NSF CAREER grant number 1652302 (PI: L Wilcox).

Contributors

Each author listed has contributed to the concept and design of the work, the analysis and interpretation of data, and the revision of the work for important intellectual content. Each author has also provided final approval of the version to be published and agreed to be accountable for all aspects of the work.

Competing interests

None.

SUPPLEMENTARY MATERIAL

Supplementary material is available at Journal of the American Medical Informatics Association online.