Creating a Guardrail System to Ensure Appropriate Activation of Adolescent Portal Accounts

The parent of an adolescent patient noticed an upcoming appointment in the patient's portal account that should have remained confidential to the parent. As it turned out, this parent was directly accessing their child's adolescent patient portal account instead of using a proxy account. After investigation of this case, it was found that the adolescent account had been activated with the parent's demographic (i.e., phone/email) information. This case illustrates the challenges of using adult-centric electronic health record (EHR) systems and how our institution addressed the problem of incorrect portal account activations.Confidentiality is fundamental to providing healthcare to adolescents. To comply with the 21st Century Cures Act's information blocking rules, confidential information must be released to adolescent patients when appropriate while also remaining confidential from their guardians. While complying with this national standard, systems of care must also account for interstate variability in which services allow for confidential adolescent consent. Unfortunately, there are high rates of guardian access to adolescent portal accounts which may lead to unintended disclosure of confidential information. Therefore, measures must be taken to minimize the risk of inadvertent confidentiality breaches via adolescent patient portals.Our institution implemented a guardrail system that checks the adolescent patient's contact information against the contact information of their parent/guardian/guarantor. This guardrail reduced the rate of account activation errors after implementation. However, the guardrail can be bypassed when demographic fields are missing. Thus, ongoing efforts to create pediatric-appropriate demographic fields, clearly distinguishing patient from proxy, in the EHR and workflows for registration of proxy accounts in the patient portal are needed.