After enactment of the 21st Century Cures Act, many health care systems offer adolescents and parents access to electronic health information through online portals. Few studies have evaluated adolescent portal access policies since the implementation of the Cures Act.
We performed structured interviews with informatics administrators in US hospitals with ≥50 dedicated pediatric beds. We performed thematic analysis of challenges to developing and implementing adolescent portal policies.
We interviewed 65 informatics leaders representing 63 pediatric hospitals, 58 health care systems, 29 states, and 14 379 pediatric hospital beds. Most hospitals provided portal access to adolescents (86%) and parents (95%). Filtering of results sent to parental portals ranged widely, with 14% providing unfiltered access, 31% performing minimal filtering for sensitive information, and 43% offering limited access. Portal access policies also varied widely within states. Challenges to developing policies included legislation and compliance issues, tension between confidentiality and usefulness, clinicians’ preferences and concerns, limited understanding and investment of institutions in pediatric issues, and limited focus of vendors on pediatric issues. Challenges to implementing policies included technical challenges, educating end-users, potential for parental coercion, harms of bad news, complex enrollment processes, and informatics workforce limitations.
Adolescent portal access policies vary widely across and within states. Informatics administrators identified multiple challenges related to developing and implementing adolescent portal policies. Future efforts should strive to develop intrastate consensus on portal policies and to engage parents and adolescent patients to better understand preferences and needs.
Portal access policies for adolescents and their parents vary widely across the country because of differing state confidentiality laws. Informatics administrators struggle to balance transparency and functionality of the portal with the need to protect adolescents’ confidentiality.
Hospitals within the same states have inconsistent portal policies, despite adhering to the same laws. Challenges identified by informatics administrators highlight the need to develop intrastate policy consensus, engage families, and advocate to institutional leadership and electronic health record vendors.
The 21st Century Cures Act prevents health care systems from information blocking, supporting the foundational principle that patients, including adolescents, have the right to access clinical information.1 Many health care systems offer adolescents and parents access to clinical information through online patient portals, a widely available tool that can improve patients’ sense of control,2–5 adherence,2 and medical understanding.3,4 However, access to adolescents’ portals generates unique challenges, which has led to varying institutional approaches in portal access policies.6 The mandated transparency of the 21st Century Cures Act has forced institutions to further re-evaluate adolescent portal access policies, potentially leading to more variability.
As adolescents mature, their information needs, level of autonomy, and privacy concerns change. To protect confidentiality, each state has adolescent confidentiality laws. Categories of protected information vary by state, but generally include information about reproductive health, substance use, sexually transmitted illnesses, and mental health.7,8 Portals represent an opportunity to engage adolescents in health care, but also risk divulging confidential information to parents.9,10 When adolescents have concerns about confidentiality, they are less likely to engage with clinicians transparently.11,12 Yet, US public opinion supports the ability of parents to access adolescents’ health care records,13 and parental access can help adolescents manage their health care needs, especially for adolescents with chronic medical conditions. For adolescent portals to be effective and ethical, they must be useful while also maintaining the adolescents’ confidentiality.14–16
Although prior studies have demonstrated wide variability in adolescent portal access policies6,17 and state confidentiality laws,8 no studies have engaged informatics administrators to understand their challenges in developing and implementing adolescent portal access policies. Furthermore, these studies of policies predated the implementation of the 21st Century Cures Act final rule mandating transparency. To characterize current policies and understand challenges with developing and implementing policies, we interviewed 65 informatics administrators from children’s hospitals across the United States.
Methods
Participants and Recruitment
We interviewed informatics administrators using a structured interview guide. Participants were eligible if employed by a health care system that managed a US children’s hospital with ≥50 dedicated pediatric beds and if they were informatics administrators involved in developing or implementing adolescent portal policies. Specialty and rehabilitation hospitals were ineligible. We identified children’s hospitals using the Children’s Hospital Association’s database in January 2022 (https://www.childrenshospitals.org/hospital-directory#). Of 232 children’s hospitals, we excluded specialty or rehabilitation hospitals (n = 37), non-US hospitals (n = 7), and hospitals with <50 pediatric beds (n = 9), yielding 179 eligible hospitals. We posted recruitment materials through 2 informatics e-mail groups and simultaneously identified contact information for informatics administrators through publicly available data. We emailed administrators at every eligible children’s hospital to request interviews. We obtained verbal informed consent. The institutional review board at Washington University approved this study.
Data Collection
We identified the number of pediatric beds from the Children’s Hospital Association’s database, supplemented with information from hospital Web sites. Based on literature review and engagement with informaticians, we developed a structured interview guide that explored adolescent portal policies, factors influencing the development and implementation of policies, and approaches to engaging adolescents through portals (Supplemental Appendix 1). We revised the interview guide with a stakeholder advisory board and 3 informatics administrators. This stakeholder advisory board included 4 physicians with combined expertise in informatics, primary care, adolescent medicine, and endocrinology, as well as an adolescent with chronic illness and their parent. B.A.S., a pediatric oncologist and communication researcher with training in qualitative research, conducted interviews between February and July 2022 via telephone or video-conferencing software. Interviews were audio-recorded and professionally transcribed.
Data Analysis
We characterized portal access policies through structured interview questions, including age of adolescent access, requirements of adolescent assent and/or parental consent, whether parents were permitted proxy access, level of proxy access, level of adolescent access, and whether parents and adolescents had identical access to portal data. We defined level of adolescent and proxy access as unfiltered access, minimal filtering (eg, sensitive results filtered, but majority of medical records available to proxy), limited access (eg, proxy restricted from viewing most of medical records), or no access. For states with ≥2 health care systems represented in this study, we evaluated whether portal policies were the same (ie, consistent) or varied (ie, inconsistent) at different health care systems in the same state. We considered states inconsistent if at least 1 health care system had a policy that differed from other systems in that state.
We employed thematic analysis18 of challenges to developing and implementing adolescent portal policies. B.A.S. and A.A. (1) read transcripts to familiarize themselves, (2) descriptively coded 5 transcripts to formulate preliminary codes, (3) grouped codes into categories and collapsed categories into representative themes, and (4) refined definitions for themes through 3 cycles of independent coding and consensus meetings. After reviewing 25 transcripts, we reached saturation for representative themes. Using this final codebook (Table 1), B.A.S., C.B., and M.E. independently coded all transcripts, reviewed the other’s application of codes, marked disagreements, and resolved disagreements through discussion. We used Dedoose qualitative software.
Code Definitions for Challenges to Developing and Implementing Adolescent Portal Policies
Challenges to Developing and Implementing Adolescent Portal Policies . | |
---|---|
Alignment of diverse interests in developing policies | |
Legislation and compliance issues | Every state has its own laws pertaining to adolescent confidentiality, and every hospital has its own legal and compliance team that interprets these laws in the context of the federal law. Many administrators described tensions with legal or compliance officers who often prioritized limiting exposure of the institution to legal risk. Additionally, administrators described how different hospitals in the same state had varying interpretations of the same law, leading to different access policies. |
Tension between adolescent confidentiality and parental care needs | Administrators described challenges with disclosing information to parents that supported management of the adolescents’ health with the need to protect the adolescent’s confidentiality. Given technological limitations, many administrators described the need to prioritize either adolescent confidentiality or parental disclosure. Administrators also described how these tensions can change over time as the adolescent matures. Some administrators worried that rapid access to sensitive or concerning results could lead to anxiety or stress for families. |
Clinicians’ preferences and concerns | Administrators described how some clinicians were hesitant to provide access to adolescents and/or parents and wanted a prominent role in determining which adolescents and parents received access to the portal. |
Limited understanding and investment of institution in pediatric issues | Administrators described a lack of institutional support or prioritization of pediatric-specific issues when designing portal access policies. This was especially true for children’s hospitals that were integrated into a larger adult hospital (as opposed to a free-standing children’s hospital). |
Limited focus of vendors on pediatric issues | Administrators described how vendors did not appear to invest in modifications needed to address pediatric or adolescent specific access challenges. Some administrators believed this lack of investment related to varying adolescent confidentiality laws across states. |
Implementation of policies | |
Technical challenges and limitations | Many administrators noted the inability of existing systems to permit sufficient granularity to appropriately share data with adolescents and their parents. Additionally, administrators described the challenge of mapping which data points are shared with which users and identifying the myriad ways in which sensitive data might become visible to proxy accounts. Physicians also can struggle with technical or workflow limitations within the portal. Administrators also described challenges related to interoperability, ie, the ability of electronic medical records at different institutions to communicate and exchange data. |
Educating end users | Administrators described the challenge of educating clinicians about how to appropriately document sensitive information, share appropriate results, and help families to enroll. Also, parents and adolescents need to learn how to register, access, and make use of clinical information from the portal. |
Potential for parental coercion or bypassing safeguards | Despite best efforts to preserve confidentiality, administrators described how parents might bypass these safeguards by using the child’s credentials to access the adolescent portal. Similarly, parents might coerce the child into grant proxy access at times against their best interests. |
Harms of bad news or misinterpretation | With rapid access to results, some administrators worried that adolescents could feel emotional distress if they receive worrisome results without clinician or parental support. |
Complexities of enrollment process | To ensure parents were not signing up for adolescent accounts, some administrators had to create enrollment processes that were onerous for families. |
Informatics workforce limitations | Some of these technical limitations were surmountable with sufficient investment of workforce effort, but administrators described how they did not have sufficient workforce to make these changes. |
Challenges to Developing and Implementing Adolescent Portal Policies . | |
---|---|
Alignment of diverse interests in developing policies | |
Legislation and compliance issues | Every state has its own laws pertaining to adolescent confidentiality, and every hospital has its own legal and compliance team that interprets these laws in the context of the federal law. Many administrators described tensions with legal or compliance officers who often prioritized limiting exposure of the institution to legal risk. Additionally, administrators described how different hospitals in the same state had varying interpretations of the same law, leading to different access policies. |
Tension between adolescent confidentiality and parental care needs | Administrators described challenges with disclosing information to parents that supported management of the adolescents’ health with the need to protect the adolescent’s confidentiality. Given technological limitations, many administrators described the need to prioritize either adolescent confidentiality or parental disclosure. Administrators also described how these tensions can change over time as the adolescent matures. Some administrators worried that rapid access to sensitive or concerning results could lead to anxiety or stress for families. |
Clinicians’ preferences and concerns | Administrators described how some clinicians were hesitant to provide access to adolescents and/or parents and wanted a prominent role in determining which adolescents and parents received access to the portal. |
Limited understanding and investment of institution in pediatric issues | Administrators described a lack of institutional support or prioritization of pediatric-specific issues when designing portal access policies. This was especially true for children’s hospitals that were integrated into a larger adult hospital (as opposed to a free-standing children’s hospital). |
Limited focus of vendors on pediatric issues | Administrators described how vendors did not appear to invest in modifications needed to address pediatric or adolescent specific access challenges. Some administrators believed this lack of investment related to varying adolescent confidentiality laws across states. |
Implementation of policies | |
Technical challenges and limitations | Many administrators noted the inability of existing systems to permit sufficient granularity to appropriately share data with adolescents and their parents. Additionally, administrators described the challenge of mapping which data points are shared with which users and identifying the myriad ways in which sensitive data might become visible to proxy accounts. Physicians also can struggle with technical or workflow limitations within the portal. Administrators also described challenges related to interoperability, ie, the ability of electronic medical records at different institutions to communicate and exchange data. |
Educating end users | Administrators described the challenge of educating clinicians about how to appropriately document sensitive information, share appropriate results, and help families to enroll. Also, parents and adolescents need to learn how to register, access, and make use of clinical information from the portal. |
Potential for parental coercion or bypassing safeguards | Despite best efforts to preserve confidentiality, administrators described how parents might bypass these safeguards by using the child’s credentials to access the adolescent portal. Similarly, parents might coerce the child into grant proxy access at times against their best interests. |
Harms of bad news or misinterpretation | With rapid access to results, some administrators worried that adolescents could feel emotional distress if they receive worrisome results without clinician or parental support. |
Complexities of enrollment process | To ensure parents were not signing up for adolescent accounts, some administrators had to create enrollment processes that were onerous for families. |
Informatics workforce limitations | Some of these technical limitations were surmountable with sufficient investment of workforce effort, but administrators described how they did not have sufficient workforce to make these changes. |
Results
Participant and Health Care System Characteristics
We performed 58 total interviews, which included 65 informatics experts representing 63 hospitals across 58 health care systems. In 7 interviews, 2 informatics administrators participated in the same interview to ensure they could represent the full context of adolescent policies. Interviews ranged from 12 to 43 minutes (mean 24 minutes). The number of dedicated pediatric beds in participating hospitals ranged from 51 to 664 beds (median = 189, interquartile range = 107–313). In total, participants represented systems with 14 379 dedicated pediatric beds across 29 states plus Washington DC (Fig 1 and Table 2). Hospitals that used Epic had an average of 226 pediatric beds and hospitals that used other electronic health record (EHR) vendors averaged 236 pediatric beds.
Map of represented pediatric hospitals. Each black dot indicates a pediatric hospital that had a representative participate in our interview study.
Map of represented pediatric hospitals. Each black dot indicates a pediatric hospital that had a representative participate in our interview study.
Characteristics of Participants and Represented Health Care Systems
Characteristic . | n (%) . |
---|---|
Professional role of participant | |
Chief medical information officer | 34 (52) |
Clinical informaticist | 15 (23) |
Chief information officera | 3 (5) |
Otherb | 13 (20) |
Type of electronic health record | |
Epic | 41 (70) |
Cerner | 9 (16) |
Multiple | 5 (9) |
Allscripts | 1 (2) |
Other | 2 (3) |
Pediatric-specific informatics team | |
Yes | 31 (53) |
No | 27 (47) |
Pediatric-specific instance of EHRb | |
Yes | 20 (34) |
No | 38 (66) |
Number of dedicated pediatric hospital beds | |
Range | 51–664 |
Median (interquartile range) | 189 (107–313) |
Characteristic . | n (%) . |
---|---|
Professional role of participant | |
Chief medical information officer | 34 (52) |
Clinical informaticist | 15 (23) |
Chief information officera | 3 (5) |
Otherb | 13 (20) |
Type of electronic health record | |
Epic | 41 (70) |
Cerner | 9 (16) |
Multiple | 5 (9) |
Allscripts | 1 (2) |
Other | 2 (3) |
Pediatric-specific informatics team | |
Yes | 31 (53) |
No | 27 (47) |
Pediatric-specific instance of EHRb | |
Yes | 20 (34) |
No | 38 (66) |
Number of dedicated pediatric hospital beds | |
Range | 51–664 |
Median (interquartile range) | 189 (107–313) |
Includes 1 participant who identified as Director of Health Information Systems.b Other roles included pediatric service line lead, director of nursing informatics, director of quality, certified analyst, adolescent physician, director of clinical analytics, medical director of informatics, chief medical officer, and clinician champion.
We defined “pediatric specific instance” as a separate build of Epic that was built specifically for use in a pediatric hospital, as opposed to a shared instance where pediatric and adult hospitals share the exact same instance and interface.
Adolescent Portal Access Policies Across and Within States
Adolescent portal policies varied widely, as summarized in Table 3. For example, 43% (n = 23 of 58) of systems required adolescent assent for the parent to receive proxy access, and 55% (n = 29 of 58) did not. Similarly, 36% (n = 18 of 58) of systems required parental permission for the adolescent to gain portal access, and 58% (n = 29 of 58) did not. Policies also varied within states. Thirteen states had ≥2 health care systems represented, and these health care systems were seldom consistent in the age of adolescent portal access, requirements for parental consent, requirements for adolescent assent, and whether adolescents and parents had access to the same information (Table 4).
Adolescent Portal Access Policies
Policy Attribute . | n (%) . |
---|---|
Age of adolescent access, y | |
No access provided | 8 (15) |
10 | 1 (2) |
11 | 2 (3) |
12 | 14 (24) |
13 | 21 (36) |
14 | 7 (12) |
15 | 2 (3) |
16 | 1 (2) |
Unsure | 2 (3) |
Adolescent assent required for parent proxy access | |
Yes | 23 (40) |
No | 29 (50) |
Unsure | 1 (2) |
No Access | 5 (8) |
Parents permitted proxy access | |
Yes | 55 (95) |
No | 3 (5) |
Parental consent required for adolescent access | |
Yes | 18 (31) |
No | 29 (50) |
Unsure | 3 (5) |
No Access | 8 (14) |
Level of adolescent accessa | |
Unfiltered access | 24 (41) |
Minimal filtering | 16 (28) |
Limited access | 3 (5) |
No access | 8 (14) |
Unsure | 7 (12) |
Level of proxy accessa | |
Unfiltered access | 8 (14) |
Minimal filtering | 18 (31) |
Limited access | 25 (43) |
No access | 3 (5) |
Unsure | 4 (7) |
Parents and adolescents with identical access to portal datab | |
Yes | 23 (40) |
No | 27 (46) |
Unsure | 8 (14) |
Policy Attribute . | n (%) . |
---|---|
Age of adolescent access, y | |
No access provided | 8 (15) |
10 | 1 (2) |
11 | 2 (3) |
12 | 14 (24) |
13 | 21 (36) |
14 | 7 (12) |
15 | 2 (3) |
16 | 1 (2) |
Unsure | 2 (3) |
Adolescent assent required for parent proxy access | |
Yes | 23 (40) |
No | 29 (50) |
Unsure | 1 (2) |
No Access | 5 (8) |
Parents permitted proxy access | |
Yes | 55 (95) |
No | 3 (5) |
Parental consent required for adolescent access | |
Yes | 18 (31) |
No | 29 (50) |
Unsure | 3 (5) |
No Access | 8 (14) |
Level of adolescent accessa | |
Unfiltered access | 24 (41) |
Minimal filtering | 16 (28) |
Limited access | 3 (5) |
No access | 8 (14) |
Unsure | 7 (12) |
Level of proxy accessa | |
Unfiltered access | 8 (14) |
Minimal filtering | 18 (31) |
Limited access | 25 (43) |
No access | 3 (5) |
Unsure | 4 (7) |
Parents and adolescents with identical access to portal datab | |
Yes | 23 (40) |
No | 27 (46) |
Unsure | 8 (14) |
We defined level of adolescent and proxy access as unfiltered access, minimal filtering (eg, sensitive results filtered, but majority of medical records available to proxy), limited access (eg, proxy restricted from viewing most of medical records, such as allergies, after visit summaries, and scheduling), or no access.
Hospitals with identical EHR access for parents and adolescents offered the following types of access: full access to parent and adolescent (n = 6), minimal filtering (n = 11), limited access (n = 3), and no access (n = 3).
Variation of Portal Policies Within States
State . | EHR System . | Adolescent Access . | Parent Access . | Age Adolescent Access . | Requires Parental Consent . | Requires Adolescent Assent . | Parent and Adolescent Same Access . |
---|---|---|---|---|---|---|---|
California (n = 5) | Epic (n = 4) Cerner (n = 1) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Florida (n = 2) | Epic (n = 2) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Consistent |
Illinois (n = 2) | Epic (n = 2) | Inconsistent | Consistent | Inconsistent | Inconsistent | Consistent | Consistent |
Louisiana (n = 2) | Epic (n = 2) | Consistent | Consistent | Inconsistent | Inconsistent | Consistent | Consistent |
Massachusetts (n = 2) | Epic (n = 1) Epic and Cerner (n = 1) | Consistent | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent |
Michigan (n = 2) | Epic (n = 1) Cerner (n = 1) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Missouri (n = 3) | Epic (n = 2) Cerner (n = 1) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Consistent |
New York (n = 6) | Epic (n = 4) Cerner (n = 1) Allscripts (n = 1) | Inconsistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
North Carolina (n = 4) | Epic (n = 4) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Ohio (n = 5) | Epic (n = 4) Allscripts (n = 1) | Inconsistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Pennsylvania (n = 4) | Epic (n = 2) Cerner (n = 1) Epic and Cerner (n = 1) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Tennessee (n = 3) | Epic (n = 1) Cerner (n = 2) | Inconsistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Virginia (n = 3) | Epic (n = 2) Cerner (n = 1) | Consistent | Consistent | Inconsistent | Inconsistent | Consistent | Inconsistent |
Total consistent | 9/13 | 12/13 | 1/13 | 0/13 | 3/13 | 4/13 |
State . | EHR System . | Adolescent Access . | Parent Access . | Age Adolescent Access . | Requires Parental Consent . | Requires Adolescent Assent . | Parent and Adolescent Same Access . |
---|---|---|---|---|---|---|---|
California (n = 5) | Epic (n = 4) Cerner (n = 1) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Florida (n = 2) | Epic (n = 2) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Consistent |
Illinois (n = 2) | Epic (n = 2) | Inconsistent | Consistent | Inconsistent | Inconsistent | Consistent | Consistent |
Louisiana (n = 2) | Epic (n = 2) | Consistent | Consistent | Inconsistent | Inconsistent | Consistent | Consistent |
Massachusetts (n = 2) | Epic (n = 1) Epic and Cerner (n = 1) | Consistent | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent |
Michigan (n = 2) | Epic (n = 1) Cerner (n = 1) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Missouri (n = 3) | Epic (n = 2) Cerner (n = 1) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Consistent |
New York (n = 6) | Epic (n = 4) Cerner (n = 1) Allscripts (n = 1) | Inconsistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
North Carolina (n = 4) | Epic (n = 4) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Ohio (n = 5) | Epic (n = 4) Allscripts (n = 1) | Inconsistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Pennsylvania (n = 4) | Epic (n = 2) Cerner (n = 1) Epic and Cerner (n = 1) | Consistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Tennessee (n = 3) | Epic (n = 1) Cerner (n = 2) | Inconsistent | Consistent | Inconsistent | Inconsistent | Inconsistent | Inconsistent |
Virginia (n = 3) | Epic (n = 2) Cerner (n = 1) | Consistent | Consistent | Inconsistent | Inconsistent | Consistent | Inconsistent |
Total consistent | 9/13 | 12/13 | 1/13 | 0/13 | 3/13 | 4/13 |
For 13 states that had multiple health care systems represented in this study, we evaluated whether portal policies were the same (ie, consistent) or varied (ie, inconsistent) at different health care systems in the same state. We considered states inconsistent if at least 1 health care system had a policy that differed from other systems in that state.
Challenges to Developing Portal Access Policies
Participants identified challenges related to the alignment of diverse interests in developing policies and the subsequent implementation of policies. Below, we describe themes related to these challenges and provide representative excerpts in Tables 5 and 6.
Challenges to Alignment of Diverse Interests in Developing Adolescent Portal Policies
Alignment of Diverse Interests . | |
---|---|
Legislation and compliance issues (n = 40) | “Laws are written very vague, and the interpretation of those lawsdoesn’t really come normally through—if there’s no court cases around it, really, you’re left with opinion of various lawyers and different lawyers have different opinions, so really interpreting those and determining how we are going to internally interpret those rules that we feel comfortable with is another barrier.” (P_181) |
“There’s the fact that there’s different laws in every state. It’s hard for vendors to think about—if you’re like Epic and you’re working in Texas where you can’t consent for birth control as an adolescent. Then you’re working in New York, where you can consent anywhere; even in school for an IUD. How do you craft—you can’t say that contraception is automatically blocked.” (P_177) | |
“I’d love for us to have some national guidelines that would supersede the state. I know it doesn’t go that way. I know the state supersedes the federal, but it’s causing all of us a lot of problems.” (P_21) | |
Tension between adolescent confidentiality and parental care needs (n = 32) | “The challenge, of course, is always to ensure that we are providing enough information without breaching confidentiality. We’re having these discussions regularly about ways that we can continue to optimize the process.” (P_26) |
“The effort of protecting that small percent of confidential information—we put significant barriers to communication with parents… we pay a relatively heavy price in terms of communication via the portal.” (P_78) | |
“At 12 [years old], what are the odds that they are doing anything that they really care about their parent not seeing? When you’re 15 or 16, that’s maybe a very different situation. We have annual messages that go out to… the adolescent patient and not their parent. It tells them to think again about it, to reconsider and to explain to them how to change their parent’s access.” (P_119) | |
Clinicians’ preferences and concerns (n = 17) | “We had a meeting with the cancer center and a few other areas because they wanted a [long] delay in their reports being accessible within the portal. We had a devil of a time talking to them, saying, ‘Actually, it’s their health information.’” (P_77) |
“I’m very nervous about extra communications. We don’t get paid for that; we don’t have time to deal with that extra communication… I don’t have time to have a whole conversation with you about something that I’ll talk about at the next visit or something that you read online. I don’t want the EMR to be social.” (P_177) | |
“[Pediatricians] wanted to act as the ultimate decider of what can be accessible in terms of the adolescent’s health record. I said, no, it’s the other way around. It’s the adolescent who has to be the ultimate decider on what can be seen in their health record from other people’s point of view.” (P_77) | |
Limited understanding and investment of institution in pediatric issues (n = 8) | “We’re part of a huge organization now. They tell us how we’re running things now.” (P_134) |
“It’s certainly very different than freestanding children’s hospitals where everybody there is there to take care of children, and so, I think that was a lesson that I continually learn… how to get the message across in a succinct way to people who are really not knowledgeable about pediatric care.” (P_36) | |
Limited focus of vendors on pediatric issues (n = 8) | “The technology doesn’t support the granularity sometimes. We’ve been able to do that through a lot of workarounds in our build, but there are many EHR vendors that just frankly don’t allow you to do those things.” (P_26) |
“We feel that we are severely hampered by our EHR vendor… We still can’t send results to the teen portal and not have them show up in the parent portal, and that’s a problem, and we do not want to rely on a consent mechanism to disclose the kids’ confidential information to the parents. I think the vendors say things are coming, but they’ve been saying that for 2 years and we don’t have it yet.” (P_153) |
Alignment of Diverse Interests . | |
---|---|
Legislation and compliance issues (n = 40) | “Laws are written very vague, and the interpretation of those lawsdoesn’t really come normally through—if there’s no court cases around it, really, you’re left with opinion of various lawyers and different lawyers have different opinions, so really interpreting those and determining how we are going to internally interpret those rules that we feel comfortable with is another barrier.” (P_181) |
“There’s the fact that there’s different laws in every state. It’s hard for vendors to think about—if you’re like Epic and you’re working in Texas where you can’t consent for birth control as an adolescent. Then you’re working in New York, where you can consent anywhere; even in school for an IUD. How do you craft—you can’t say that contraception is automatically blocked.” (P_177) | |
“I’d love for us to have some national guidelines that would supersede the state. I know it doesn’t go that way. I know the state supersedes the federal, but it’s causing all of us a lot of problems.” (P_21) | |
Tension between adolescent confidentiality and parental care needs (n = 32) | “The challenge, of course, is always to ensure that we are providing enough information without breaching confidentiality. We’re having these discussions regularly about ways that we can continue to optimize the process.” (P_26) |
“The effort of protecting that small percent of confidential information—we put significant barriers to communication with parents… we pay a relatively heavy price in terms of communication via the portal.” (P_78) | |
“At 12 [years old], what are the odds that they are doing anything that they really care about their parent not seeing? When you’re 15 or 16, that’s maybe a very different situation. We have annual messages that go out to… the adolescent patient and not their parent. It tells them to think again about it, to reconsider and to explain to them how to change their parent’s access.” (P_119) | |
Clinicians’ preferences and concerns (n = 17) | “We had a meeting with the cancer center and a few other areas because they wanted a [long] delay in their reports being accessible within the portal. We had a devil of a time talking to them, saying, ‘Actually, it’s their health information.’” (P_77) |
“I’m very nervous about extra communications. We don’t get paid for that; we don’t have time to deal with that extra communication… I don’t have time to have a whole conversation with you about something that I’ll talk about at the next visit or something that you read online. I don’t want the EMR to be social.” (P_177) | |
“[Pediatricians] wanted to act as the ultimate decider of what can be accessible in terms of the adolescent’s health record. I said, no, it’s the other way around. It’s the adolescent who has to be the ultimate decider on what can be seen in their health record from other people’s point of view.” (P_77) | |
Limited understanding and investment of institution in pediatric issues (n = 8) | “We’re part of a huge organization now. They tell us how we’re running things now.” (P_134) |
“It’s certainly very different than freestanding children’s hospitals where everybody there is there to take care of children, and so, I think that was a lesson that I continually learn… how to get the message across in a succinct way to people who are really not knowledgeable about pediatric care.” (P_36) | |
Limited focus of vendors on pediatric issues (n = 8) | “The technology doesn’t support the granularity sometimes. We’ve been able to do that through a lot of workarounds in our build, but there are many EHR vendors that just frankly don’t allow you to do those things.” (P_26) |
“We feel that we are severely hampered by our EHR vendor… We still can’t send results to the teen portal and not have them show up in the parent portal, and that’s a problem, and we do not want to rely on a consent mechanism to disclose the kids’ confidential information to the parents. I think the vendors say things are coming, but they’ve been saying that for 2 years and we don’t have it yet.” (P_153) |
Challenges to Implementing Adolescent Portal Policies
Implementation of Policies . | |
---|---|
Technical challenges and limitations (n = 41) | “The EHR isn’t set up to be able to peel off those layers to distinguish, easily, what should be confidential and what shouldn’t be. They have to either go one extreme or the other, like an all or nothing kind of thing. I think that’s what really has made it the most challenging, in general.” (P_56) |
“The things that we may be concerned about putting in the portal because we don’t want their parent to see are very likely those things that may be are the most important ones to [adolescents].” (P_119) | |
Educating end-users (n = 23) | “I would say the most important lessons learned are educating providers about notes, about charting. Making sure that they’re charting not just accurately but needing to make changes to templates to be sure things aren’t accidentally getting through, right? If you’re keeping a med confidential and you’ve got a templated note that brings all the meds in, that’s not going to work.” (P_37) |
“Having a discussion with the 15-year-old whether they want the parent to have access and educate them what level that access really means and all those things and getting consent forms signed and placed in the chart—all of those things needed to be navigated as well.” (P_51) | |
“Essentially if everyone in the organization understands the portal, knows about it, and knows how to send the invite to the family, we could get there, but that’s a ton of teams, a ton of people who don’t view it as their job to care about the portal, or get people onto the portal.” (P_153) | |
Potential for parental coercion or bypassing safeguards (n = 21) | “The folks at Stanford published a fascinating study of the language used in messages on supposedly teens’ portal accounts. It was very clear that something like 50% of the time, it was the parent actually accessing the account for the teen.” (P_180) |
“We had to disable self-enrollment all together, because we couldn’t have any way to enforce that it’s the teen claiming the private account with the secure messaging features that we now have. It could just as easily be a parent, and we have no way of actually knowing that.” (P_153) | |
Harms of bad news or misinterpretation (n = 19) | “Oncologists are saying, ‘Wait, I don’t want that pathology report flowing right to the medical portal until I’ve digested it and called the patient and done my job that I think I should do as an oncologist to say, ‘Your cancer has relapsed.’ It’s obviously a big issue for people who feel it’s their job as a doctor to be able to tell people certain news.” (P_151) |
“I think, in general, people are much more okay with getting data than a lot of providers had originally feared.” (P_139) | |
“[Another institution has] really nice disclaimers that they have in their MyChart for how to look at results and what have you. Ours is probably not quite as good as theirs, but we have something like that.” (P_179) | |
Complexities of enrollment process (n = 16) | “We require staff so that they’re agreeing that parent is the parent, and has a legal right to see the information, cause of course we get all kinds of legal situations where the parent actually is not allowed to see the information.”(P_153) |
“We’re still doing paper—and paper signatures, which in the age of—yeah. In 2022, that feels like—I don’t know.” (P_10) | |
Informatics workforce limitations (n = 6) | “Our IT resources are shared across our entire enterprise. Getting the resources to develop, to build these tools out ourselves is challenging.” (P_119) |
Implementation of Policies . | |
---|---|
Technical challenges and limitations (n = 41) | “The EHR isn’t set up to be able to peel off those layers to distinguish, easily, what should be confidential and what shouldn’t be. They have to either go one extreme or the other, like an all or nothing kind of thing. I think that’s what really has made it the most challenging, in general.” (P_56) |
“The things that we may be concerned about putting in the portal because we don’t want their parent to see are very likely those things that may be are the most important ones to [adolescents].” (P_119) | |
Educating end-users (n = 23) | “I would say the most important lessons learned are educating providers about notes, about charting. Making sure that they’re charting not just accurately but needing to make changes to templates to be sure things aren’t accidentally getting through, right? If you’re keeping a med confidential and you’ve got a templated note that brings all the meds in, that’s not going to work.” (P_37) |
“Having a discussion with the 15-year-old whether they want the parent to have access and educate them what level that access really means and all those things and getting consent forms signed and placed in the chart—all of those things needed to be navigated as well.” (P_51) | |
“Essentially if everyone in the organization understands the portal, knows about it, and knows how to send the invite to the family, we could get there, but that’s a ton of teams, a ton of people who don’t view it as their job to care about the portal, or get people onto the portal.” (P_153) | |
Potential for parental coercion or bypassing safeguards (n = 21) | “The folks at Stanford published a fascinating study of the language used in messages on supposedly teens’ portal accounts. It was very clear that something like 50% of the time, it was the parent actually accessing the account for the teen.” (P_180) |
“We had to disable self-enrollment all together, because we couldn’t have any way to enforce that it’s the teen claiming the private account with the secure messaging features that we now have. It could just as easily be a parent, and we have no way of actually knowing that.” (P_153) | |
Harms of bad news or misinterpretation (n = 19) | “Oncologists are saying, ‘Wait, I don’t want that pathology report flowing right to the medical portal until I’ve digested it and called the patient and done my job that I think I should do as an oncologist to say, ‘Your cancer has relapsed.’ It’s obviously a big issue for people who feel it’s their job as a doctor to be able to tell people certain news.” (P_151) |
“I think, in general, people are much more okay with getting data than a lot of providers had originally feared.” (P_139) | |
“[Another institution has] really nice disclaimers that they have in their MyChart for how to look at results and what have you. Ours is probably not quite as good as theirs, but we have something like that.” (P_179) | |
Complexities of enrollment process (n = 16) | “We require staff so that they’re agreeing that parent is the parent, and has a legal right to see the information, cause of course we get all kinds of legal situations where the parent actually is not allowed to see the information.”(P_153) |
“We’re still doing paper—and paper signatures, which in the age of—yeah. In 2022, that feels like—I don’t know.” (P_10) | |
Informatics workforce limitations (n = 6) | “Our IT resources are shared across our entire enterprise. Getting the resources to develop, to build these tools out ourselves is challenging.” (P_119) |
Alignment of Diverse Interests in Developing Policies
Legislation and Compliance Issues
Participants described challenges in balancing confidentiality and transparency while navigating conflicting laws and negotiating with institutional compliance officers, legal counsel, and risk management. Many participants believed the Cures Act mandate for transparency conflicts with state laws mandating certain types of confidential care for adolescents. State laws varied widely across the country, and this variation was especially challenging for health care systems managing hospitals across multiple states. Even within states, different hospitals implemented different policies in response to the same laws. Interpretation of these laws was driven by legal counsel and institutional compliance officers, leading to variations in policy depending on the level of risk organizations were willing to assume. Additionally, some centers had insufficient legal resources to addresses these complexities. Several participants called for national standards for data-sharing in adolescence, although they acknowledged the difficulties in creating such a consensus.
Tension Between Adolescent Confidentiality and Parental Care Needs
Participants described the challenge of balancing the needs of parents to manage their child’s illness with the adolescent’s need for privacy. These conflicting needs required tradeoffs, especially when the EHR lacked options for granular differential sharing of content between adolescent and proxy portals. Participants also acknowledged that an adolescent’s need for confidentiality can change over time and must be readdressed.
Clinicians’ Preferences and Concerns
Participants described multiple concerns of clinicians that occasionally conflicted. For example, adolescent physicians proposed limiting parental access to ensure confidentiality. Oncologists worried about emotional harms of sharing distressing results with families before they communicated with their clinician. Other clinicians worried that restricted data sharing would make portals less useful. One administrator worried that overly incentivizing portal use might threaten adolescent confidentiality by pushing them into a system with suboptimal confidentiality protections.
Some clinicians worried that policies would affect their workload and workflow. Other clinicians preferred phone calls to portal messaging. Lastly, some clinicians felt they should have a stronger role in determining who can access information through the portal because they believed they understood adolescents’ capacity and needs for information.
Limited Understanding and Investment of Institution in Pediatric Issues
When pediatrics was a small part of an organization, participants described how adult-centric health care systems made decisions that did not account for pediatric needs. Participants described the need to educate and advocate for pediatric issues, stressing the importance of having “somebody with a pediatric and adolescent mindset who’s on the policy teams.” (P_119)
Limited Focus of Vendors on Pediatric Issues
Participants described how EHR systems provided limited ability to differentially share information to adolescents versus parents, and EHR vendors seemed to have insufficient interest in addressing this technical challenge. To overcome EHR limitations, some systems attempted to build workarounds within the existing EHR platform. Despite these efforts, some participants felt “dependent on the large EHR vendors to get there, and they haven’t.” (P_102)
Implementation of Policies
Technical Challenges and Limitations
Many participants felt hampered in their attempts to meet the intentions of regulations by the EHR’s limited ability to differentially share information with the adolescent versus the parent. The lack of ability for differential sharing often led to “all-or-none” decisions about which data fields were sent to the portal, since parents and adolescents often had the same access to data on the portal. As a result, many systems restricted the ability of parents and adolescents to view medications, problem lists, and specific test results and appointments. Limiting access to these data decreased the utility of portals.
Participants also described myriad problems in identifying which data are sensitive. Clinicians often document sensitive information in unexpected areas of notes. Scanned documents create another area where sensitive information can enter the chart. Also, results and notes from other health care systems can be reconciled into the EHR, leading to potential confidentiality breaches. Furthermore, some participants described how certain data are only time sensitive for a short amount of time and become nonconfidential over time. For example, many participants mentioned gender identity and sexual orientation as examples of information that might not need to remain confidential over time for some patients. Lastly, some participants mentioned how the portal interface at their institution was not intuitive as well as challenges when a single system uses multiple EHRs.
Educating End-Users
When health care systems changed portal access policies, participants noted challenges with educating clinicians, adolescent patients, and parents about these processes. For systems that filtered data before posting to the portal, administrators noted challenges in training clinicians about which data adolescents and parents can see and how to appropriately determine whether a note should be confidential. This education was especially important for clinicians that made their own templates that might pull confidential information into their notes. Administrators described difficulties training nonpediatrician clinicians who cared for pediatric patients in maintaining confidentiality, such as adult surgeons who care for adolescents. Keeping clinicians educated was a challenge during the pandemic because of high turnover. Frequent rotations of trainees created challenges with consistent adherence to policies. Administrators also described how education is only one component of a change management process that requires end-user collaboration and commitment to shared goals.
Participants also described the importance of educating parents and adolescents about how to register for the portal as well as what types of information are shared. This education was especially important when adolescents were deciding whether to provide their parents with proxy access. One participant described barriers experienced by families who did not speak English.
Potential for Parental Coercion or Bypassing Safeguards
Many participants worried that parents had access to their adolescent’s online portal account, which threatened confidentiality. Participants described how this parental access could result from glitches in EHR contact information, parental coercion, or the choice of the adolescent. Some administrators described policies of withholding certain results or notes from the portal because of concerns that parents were accessing the adolescents’ account. For example, test results for pregnancy or sexually transmitted infections were seldom sent to portals. Other systems disabled self-enrollment for adolescents because of these concerns. Some systems turned off the portal completely during adolescent years for parents and adolescents. A few health care systems were developing strategies to ensure that adolescent contact information was entered correctly in the EHR. One system was developing an approach with natural language processing to evaluate language of portal messaging to ensure parents were not messaging from adolescents’ accounts. Some participants called for better identity authentication processes for adolescents, such as 2-factor authentication.
Harms of Bad News or Misinterpretation
Many health care systems provided immediate access to results and documentation, based on their interpretation of the 21st Century Cures Act. “The Cures Act doesn’t allow for psychological harm being a reason that you block a note or a test result or something like that.” (P_168) Other systems interpreted the law differently and instituted delays in release of results ranging from a few hours to several days. The rationale for this restriction was the potential for emotional harm. “[We] are taking that little loophole in the 21st Century Cures where you don’t want to produce emotional harm.” (P_43)
For centers that provided immediate access to results and notes, some participants described concerns about harms of early disclosure of results, such as pathology or imaging results indicating a cancer diagnosis. Other participants, however, questioned whether families shared these concerns. To mitigate potential harms, some health care systems provided disclaimers at the beginning of results to prepare families to interpret the results. One center began batching inpatient results’ release twice daily to prevent families from becoming overwhelmed with information.
Complexities of Enrollment Process
Enrolling adolescents and/or parents in the portal was more complicated and onerous than enrolling adult patients. One major challenge related to identity verification for parents and the adolescent, which requires staff effort and workflows. Enrollment is further complicated in systems that mandate adolescents and parents to both enroll in the portal, otherwise neither can have access. Enrollment of parents in proxy accounts often requires in person visits, paper signatures, and occasionally phone calls with a helpdesk.
Informatics Workforce Limitations
Health care systems were often hampered in their efforts to modify adolescent portals by limitations in bandwidth and funding for their information technology team. One participant described the importance of distinguishing between modifications that are technically impossible versus modifications that are implausible because of workforce limitations.
Discussion
US children’s hospitals demonstrated wide variations in adolescent portal access policies, especially in integrated health care systems. These policies varied both across and within states, with some systems prioritizing adolescent autonomy and others prioritizing parental authority, and some of these policies might violate the mandate against information blocking in the 21st Century Cures Act. Parental access likely provides adolescents with additional support for medical needs but risks disclosure of sensitive information. Prioritizing adolescent confidentiality requires adolescents to navigate the health care system with limited support, or parents might access the adolescent’s portal and bypass safeguards. Until technological advances permit granular, user-friendly sharing of appropriate data with adolescents and parents, institutions should strive for consensus on policies to best support these conflicting needs for support and confidentiality.
Many participants attributed this variability to differing state laws and conflicts between state and federal law. Adolescent privacy laws vary by state, and many state laws conflict with pediatric professional standards of care.8 Furthermore, the 21st Century Cures Act provides a mandate for transparency, but allows state laws to supersede this mandate.1 Given the vague and conflicting regulations, institutional interpretation of state laws were central to development of portal policies. Although developing a national consensus on adolescent portal policies is challenged by state-by-state variations in confidentiality laws, developing intrastate consensus should be more achievable. Pediatric organizations should strive to develop collaborative guidelines for adolescent portal policies within each state. Developing a local consensus, although technically and politically challenging, could provide additional leverage with institutional leadership and vendors to optimize portal policies.
Portal policies were also influenced by limited buy-in from institutional administration and vendors, especially in integrated health care systems where pediatrics represented a small portion of the enterprise. At these institutions, it is imperative for pediatricians to get involved with policy development and technology builds to ensure that pediatric and adolescent issues were addressed. Institutional buy-in was especially important because vendors were slow in responding to the needs of pediatricians and adolescents. Therefore, changes relied on institutional informatics resources to support portal modifications, and many institutions experienced informatics workforce limitations. As such, it is imperative that pediatricians and informaticists advocate and pressure vendors to make adolescent-specific modifications. Broad variations in state confidentiality laws likely disincentivizes vendors from investing in these modifications, further emphasizing the importance of developing consensus where possible to support advocacy efforts with vendors.
Lastly, our data emphasize the importance of understanding how families manage adolescent health care. Adolescents with serious illness often rely on parental support to navigate communication and medical care.19–21 Although medical societies and professional organizations emphasize the need for confidential adolescent care, public opinion favors the ability of parents to access their adolescent’s medical record.13 Furthermore, efforts to maintain confidentiality with technological changes will fail to protect adolescent confidentiality unless we account for the parental desire or need to access meaningful data in their adolescent’s portal. For example, prior studies estimate that up to 76% of adolescent portal accounts were accessed by parents.22,23 Despite the central role of parents in protecting the adolescent’s confidentiality, few studies have explored parental or adolescent preferences, information needs, and motivations for accessing the adolescent’s portal, and this area needs dedicated study.
This study should be interpreted in light of limitations. We limited enrollment to hospitals with at least 50 dedicated pediatric beds, which could underrepresent the challenges of hospitals with smaller pediatric presence. Participating hospitals were slightly larger than nonparticipating hospitals. Our results could be biased toward larger pediatric hospitals. Additionally, we excluded specialty hospitals from analysis. Thus, our results might not represent the unique challenges of these institutions in developing and implementing adolescent portal policies. Furthermore, participants could have moderated their responses during interviews because of social desirability bias.
Conclusions
Adolescent portal access policies vary across and within states. Informatics administrators identified challenges in developing and implementing adolescent portal policies, especially related to conflicting laws, stakeholder buy-in, and technical limitations. For portals to achieve their potential to provide collaborative and confidential care for adolescents, administrators must address these challenges, especially related to the wide variability of portal policies, investment in developing solutions, and accounting for how families function to ensure solutions are practicable. Future efforts should strive for intrastate consensus on portal policies and engage parents and adolescent patients to understand their preferences and needs.
Dr Sisk participated in conceptualization, design, and implementation of the study, formal analysis, and drafted the initial manuscript; Ms Bereitschaft and Ms Enloe participated in design of the study, facilitated acquisition of data, and participated in formal data analysis; Drs Antes, Bourgeois, and DuBois participated in conceptualization, design, and implementation of the study and formal analysis; and all authors reviewed and revised the manuscript, approved the final manuscript as submitted, and agree to be accountable for all aspects of the work.
FUNDING: This study was funded by a Greenwall Foundation Making a Difference grant.
CONFLICT OF INTEREST DISCLOSURES: The authors have indicated they have no potential conflicts of interest to disclose.
Comments