Patient portals and young people: addressing the privacy dilemma of providing access to health information

KEYWORDS: E-health; health law; ethics; general practitioners; primary health care; family health care; information management

Patient portals have the potential to improve the way health care is delivered, but concerns about confidentiality and privacy breaches, particularly for children and adolescents (‘young people’), may be impeding portal adoption.^1–5 This paper considers the legal and ethical framework relating to health information privacy and informed consent in New Zealand, and suggests an approach to implementing patient portals for young people.

Patient portals are secure online websites providing patients with electronic access to their health information held by their general practice and enabling interaction with their general practice team. This includes requesting repeat prescriptions, booking appointments, secure messaging and checking laboratory results.⁶ At the end of June 2017, 407,049 patients in New Zealand were registered to use a patient portal.⁷

There is general consensus that portal use by young people has the potential to improve patient outcomes, although direct evidence linking outcomes to portals is limited.⁸ Systematic reviews have identified perceived benefits from portal adoption in young people. These benefits include increased patient–provider communication, improved care coordination, access to health information, patient engagement, increased self-management of chronic conditions and improved reliability of data in patients’ electronic health records.^1,8 Furthermore, portals have helped parents (in this paper, the term includes guardians⁹) of young people with chronic conditions to better manage and understand conditions, reduce anxiety and offer reassurance. Young people have been enthusiastic about using portals to contact their health care providers, seek health information and make appointments.¹

International literature cites privacy concerns as a barrier to portal adoption for young people.^1–5 Moreover, data from the Royal New Zealand College of General Practitioners’ 2016 workforce survey relating to portal use overall revealed that confidentiality and privacy were main concerns for general practitioners (23% of users (n = 478) and 20% of non-users (n = 1325)).¹⁰

At the heart of health care for young people are their best interests and rights. In 1993, New Zealand ratified the United Convention of the Rights of the Child with the guiding principles of non-discrimination, voice of the child, their best interests, and life, survival and development. The New Zealand Code of Health and Disability Services Consumers’ Rights (HDC Code) and the Health Information Privacy Code 1994 (HIPC) reflect the ethical principle of autonomy and cover important rights of young people receiving health care.

Right 6(2) of the HDC Code gives young people the right to receive appropriate information about health services. Under rule 6 of the HIPC, young people have the right of access to their own health information, with limited grounds for refusal; for example, where disclosure is not in their interests.¹¹ Health information should be made available in the form requested (section 42(2) of the Privacy Act 1993) and in a manner that enables the young person to understand it (Right 5(1) of the HDC Code). Thus, while a young person should normally be given access to their health information via a portal on request, granting access may not be appropriate where safety is a concern.

By giving young people timely electronic access to their health information, patient portals can enable them to participate more actively in their own health care. Parents have a similar right of access to information about their children aged under 16 years, unless disclosure would be against the young person’s wishes or interests.¹²

A good option for a child is shared portal access where both child and parent have access to the child’s portal. Parents can help their children to interpret information, answer their questions and give support particularly for complex or serious matters. Health literacy is crucial to portal use,¹³ and it can be developed as parents and health care providers assist young people to understand health information and to use their patient portal.

Trust is a central tenet of the doctor–patient relationship. Some young people may seek care only if they can trust their doctor not to breach their confidences.¹⁴ New Zealand survey data have shown that young people are more likely to forgo needed health care if they are concerned about confidentiality for pregnancy worries, substance use and other sensitive matters.^15,16 In such situations, a doctor’s duty of confidentiality to a young person and the duty to inform their parent who wants and needs to know their young person’s clinical situation may present an inherent dilemma.

As young people develop, their capacity to make decisions and take responsibility for their health gradually increases. For maturing young people, implementing patient portals becomes more complicated with regard to access to and control of the portal, and the sharing of health information. Difficulties arise, in part, from the complexity and relative uncertainty around the capacity and legal entitlement of young people aged under 16 years to consent to medical treatment. Ethical and technical considerations add further layers of complexity. For example, the mechanism to share portal access depends on the software used by the practice. A young person and parent might need to share log-in details or, alternatively, both parties might have access to the young person’s health information via their own portal accounts.

The HIPC, HDC Code and common law recognise that young people have a degree of autonomy not solely reliant on reaching a specific age. For the purpose of consent to medical treatment, capacity or competence is determined either by age (ie aged 16 years and over under section 36 of the Care of Children Act 2004, except for a female consenting, or not, to an abortion¹⁷), or the level of understanding of proposed treatment as governed by the HDC Code and common law. Young people aged under 16 years may consent to treatment if they are sufficiently mature to understand what is proposed and capable of expressing their own wishes (Gillick competence).^18,19

Informed consent is intertwined with confidentiality and health information privacy. The HIPC recognises that parents do not have an automatic right to all information about their children aged under 16 years, whose views should, where practical, be ascertained and considered when responding to parental requests for disclosure of health information.¹⁹ However, many young people are likely to choose to involve parents in their health care in most situations.

While shared portal access may be a good option for a child, implementing independent portal access for a young person assessed as competent – that is, aged 16 years and over or with sufficient understanding and maturity to make an informed decision – is an appropriate starting point. The young person’s views on sharing access to their health information with a parent should be sought without parents present. Factors to consider in deciding whether to implement shared portal access include the ‘withholding grounds’ in sections 27–29 of the Privacy Act 1993 and the provisions of rule 11(4) of the HIPC, such as where disclosure would harm the young person’s physical or mental health,²⁰ would be contrary to their wishes or interests,¹¹ or would breach legal professional privilege.²¹

Broader discussions about confidentiality, privacy and parental involvement in health care, especially for more serious or complex health issues, are key to implementing portals for young people. Having early, open conversations with young people and their parents about portal use may lessen parental concerns and help to foster the acceptance of a future shift to the young person’s independent portal use. This is in keeping with the practice of seeing young people alone for part of their consultation to help their transition to independent access to health care. Young people’s cultural needs should also be appreciated. For many cultures, decision-making about young people involves their whanau and extended family networks, as well as the young person and their parents.¹⁹

Shifting from shared portal access to independent access by a competent young person should be made on a case-by-case basis, taking into account the young person’s interests and wishes. One approach is to consider shifting control of the portal to the competent young person at the following trigger points:

• A young person asks a practice to withhold their health information from their parent; or

• The clinical situation necessitates a review of shared portal access (eg it involves a sensitive health issue).

This approach is tailored towards addressing individual young people’s needs where privacy and confidentiality have come to the fore. However, it relies on a specific request or event, which might not take place, and could also raise parental suspicion.

An alternative approach is to consider shifting from shared portal access to independent access for each young person at a set ‘default age’ (eg 12 years) and to reconsider regularly (eg annually on next visit) thereafter. This approach might prove more onerous for practices than using the suggested trigger points. However, it better supports positive youth development, and enables consistency within a service and considerations to become routine, particularly where automated notifications are used.

As a result of the call for practical guidance on this topic, a project group (including the authors) developed a resource to assist practices to implement portals for young people.²² We hope that portal use will help in empowering young people to actively participate in their own health care.

The views expressed in this paper are those of the authors and do not necessarily represent those of The Royal New Zealand College of General Practitioners.