Patient portals and young people: addressing the privacy dilemma of providing access to health informationDeanne Wong 1 , Sebastian Morgan-Lynch 2
1 The Royal New Zealand College of General Practitioners, Wellington, New Zealand
2 Office of the Privacy Commissioner, Wellington, New Zealand
Correspondence to: Deanne Wong, PO Box 10-440, Wellington 6143, New Zealand. Email: Deanne.Wong@rnzcgp.org.nz
Journal of Primary Health Care - https://doi.org/10.1071/HC17037
Published online: 25 October 2017
Journal Compilation © Royal New Zealand College of General Practitioners 2017.
This is an open access article licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
Patient portals enable people to access their health information electronically, but concerns about confidentiality and privacy breaches, particularly for young people, may be impeding portal adoption in New Zealand. This paper considers the legal and ethical framework relating to health information privacy and informed consent in New Zealand, and proposes an approach to implementing patient portals for young people. Shared portal access (where both a young person and their parent or guardian have access to the young person’s portal) may be appropriate for young children whose parents or guardians are responsible for their health care. However, as children mature and their capacity to make health care decisions increases, general practitioners will need to consider shifting to independent portal access by competent young people. The circumstances of each young person, including their best interests and rights, cultural needs and their views on information disclosure should be taken into account.
KEYWORDS: E-health; health law; ethics; general practitioners; primary health care; family health care; information management
Patient portals have the potential to improve the way health care is delivered, but concerns about confidentiality and privacy breaches, particularly for children and adolescents (‘young people’), may be impeding portal adoption.1–5 This paper considers the legal and ethical framework relating to health information privacy and informed consent in New Zealand, and suggests an approach to implementing patient portals for young people.
Patient portals are secure online websites providing patients with electronic access to their health information held by their general practice and enabling interaction with their general practice team. This includes requesting repeat prescriptions, booking appointments, secure messaging and checking laboratory results.6 At the end of June 2017, 407,049 patients in New Zealand were registered to use a patient portal.7
There is general consensus that portal use by young people has the potential to improve patient outcomes, although direct evidence linking outcomes to portals is limited.8 Systematic reviews have identified perceived benefits from portal adoption in young people. These benefits include increased patient–provider communication, improved care coordination, access to health information, patient engagement, increased self-management of chronic conditions and improved reliability of data in patients’ electronic health records.1,8 Furthermore, portals have helped parents (in this paper, the term includes guardians9) of young people with chronic conditions to better manage and understand conditions, reduce anxiety and offer reassurance. Young people have been enthusiastic about using portals to contact their health care providers, seek health information and make appointments.1
International literature cites privacy concerns as a barrier to portal adoption for young people.1–5 Moreover, data from the Royal New Zealand College of General Practitioners’ 2016 workforce survey relating to portal use overall revealed that confidentiality and privacy were main concerns for general practitioners (23% of users (n = 478) and 20% of non-users (n = 1325)).10
The young person’s best interests and rights
At the heart of health care for young people are their best interests and rights. In 1993, New Zealand ratified the United Convention of the Rights of the Child with the guiding principles of non-discrimination, voice of the child, their best interests, and life, survival and development. The New Zealand Code of Health and Disability Services Consumers’ Rights (HDC Code) and the Health Information Privacy Code 1994 (HIPC) reflect the ethical principle of autonomy and cover important rights of young people receiving health care.
Right 6(2) of the HDC Code gives young people the right to receive appropriate information about health services. Under rule 6 of the HIPC, young people have the right of access to their own health information, with limited grounds for refusal; for example, where disclosure is not in their interests.11 Health information should be made available in the form requested (section 42(2) of the Privacy Act 1993) and in a manner that enables the young person to understand it (Right 5(1) of the HDC Code). Thus, while a young person should normally be given access to their health information via a portal on request, granting access may not be appropriate where safety is a concern.
By giving young people timely electronic access to their health information, patient portals can enable them to participate more actively in their own health care. Parents have a similar right of access to information about their children aged under 16 years, unless disclosure would be against the young person’s wishes or interests.12
A good option for a child is shared portal access where both child and parent have access to the child’s portal. Parents can help their children to interpret information, answer their questions and give support particularly for complex or serious matters. Health literacy is crucial to portal use,13 and it can be developed as parents and health care providers assist young people to understand health information and to use their patient portal.
The maturing young person
Trust is a central tenet of the doctor–patient relationship. Some young people may seek care only if they can trust their doctor not to breach their confidences.14 New Zealand survey data have shown that young people are more likely to forgo needed health care if they are concerned about confidentiality for pregnancy worries, substance use and other sensitive matters.15,16 In such situations, a doctor’s duty of confidentiality to a young person and the duty to inform their parent who wants and needs to know their young person’s clinical situation may present an inherent dilemma.
As young people develop, their capacity to make decisions and take responsibility for their health gradually increases. For maturing young people, implementing patient portals becomes more complicated with regard to access to and control of the portal, and the sharing of health information. Difficulties arise, in part, from the complexity and relative uncertainty around the capacity and legal entitlement of young people aged under 16 years to consent to medical treatment. Ethical and technical considerations add further layers of complexity. For example, the mechanism to share portal access depends on the software used by the practice. A young person and parent might need to share log-in details or, alternatively, both parties might have access to the young person’s health information via their own portal accounts.
The HIPC, HDC Code and common law recognise that young people have a degree of autonomy not solely reliant on reaching a specific age. For the purpose of consent to medical treatment, capacity or competence is determined either by age (ie aged 16 years and over under section 36 of the Care of Children Act 2004, except for a female consenting, or not, to an abortion17), or the level of understanding of proposed treatment as governed by the HDC Code and common law. Young people aged under 16 years may consent to treatment if they are sufficiently mature to understand what is proposed and capable of expressing their own wishes (Gillick competence).18,19
Informed consent is intertwined with confidentiality and health information privacy. The HIPC recognises that parents do not have an automatic right to all information about their children aged under 16 years, whose views should, where practical, be ascertained and considered when responding to parental requests for disclosure of health information.19 However, many young people are likely to choose to involve parents in their health care in most situations.
Implications and practice points
While shared portal access may be a good option for a child, implementing independent portal access for a young person assessed as competent – that is, aged 16 years and over or with sufficient understanding and maturity to make an informed decision – is an appropriate starting point. The young person’s views on sharing access to their health information with a parent should be sought without parents present. Factors to consider in deciding whether to implement shared portal access include the ‘withholding grounds’ in sections 27–29 of the Privacy Act 1993 and the provisions of rule 11(4) of the HIPC, such as where disclosure would harm the young person’s physical or mental health,20 would be contrary to their wishes or interests,11 or would breach legal professional privilege.21
Broader discussions about confidentiality, privacy and parental involvement in health care, especially for more serious or complex health issues, are key to implementing portals for young people. Having early, open conversations with young people and their parents about portal use may lessen parental concerns and help to foster the acceptance of a future shift to the young person’s independent portal use. This is in keeping with the practice of seeing young people alone for part of their consultation to help their transition to independent access to health care. Young people’s cultural needs should also be appreciated. For many cultures, decision-making about young people involves their whanau and extended family networks, as well as the young person and their parents.19
Shifting from shared portal access to independent access by a competent young person should be made on a case-by-case basis, taking into account the young person’s interests and wishes. One approach is to consider shifting control of the portal to the competent young person at the following trigger points:
A young person asks a practice to withhold their health information from their parent; or
The clinical situation necessitates a review of shared portal access (eg it involves a sensitive health issue).
This approach is tailored towards addressing individual young people’s needs where privacy and confidentiality have come to the fore. However, it relies on a specific request or event, which might not take place, and could also raise parental suspicion.
An alternative approach is to consider shifting from shared portal access to independent access for each young person at a set ‘default age’ (eg 12 years) and to reconsider regularly (eg annually on next visit) thereafter. This approach might prove more onerous for practices than using the suggested trigger points. However, it better supports positive youth development, and enables consistency within a service and considerations to become routine, particularly where automated notifications are used.
As a result of the call for practical guidance on this topic, a project group (including the authors) developed a resource to assist practices to implement portals for young people.22 We hope that portal use will help in empowering young people to actively participate in their own health care.
The views expressed in this paper are those of the authors and do not necessarily represent those of The Royal New Zealand College of General Practitioners.
References Bush RA, Connelly CD, Fuller M, et al Implementation of the integrated electronic patient portal in the pediatric population: a systematic review. Telemed J E Health 2015; 22 144–52.
 Bergman DA, Brown NL, Wilson S. Teen use of a patient portal: a qualitative study of parent and teen attitudes. Perspect Health Inf Manag 2008; 5 13
 Thompson LA, Martinko T, Budd P, et al Meaningful use of a confidential adolescent patient portal. J Adolesc Health 2016; 58 134–40.
| Meaningful use of a confidential adolescent patient portal.CrossRef |
 Britto MT, Wimberg J. Pediatric personal health records: current trends and key challenges. Pediatrics 2009; 123(Suppl 2): S97–9
| Pediatric personal health records: current trends and key challenges.CrossRef |
 Moreno MA, Ralsotin JD, Grossman DC. Adolescent access to online health services: perils and promise. J Adolesc Health 2009; 44 244–51.
| Adolescent access to online health services: perils and promise.CrossRef |
 Ministry of Health. Patient portals. Wellington: Ministry of Health; 2017. [cited 2017 September 22]. Available from: http://www.health.govt.nz/our-work/ehealth/other-ehealth-initiatives/patient-portals
 Ministry of Health. Patient Portal – uptake report, June 2017. Wellington: Ministry of Health; 2017. [cited 2017 Aug 16]. Available from: http://www.health.govt.nz/our-work/ehealth/other-ehealth-initiatives/patient-portals
 Kruse CS, Ozoa NM, Smith JG. Patient portals and the management of pediatric chronic diseases – a systematic literature review. Med Res Arch 2015; 2 1–18.
| Patient portals and the management of pediatric chronic diseases – a systematic literature review.CrossRef |
 Care of Children Act 2004 [NZ]. Pub. Act 2004 No. 90 (2004 Nov 21). [cited 2017 May 1]. Available from: http://legislation.govt.nz/act/public/2004/0090/latest/DLM317233.html?search=ts_act%40bill%40regulation%40deemedreg_Care+of+Children+Act+2004_resel_25_a8p=1%2f#DLM317462
 The Royal New Zealand College of General Practitioners. Workforce Survey 2016 – Technology. Wellington: The Royal New Zealand College of General Practitioners; 2017. [cited 2017 May 1]. Available from: https://oldgp16.rnzcgp.org.nz/assets/New-website/Publications/GP-Workforce/Workforce-Survey-2016TechnologyReport-HR.pdf
 Privacy Act 1993 [NZ], s 29(1)(d). Pub. Act 1993 No. 28 (1993 May 17). [cited 2017 May 1]. Available from: http://legislation.govt.nz/act/public/1993/0028/latest/DLM297083.html?search=ad_act__privacy____25_ac%40bn%40rn%40dn%40apub%40aloc%40apri%40apro%40aimp%40bgov%40bloc%40bpri%40bmem%40rpub%40rimp_ac%40ainf%40anif%40bcur%40rinf%40rnif_a_aw_se8p=1
 Health Act 1956 [NZ], s 22 F. Pub. Act 1956 No. 65 (1956 Oct 25). [cited 2017 May 1]. Available from: http://legislation.govt.nz/act/public/1956/0065/latest/DLM305840.html?search=ta_act_H_ac%40ainf%40anif_an%40bn%40rn_25_a8p=2#DLM306582 and Health Information Privacy Code 1994 [NZ], rule 11(4). (2015 Oct 15) [cited 2017 May 1]. Available from: https://privacy.org.nz/assets/Files/Codes-of-Practice-materials/Consolidated-HIPC-current-15-Oct-2015-inc-amdmts-2-8.pdf
 Gu Y, Orr M, Warren J. Health literacy and patient portals. J Prim Health Care 2015; 7 172–5.
 Kerkin S. Privacy Commissioner. Disclosing children’s health information: a legal and ethical framework. Consent in Child Health Workshop; 1998 Aug 6; Wellington. Wellington: Privacy Commissioner; 1998. [cited 2017 April 22]. Available from: https://www.privacy.org.nz/news-and-publications/speeches-and-presentations/disclosing-children-s-health-information-a-legal-and-ethical-framework/
 Denny S, Farrant B, Cosgriff J, et al Forgone health care among secondary school students in New Zealand. J Prim Health Care 2013; 5 11–18.
 Denny S, Farrant B, Cosgriff J, et al Access to private and confidential health care among secondary school students in New Zealand. J Adolesc Health 2012; 51 285–91.
| Access to private and confidential health care among secondary school students in New Zealand.CrossRef |
 Care of Children Act 2004 [NZ], s 38. Pub. Act 2004 No. 90 (2004 Nov 21). [cited 2017 May 1]. Available from: http://legislation.govt.nz/act/public/2004/0090/latest/DLM317233.html?search=ts_act%40bill%40regulation%40deemedreg_Care+of+Children+Act+2004_resel_25_a&p=1%2f#DLM317462
 Gillick v West Norfolk and Wisbech Area Health Authority  3 ALL ER 402 (HL). The decision was noted with approval by the New Zealand Court of Appeal in Re J  2 NZLR 134.
 Ministry of Health. Consent in Child and Youth Health: Information for Practitioners. Wellington: Ministry of Health; 1998. [cited 2017 Apr 22]. Available from: http://www.health.govt.nz/publication/consent-child-and-youth-health-information-practitioners
 Privacy Act 1993 [NZ], s 29(1)(c). Pub. Act 1993 No. 28 (1993 May 17). [cited 2017 Aug 18]. Available from: http://legislation.govt.nz/act/public/1993/0028/latest/DLM297083.html?search=ad_act__privacy____25_ac%40bn%40rn%40dn%40apub%40aloc%40apri%40apro%40aimp%40bgov%40bloc%40bpri%40bmem%40rpub%40rimp_ac%40ainf%40anif%40bcur%40rinf%40rnif_a_aw_se8p=1
 Privacy Act 1993 [NZ], s 29(1)(f). Pub. Act 1993 No. 28 (1993 May 17). [cited 2017 Aug 18]. Available from: http://legislation.govt.nz/act/public/1993/0028/latest/DLM297083.html?search=ad_act__privacy____25_ac%40bn%40rn%40dn%40apub%40aloc%40apri%40apro%40aimp%40bgov%40bloc%40bpri%40bmem%40rpub%40rimp_ac%40ainf%40anif%40bcur%40rinf%40rnif_a_aw_se8p=1
 The Royal New Zealand College of General Practitioners. Child and adolescent health: patient portals, health information and disclosure. Wellington: The Royal New Zealand College of General Practitioners; 2017. [cited 2017 August 18]. Available from: https://oldgp16.rnzcgp.org.nz/assets/New-website/Dashboard/Resources/Guides-and-modules/Patientportalschildandadolescenthealth-Final-April-2017.pdf [accessible to College members only]