← Back to Resources

Practice Operations

Portal Access for Caregivers and Parents in Pediatrics

In pediatrics the portal account almost never belongs to the patient. What proxy portal access requires, where it breaks, and which decisions stay with people.

9 min read

In a pediatric practice the person reading the portal is almost never the patient. Portal access belongs to a parent, a stepparent, a grandparent with custody, or a caregiver who brings the child in while the parents work. Every message the practice sends is going to a person the chart describes indirectly, and every one of those relationships can change.

Most portal tooling was designed around an adult who owns their own record. Pediatrics inherits that design and then works around it, usually with a paper form at the front desk and an institutional memory of which families are complicated.

That workaround holds until something moves. A custody arrangement changes, a patient turns thirteen or fourteen depending on the state, a second caregiver asks for their own login, or a parent who has not been at a visit in two years calls to ask why they cannot see anything. Each of those is a records-access question with a real answer, and the front desk is usually the first place it gets asked.

The portal account usually belongs to someone other than the patient

Pediatric practices tend to underestimate how much of their communication runs through a proxy relationship, because the proxy is invisible in most reporting.

Portal use overall is no longer marginal. ONC reporting on 2022 survey data found 73% of individuals were offered online access to their medical records and 57% accessed a portal or online record at least once in the past year. In pediatrics those numbers describe caregivers acting on a child’s record rather than patients acting on their own.

That difference matters operationally because the practice’s contact data is caregiver data. The phone number on file is a parent’s phone. The email is a parent’s email. When a family changes shape, the chart’s contact fields and the portal’s access list can move independently, and a practice that maintains one while ignoring the other ends up sending a child’s information to a person who should no longer receive it.

The uncomfortable version of that sentence is the reason this is worth building properly rather than handling case by case.

athenaOne will tell you who actually has access

The first practical step is knowing the current state, which is a query rather than a filing cabinet.

GET /patients/{patientid}/portalaccess returns the list of users who have access to a given patient. That is the authoritative answer to who can see this child’s record right now, and it is frequently different from what the front desk believes.

Running that list as a report rather than a lookup changes what a practice can do with it. Children with no active proxy at all, which is the silent cause of unread reminders. Children with more than one proxy where the practice expected one. Proxies that were added years ago during an arrangement that has since ended.

None of that requires judgment to surface. It is a reconciliation exercise, and it is the kind of work that never gets done manually because it has no deadline attached. Running it on a schedule turns a slow-motion privacy risk into a worklist someone can clear.

The complication: access has to change on a birthday

This is the failure mode specific to pediatrics, and it arrives on a date nobody is watching.

Start from where most portals actually are. ONC’s Patient Engagement Playbook notes that many patient portals still offer a one-size-fits-all approach in which anyone with the right login sees the full record, and cites an environmental scan of 20 large and geographically diverse health systems finding that the majority give caregivers full access to portal information and features. The Playbook’s guidance to practice administrators is to check whether the EHR supports varying levels of access and to give each personal representative a unique, secure login rather than sharing the patient’s own credentials.

Pediatrics needs that granularity more than most, because the appropriate level of caregiver access changes as the child gets older. Every state gives adolescent minors the right to consent to at least some categories of care on their own, and where a minor may consent, what a parent may see narrows. The specific age and the specific categories are set by state law and by the practice’s own policy, written with its counsel.

The operational point is that the trigger is a birthday sitting in the chart, and nothing in a portal is watching for it. Full caregiver access usually just continues past the threshold, because no process was ever attached to the date. Custody is the second trigger and it arrives by phone rather than by calendar. A practice that updates the contact phone number after a custody change but never revisits the portal access list has done the easy half.

Automation earns its place here by watching the dates and assembling the packet, never by deciding the outcome. It can produce the list of patients crossing the practice’s configured age threshold in the next sixty days, send the caregiver notification the practice has already approved, collect the forms the new arrangement requires, and open a task against each record.

The handoff is every decision. Whether a specific minor may consent to a specific category of care, what a custody order actually grants, and where professional judgment should permit or deny access are determinations for the practice’s clinicians and its counsel. The front-office layer moves the paperwork and holds the deadline. It does not read the order and it does not decide who gets to see the chart.

Portal access and release authorization are two different records, and practices routinely treat them as one.

athenaOne carries release authorizations and consent details separately, readable through GET /patients/{patientid}/authorizations. A caregiver having a portal login is not the same fact as a signed authorization permitting disclosure to a school, a specialist, a sports program, or a parent who is not the personal representative.

Pediatrics generates more of these than most specialties. School and camp forms, sports physicals, early intervention programs, and specialist referrals each carry their own release, and each expires or narrows on its own schedule. When the two records are conflated, staff answer a disclosure question by checking whether the caller has a portal login, which is not the question.

The useful operational move is to check both and to say which one is missing. A request that needs an authorization on file should return the authorization form, prefilled and sent to the right adult, rather than a denial the caller has to decode. Chasing that paperwork is administrative work an automation can carry end to end, right up to the point where someone has to decide whether the disclosure is permitted.

Automate the reconciliation, escalate the judgment

The line here is cleaner than in most front-office workflows, which makes it a good place to be strict about it.

On the automatable side: reconciling the access list against the chart on a schedule, flagging patients approaching the practice’s configured age threshold, noticing children with no active proxy so reminders stop disappearing, chasing an authorization form that is missing or expired, and confirming a caregiver’s contact details are current before anything is sent to them.

On the human side: interpreting a custody order, applying state minor-consent law to a specific patient, and handling any request that raises a safety concern. Those are legal and clinical determinations, and an automation should be configured so it cannot make them. The correct behavior when one appears is to stop, package what it has, and put it in front of the right person.

Measured honestly, the win is not speed. It is that a set of records-access questions which currently surface only when someone complains become a worklist the practice sees in advance. The date-driven ones stop being surprises, and the judgment-driven ones reach the right person with the paperwork already assembled.

Key Takeaways

  • Report on portal access as a list, not a belief. Query who currently has access to each pediatric record and reconcile it against the chart on a schedule.
  • Look for children with no active proxy at all. That is the quiet reason reminders and results notifications go unread in a pediatric panel.
  • Attach a process to the age threshold your state and your policy set. Caregiver access continues past it by default because nothing is watching the date.
  • Treat custody changes as an access event, not just a contact-record update. Updating the phone number and leaving the access list alone finishes half the job.
  • Keep release authorizations separate from portal logins in your process. A caregiver having a login does not answer a disclosure question.
  • Return the missing form rather than a denial. If a request needs an authorization on file, send the prefilled form to the right adult.
  • Let automation watch dates, assemble packets, and chase signatures. Do not let it interpret a custody decree or apply state law to a specific minor.
  • Route anything raising a safety concern straight to a clinician, and configure the automation so it cannot resolve a legal or clinical access question on its own.

Proxy access is where a pediatric practice’s privacy posture and its communication reliability turn out to be the same problem. Get it wrong in one direction and messages reach someone they should not. Get it wrong in the other and a family stops receiving anything, then stops showing up. Most of the work between those two failures is reconciliation, date-watching, and paperwork, which is exactly the work that never gets scheduled. An AI team working inside athenaOne can hold the access list against the chart, surface the birthdays and the gaps before they become complaints, and put every judgment call in front of the person whose job it is.

Sources

Ready to See It in Action?

See how PGA handles pediatric portal access and consent paperwork inside athenaOne

Schedule a Demo →

Written by Kevin Henrikson