The teen portal: the hardest configuration in the EHR

Why the default proxy setting is built for a different patient

Most EHRs create a family record at intake and grant the account holder — almost always a parent — full proxy access to a minor's chart automatically, with every future note visible the moment it's signed. That default is built for a pediatric well visit, not for a fifteen-year-old disclosing substance use or asking about contraception. Left unconfigured, the parent-proxy login sees everything, on the same day it's written.

The fix is not a blanket lockout at intake; most states still expect — and several require — parents to see routine pediatric care. What you need is a second access tier that activates once a patient reaches your state's minor-consent age for a specific service, usually behavioral health, reproductive health, or substance use treatment, and that tier has to restrict the parent-proxy account without also blocking the teenager's own access to the same record. Build this tier before the first teenager who needs it walks into your waiting room.

The federal floor: information blocking and the eight exceptions

The 21st Century Cures Act's information-blocking rule treats you as an actor and presumes you'll give patients — including adolescent patients with their own access rights — electronic access to their health information; withholding it is presumed information blocking unless one of eight defined exceptions applies 1Ref 1Office of the National Coordinator / ASTP (2026).Information Blocking.Establishes that adolescent patients have a federal right to electronic access to their own health information, and that withholding it is presumed information blocking absent one of the eight exceptions..

The exception a solo practice actually leans on here is the privacy exception, which lets you withhold or delay access when state law requires the patient's own consent to disclose, or when release would reveal information the patient shared in confidence. Work through the eight exceptions before configuring a blanket suppression rule for adolescent charts — a system-wide rule that also hides growth charts and immunization records from every parent-proxy account is broader than the rule allows, and that overcorrection is what draws attention.

State law, not your EHR vendor, decides who is the personal representative

HIPAA does not define who can access a minor's chart; it defers to state law, and treats whoever qualifies as the personal representative as if they were the patient themselves, with the same access rights, except where state law creates a specific exception 2Ref 2HHS Office for Civil Rights (2026).Personal Representatives.Establishes that HIPAA defers to state law on who qualifies as a minor's personal representative, and that a parent's default access can be limited in abuse/endangerment or state-law-consent situations..

States vary widely on the services a minor can consent to independently — reproductive health, mental health, and substance use are the three that show up in the most state statutes — and on whether a parent automatically becomes the personal representative for everything else. HIPAA also lets you withhold access from a parent where state law permits it or where you reasonably believe disclosure would endanger the patient, which matters most when custody and the chart intersect: a noncustodial parent's proxy request is not automatically valid, and a record flagged mid-dispute needs review before any account gets new access.

What a teenager, and a parent, can actually request under HIPAA

Once someone qualifies as the patient's personal representative, HIPAA's right-of-access rule gives them the same pull a competent adult patient has: inspect and obtain a copy of the record within 30 days, with one 30-day extension, for a reasonable cost-based fee — except that psychotherapy notes are carved out of the access right entirely 3Ref 3HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.Establishes the 30-day (plus one extension) right-of-access timeline and fee rule, and that psychotherapy notes are excluded from the access right regardless of patient age..

That carve-out does real work in a teen-portal configuration: therapy process notes kept separate from the rest of the chart are the one category neither a confused proxy setting nor an overzealous open notes policy can expose, because the access right itself doesn't reach them. Everything else in the chart — diagnoses, medications, lab results, visit summaries — is subject to the same 30-day clock regardless of the patient's age, so a portal that silently drops adolescent requests to the bottom of the queue is a compliance problem, not just a workflow one.

Configuring the tiers: what to actually change in the EHR

Most EHR portal-configuration screens expose three settings worth checking today: the age at which proxy access auto-restricts, whether sensitive encounter types can be individually flagged as patient-only, and whether the patient gets a login separate from the family account. Turn all three on deliberately rather than trusting the vendor's default.

• Age-based proxy step-down: set to your state's minor-consent age for the most sensitive service line you provide, not a single practice-wide default.
• Encounter-level flags: flag the encounter, not the chart. A chart-level lock also hides the immunization record and growth curve from a parent who is otherwise entitled to see them.
• Separate teen login: issue the adolescent their own credential to the portal the same day the flag goes on — a flagged note nobody can read isn't confidential, it's just invisible to the wrong person until IT gets a request.
• Quarterly audit: a proxy tier configured correctly at intake can silently revert after an EHR update; check it on the same cadence as your other portal settings.

Your portal vendor is a business associate too

The patient portal itself is software a vendor operates on your behalf, which makes the vendor a business associate under HIPAA the moment it creates, receives, maintains, or transmits PHI for your practice — proxy-access logic included 4Ref 4HHS Office for Civil Rights (2026).Business Associates.Establishes that the portal vendor is a business associate whose BAA should be checked before relying on its adolescent-access configuration.. That relationship is worth remembering the first time a proxy-access bug shows up: the vendor's support team is now handling PHI too, whatever channel they use to help you fix it.

Before you rely on a vendor's adolescent-access feature to carry legal weight, confirm the business associate agreement actually covers portal configuration, not just hosting and backup. If the EHR you're on doesn't support encounter-level sensitivity flags at all, that gap becomes a real line item the next time you're evaluating the ehr migration — a system that can't separate a therapy note from a growth chart isn't one a solo behavioral health practice can configure around indefinitely. ONC's contracting guide covers exactly this kind of data-access term to negotiate before signing a new agreement 5Ref 5Office of the National Coordinator (2016).EHR Contracts Untangled: Selecting Wisely, Negotiating Terms, and Understanding the Fine Print.Supports negotiating EHR contract terms around data-access configuration, including adolescent-specific proxy and sensitivity-flag capability, before signing..

Building the practice's written policy

Put the configuration decisions in a one-page policy before the first teenager needs them: the age threshold, which encounter types get flagged, who approves an exception, and how a custody dispute pauses new proxy grants until it's resolved. A written policy also gives a covering colleague or a new hire something concrete to follow instead of guessing at your intent from old chart entries.

Review the policy against your state's minor-consent statute annually — several states have moved the consent age for specific services in recent years, and a policy written to an old statute quietly becomes wrong. For practices where schools as referrers make up a meaningful share of adolescent intake, loop the policy into the consent paperwork collected before the first visit, so the confidentiality question is settled before the teenager is sitting in the room rather than negotiated live.