Shared Access to Adults' Patient Portals: A Secret Shopper Exercise

Abstract

Background Millions of Americans manage their health care with the help of a trusted individual. Shared access to a patient's online patient portal is one tool that can assist their care partner(s) in gaining access to the patient's health information and allow for easy exchange with the patient's care team. Shared access provides care partners with a validated and secure method for accessing the patient's portal account using their own login credentials. Shared access provides extra privacy protection and control to the patient, who designates which individuals can view their record. It also reduces confusion for the care team when interacting with the care partner via the portal. Shared access is underutilized among adult patients' care partners.

Objectives Investigate the process of granting or receiving shared access at multiple health care organizations in the United States to learn about barriers and facilitators experienced by patients and care partners.

Methods The Shared Access Learning Collaborative undertook a “Secret Shopper” exercise. Participants attempted to give or gain shared access to another adult's portal account. After each attempt they completed a 14-question survey with a mix of open- and closed-ended questions.

Results Eighteen participants attempted to grant or receive shared access a total of 24 times. Fifteen attempts were successful. Barriers to success included requiring paper forms with signatures, lack of knowledgeable staff, lack of access to technical support, and difficult-to-navigate technology. Facilitators included easy-to-navigate online processes and accessible technical help. Participants who were successful in gaining shared access reported feeling more informed and able to engage in shared decision-making.

Conclusion The outcomes of our secret shopper exercise underscore the importance of collaboration aimed at learning from diverse encounters and disseminating the best practices. This is essential to address technical, informational, and organizational obstacles that may impede the widespread and accessible adoption of shared access.

Keywords

patient portal - caregiver - informal caregiver - family caregiver - patient engagement - proxy access - shared access

Background and Significance

Millions of Americans manage their health care and well-being with the help of a family member, friend, or other trusted individual.[1] While care partners can be critically important to the patient's well-being, they are often not well-supported by health care systems and can struggle to get the information they need.[2] In addition, they often hold information about the patient that is important for the care team to know related to care plans and outcomes.[3] [4] One potential solution to this challenge of information flow is shared access to the patient portal. Shared (proxy) access allows one or more trusted care partners, with the patient's permission, to access the patient's health information on the portal with a unique username and password.[5] Shared access may be particularly important for patients with diminished cognitive capacity or limited English proficiency or who are uncomfortable with technology.[6]

Most often, care partners with shared access are able to see all of the patient's information in the portal, such as medical history, medications, medical and/or behavioral health notes, and details of upcoming appointments.[6] They can complete previsit questionnaires and view test results, and they have easy access to a patient's medical information in case of emergency. In addition to viewing, the patient portal can offer care partners a convenient, validated, and confidential way to contact the care team to ask questions and provide important patient-related information.

Prior research indicates that shared access is beneficial for care partners.[7] However, while shared access is an option in most commercially available patient portals, uptake of this functionality is low. Studies suggest it is common practice for care partners to instead log in using the patient's credentials.[7] [8] [9] [10] Accessing patient records in this way, while convenient, can impact patient autonomy and can confuse clinicians who may not know with whom they are communicating.[7] Further, clinicians may not be confident that the care partner has the patient's permission to use the portal or communicate with the care team on their behalf. When a patient has specifically granted a care partner shared access, the care team can see who is communicating with them and be sure that the patient has authorized this access. However, the process of gaining or granting shared access can be difficult, often requiring multiple steps and follow-up, which may serve as a barrier to patients who want to choose this option.[11]

Lowering barriers to granting shared access requires first understanding both what is working well and where patients encounter challenges—particularly those related to technology and organizational policy. Toward that end, the Coalition for Care Partners[12] convened the Shared Access Learning Collaborative (“the Collaborative”) as part of a larger multisite study designed to build awareness and increase the uptake and use of shared access.[5] The Collaborative grew out of early findings from the study pointing to the importance of context and organizational setting to increasing the use of shared access and to opportunities for cross-organizational learning. The Collaborative brings together interested patients, care partners, electronic health record (EHR) vendors, health care providers, and other health system staff. The Collaborative's overall goal is to share and disseminate information about shared access to health systems and other health care stakeholders. The objective of this study is to describe the Collaborative members' experiences with the process of granting shared access to the patient portal through a secret shopper exercise.

Methods

In March 2023, the Collaborative discussed and agreed to implement a “Secret Shopper” exercise to learn more about the direct experience of trying to grant or receive shared access. Members of the group were asked to attempt to either grant shared portal access to or receive shared portal access from a trusted friend or family member. After each attempt, participants were asked to complete an online survey about the experience.

The survey consisted of 14 questions, 6 closed- and 8 open-ended ([Supplementary Appendix A]). The closed-ended survey items built on an environmental scan conducted by our team and asked participants to report on the following[13]: (1) whether they were trying to grant or receive shared access (response options: give someone else access to your health information, gain access to someone else's health information), (2) whether shared access was allowed at the health care system (response options: yes, no, don't know), (3) where they found information about shared access (check all that apply: Web site, portal log in page, in the portal after logging in, poster/handout in the office, from staff, other [please specify]), and (4) whether the respondent was successful at granting or receiving shared access (response options: yes, no, other). Open-ended survey items asked participants to report, in their own words, on (1) the ease or difficulty of finding information about shared access, (2) the steps they were required to take to register for shared access, (3) how long it took to complete the registration process, (4) any other reflections they wanted to share, and, if utilized, (5) any impacts on care processes.

The secret shopper exercise was conducted between April 11, 2023 and June 13, 2023. Research team members analyzed the responses. For all closed-ended questions, we calculated frequencies of response attributes for each attempt to grant or receive shared access. For all free text questions, a research team member (D.W.) developed codes and coded responses' themes, then a second team member (C.M.D.) coded responses, and they resolved conflicts through discussion.[14] [15] We grouped the open-ended responses into the following themes: finding information about shared access (subtheme of how easy/difficult it was to find information), steps required for shared access (subtheme of paper or electronic, help required, other), the impact of having shared access, and other reflections (codes are available in [Supplementary Appendix B]).[9] [10]

Findings

Twenty-four surveys were submitted by 18 participants ([Table 1]). Participants made attempts to grant or receive shared access at 17 health care organizations that use 4 different commercially available patient portals. Of the 24 attempts, 9 were trying to grant access and 15 were trying to receive access. Fifteen of the 24 attempts were successful. Of the 15 successful attempts, 8 took less than 1 hour to complete, 1 required a full day, and 6 took more than a day.

Table 1 Characteristics of secret shopper attempts to grant or receive shared access

	Attempts to grant or receive shared access N = 24
Total number of participants	18
Total number of health systems	17
Is shared access offered at the health care system
Yes	20
No	2
Not sure	2
Tried to grant access to someone else	9
Tried to receive access from someone else	15
Were you able to grant/receive access?
Yes	15
No	9
How long did it take to grant/receive access?
Less than 1 h	8
1–24 h	1
2–6 d	3
7 days or more	3
Was not able to complete process	9

Finding and Utilizing Information about Shared Access

Finding Information

Information about shared access was found through various means: most commonly after logging into the portal, but also finding information on the portal log-in page before logging in, or through the staff/clinic ([Table 2]).

Table 2 How participants learned about shared access

Where did you find information about shared access?		Number of responses (n)
On the portal	After logging in	7
	On the portal login page	2
From the health care organization	Discussed with clinic staff	1
	Learned as an organizational committee member	1
From health care organization information technology department	Received an email about child's account	1
	Telephoned the portal help desk	1
	Was contacted by the portal help desk	1

When asked to describe, in their own words, the process of finding information about shared access, participants' experiences were about evenly divided between easy (n = 10) and difficult (n = 8). Participants who said it was easy to find information reported: searching using the word “proxy” in the portal, using drop down menus in the portal, using internet search engines to find additional information, and receiving a link for sign-up after the hospital received permission from the patient.

Those responding that it was difficult to find information reported the following experiences: (1) having to call the health system, usually the tech support line, instead of being able to find the information online, (2) difficulty reaching a person with the correct information or receiving incorrect information, (3) having to use the patient's log-in information for verification, and (4) being required to set up an account because they were not a patient at the health care system. One participant reported watching a video produced by a vendor of commercially available patient portals, but the information in the video did not apply to their health care organization's version of that portal, despite finding the video on the organization's Web site.

Utilizing Information

Of the 24 attempts to grant or receive shared access, in 9 attempts participants used a fully electronic online process, in 5 attempts participants were required to complete a paper form and either mail it to the health care organization or deliver it in person, and in 2 attempts participants had to complete the process by phone. In 3 attempts, participants needed the involvement of the organization's help desk and in another 3 attempts the participants had to set up their own individual portal account because they were not patients at the health care organization.

Barriers and Facilitators to Granting or Receiving Shared Access

Overall, respondents reflected that there are barriers to granting and receiving shared access related to technology, required documentation, and access to resources for guidance ([Fig. 1]). The lack of a remote option for sign up at some organizations—having to print, sign (requiring signatures from both the patient and the care partner), and mail forms, or having to complete forms in person—was noted as burdensome for patients and care partners. Several participants remarked on the lack of knowledgeable support staff at the health care organization. Telephone help desk hours were also a barrier for several participants, as they were required to call during business hours.

Fig. 1 Barriers to shared access. This figure displays the barriers to shared access identified by participants grouped by themes.

“Tech support could never be reached by email or phone in real time. I had to wait for them to call me back.”

One person reported receiving conflicting and at times inaccurate information from different members of the tech support line at one organization and being told to use the patient's log-in information.

“They basically told me that since he's an adult he cannot give someone else access and if he wants me to have access then I should use his log-in credentials.”

Finally, those who reported having to create a patient portal account for themselves or their care partner to grant them shared access (because the care partner is not a patient in the same health system) said that this was a time-consuming and multistep process.

“My husband is not a patient, so I had to create a new account for him. The new account process for a non-existing patient requires linking my husband's identity to Experian credit data.”

Portal navigation was also a challenge for some participants, as was multifactor authentication (although participants did acknowledge the importance of data security).

Some participants reported that the process was relatively easy for them to complete. Participants specifically noted the option to complete the process electronically, through the patient portal, and easy navigation to the functionality in the portal as facilitators of granting shared access. Some reported utilizing easily accessible and knowledgeable assistance over the phone ([Fig. 2]).

Fig. 2 Facilitators to shared access. This figure displays the facilitators to shared access identified by participants grouped by themes.

Finally, among all participants several noted that they found it difficult to understand what granting shared access would mean for their health data privacy—citing as a potential barrier the idea that someone with shared access would see everything in their record. Participants noted the need for more information to understand the full data privacy implications of granting or receiving shared access.

The Impact of Granting or Receiving Shared Access

When participants who used newly acquired shared access were asked to reflect on its impact, they cited several benefits. Those benefits included an enhanced ability to communicate with the care team, “I can communicate with the care team, coordinate care, access test results, and progress notes. It is a must have for anyone involved in another's care”; feeling more informed, “It provides all the medical information needed to stay informed and make decisions”; and being better able to participate in shared decision-making, “I have been able to stay up to speed in between phone calls from providers and the hospital. On those calls, I'm ready with questions and can build on what I'm eyeing on the patient portal.” No participants shared any negative experiences with shared access.

Discussion

This article reports on the experiences of 18 individuals trying to grant or receive shared access to the patient portal. Their experiences suggest that the process of granting or receiving shared access can be challenging. It can be difficult to find accurate information and knowledgeable staff and often the process itself is technically formidable. Some participants did report having easier experiences, indicating that best practices to learn from do exist.

Patient portals are increasingly used as visit extenders, providing patients and care partners with access to visit notes, test results, and other information important for managing their health and next steps.[16] Similarly, these platforms are being used in advance of visits to set visit agendas and collect previsit information, including patient-reported outcomes.[17] Ensuring that patients with care partners have shared access to the patient portal could both increase the likelihood that these previsit data will be collected and also reduce the potential for disparities in portal use.[7] [18] [19]

Findings from the secret shopper exercise echo earlier work reporting that patient-facing information about the availability and features of shared access to patient portals can be difficult to find.[13] This report extends that work, by providing a more recent snapshot at a time when the use of patient portals is increasing overall both for viewing information and communicating with the care team and offers several solutions.[18] First, all health systems should review, with the input of patients and care partners, their processes for granting shared access. By including the end users—patients and care partners—in the review, they are likely to identify areas for improvement and ensure that the shared access processes align with the needs and preferences of those directly affected. This collaborative approach promotes transparency, trust, and patient-centered care, ultimately leading to more effective and user-friendly systems. Second, health care organizations could prioritize the use of electronic processes, via the patient portal, for designating shared access (while also still allowing for an in-person process for those who prefer that option).[5] Ideally these processes would be supported by knowledgeable staff providing guidance and helping patients who are not comfortable navigating the portal independently.[5] Finally, health systems can work to reduce or eliminate barriers that discourage patients from granting shared access, such as streamlining the process of granting shared access to care partners who are not patients in the same system.[5]

Beyond making the process of granting or receiving shared access easier, health systems, EHR vendors, patients, and care partners should all engage together in conversations about how patient privacy is affected by shared access, as each have a significant role to play in protecting privacy while also improving access.[20] [21] [22]

Protecting patient data from unauthorized disclosure is a central goal of the Health Insurance Portability and Accountability Act (HIPAA). Administrative processes that were noted as difficult (e.g., paper forms, requiring in person registration) were likely put in place by organizations to comply with HIPAA and ensure that only people specifically authorized by the patient were granted access to their health information. Further, some participants were concerned about granting or receiving access to the entire record, including sensitive information that the patient may not want shared. The development of technical and policy solutions to this problem is underway. Efforts to increase support for data segmentation, which would allow data to be tagged as “sensitive” and enable patients to indicate whether such information should be shared, are in development.[23] [24] However, implementing this change is technically challenging for electronic health record vendors and these solutions are not imminent.[25] In the meantime, increased efforts by health care organizations to understand how patients and care partners experience shared access could help in developing educational efforts and implementations that balance privacy-related concerns with the information needs of care partners.

There are several limitations to our study that must be noted. First, we had a small number of participants, and their experiences might not be generalizable. Our study participants were members of the Shared Access Learning Collaborative and are engaged in the issue of shared access. A study of this type repeated with the general public might yield very different results. The prevalence of barriers and failures to complete the process reported by our knowledgeable participants suggests that these issues would be experienced much more frequently by the general public, where we would expect to see lower levels of knowledge about shared access. Second, our study relied on participant self-report, and we did not collect artifacts such as screenshots of a health care organization's online help or frequently asked questions. However, participants' experiences with barriers to portal registration, in contrast to how an organization expects this navigation to happen, are critical to understanding how patients and care partners navigate the process, and as such offer important insight into how such processes can be improved. Finally, we did not collect participant or health care organization characteristics. We chose not to collect participant characteristics beyond giving them the option to share their name, which was removed from the data file, to maintain their anonymity. While we did ask participants to identify the health system, we did not collect any further information about the type of provider, location, or size. Health care organizations are complex, and patients may not have accurate information about their characteristics. Additionally, there are significant methodological challenges related to matching health care organization names with their structural attributes and characteristics.[26]

Conclusion

Facilitating shared access to the patient portal for care partners presents a convenient and vital channel for enhancing communication with the care team, catering to the needs of millions of Americans who depend on a friend, family member or other trusted individual for assistance in managing their health care and overall well-being. Our secret shopper exercise unveiled noteworthy variability in these experiences, finding some barriers and some facilitators to shared access. The findings underscore the imperative for cross- and intraorganizational collaboration, such as that of the Collaborative, aimed at learning from the diverse experiences of patients, care partners, clinicians, and staff, and disseminating best practices. This collaborative effort is essential to address technical, informational, and organizational obstacles that may impede the widespread and accessible adoption of shared access.

Clinical Relevance Statement

Care partners need ready access to patient information as well as a convenient channel for providing information about the patient back to the care team. The patient portal offers a readily available solution; however, many care partners of adult patients use the patient's log-in credentials to view their information in the patient portal. This impacts patient autonomy and can create confusion for practitioners who do not know with whom they are communicating and if the patient has given permission for the care partner to access their record. The secret shopper exercise highlighted some of the barriers to shared access and offers suggestions for how health systems can facilitate the use of shared access to improve communication and engagement with patients and their trusted care partners.

Multiple-Choice Questions

1. What is shared (proxy) access?

   • All clinicians involved in a patient's care have access to the patient's electronic health record.

   • A patient's care partner(s) can view their patient portal information using the patient's log-in credentials.

   • Hospitals can access a patient's electronic health record even when the patient usually gets care elsewhere.

   • A patient's care partner(s) can view their patient portal information using their own unique log-in credentials.

   Correct Answer: The correct answer is option d. Shared (also called proxy) access to a patient portal allows a patient to designate one or more individuals to have access to the information in their portal account. The designated individuals have their own unique log-in credentials.

2. What is one benefit of shared access?

   • The care team knows with whom they are communicating in the portal.

   • The patient can determine what is shared with the person who has shared access.

   • The patient and care partner can communicate with each other in the portal.

   • The clinician can determine what is shared with the person who has shared access.

   Correct Answer: The correct answer is option a. When care partners use the patient's log-in credentials and send messages to the care team, there is confusion about who is sending the message and if that person has the patient's permission to send the communication. A benefit of shared access is that the care team knows with whom they are communicating, and that this person was given permission to have access to the patient's records. As of now, patients and providers cannot decide if some information goes to just the patient's portal account and is not shared with the care partner.

Conflict of Interest

None declared.

Acknowledgments

The authors would like to thank the John A. Hartford Foundation and the Cambia Health Foundation for their support of, and the members of the Shared Access Learning Collaborative for their participation in, this work.

Protection of Human and Animal Subjects

The larger study, involving pilot interventions at three health systems, was reviewed and approved by the Institutional Review Boards at Beth Israel Deaconess Medical Center and Johns Hopkins Medicine.

• References

• 1 Schulz R, Eden J. Families Caring for an Aging America. National Academies Press; 2016
• 2 Wolff JL, Freedman VA, Mulcahy JF, Kasper JD. Family caregivers' experiences with health care workers in the care of older adults with activity limitations. JAMA Netw Open 2020; 3 (01) e1919866
• 3 Sherman DW, McGuire DB, Free D, Cheon JY. A pilot study of the experience of family caregivers of patients with advanced pancreatic cancer using a mixed methods approach. J Pain Symptom Manage 2014; 48 (03) 385-99.e1 , 2
• 4 Carlsen B, Lundberg K. 'If it weren't for me…': perspectives of family carers of older people receiving professional care. Scand J Caring Sci 2018; 32 (01) 213-221
• 5 Dukhanin V, Wolff JL, Salmi L. et al; Shared Access Project Team. Co-designing an initiative to increase shared access to older adults' patient portals: stakeholder engagement. J Med Internet Res 2023; 25: e46146
• 6 Wolff JL, Spillman BC, Freedman VA, Kasper JD. A national profile of family and unpaid caregivers who assist older adults with health care activities. JAMA Intern Med 2016; 176 (03) 372-379
• 7 Gleason KT, Peereboom D, Wec A, Wolff JL. Patient portals to support care partner engagement in adolescent and adult populations: a scoping review. JAMA Netw Open 2022; 5 (12) e2248696
• 8 Reed ME, Huang J, Brand R. et al. Communicating through a patient portal to engage family care partners. JAMA Intern Med 2018; 178 (01) 142-144
• 9 Latulipe C, Mazumder SF, Wilson RKW. et al. Security and privacy risks associated with adult patient portal accounts in U.S. hospitals. JAMA Intern Med 2020; 180 (06) 845-849
• 10 Gleason KT, Wu MMJ, Wec A. et al. Use of the patient portal among older adults with diagnosed dementia and their care partners. Alzheimers Dement 2023; 19 (12) 5663-5671
• 11 Wolff JL, Dukhanin V, Burgdorf JG, DesRoches CM. Shared access to patient portals for older adults: implications for privacy and digital health equity. JMIR Aging 2022; 5 (02) e34628
• 12 OpenNotes, Johns Hopkins University. Coalition for Care Partners. Coalition for Care Partners. 2022 . Accessed June 17, 2024 at: https://coalitionforcarepartners.org/
• 13 Wolff JL, Kim VS, Mintz S, Stametz R, Griffin JM. An environmental scan of shared access to patient portals. J Am Med Inform Assoc 2018; 25 (04) 408-412
• 14 Urquhart C. Grounded Theory for Qualitative Research: A Practical Guide. Sage Publications, Ltd; 2013
• 15 Brod M, Tesler LE, Christensen TL. Qualitative research and content validity: developing best practices based on science and experience. Qual Life Res 2009; 18 (09) 1263-1278
• 16 Antonio MG, Petrovskaya O, Lau F. The state of evidence in patient portals: umbrella review. J Med Internet Res 2020; 22 (11) e23851
• 17 Walker J, Leveille S, Kriegel G. et al. Patients contributing to visit notes: mixed methods evaluation of OurNotes. J Med Internet Res 2021; 23 (11) e29951
• 18 Richwine C, Johnson C, Patel V. Disparities in patient portal access and the role of providers in encouraging access and use. J Am Med Inform Assoc 2023; 30 (02) 308-317
• 19 Ratcliff CL, Krakow M, Greenberg-Worisek A, Hesse BW. Digital Health Engagement in the US population: insights from the 2018 Health Information National Trends Survey. Am J Public Health 2021; 111 (07) 1348-1351
• 20 Reynolds TL, Cobb JG, Steitz BD, Ancker JS, Rosenbloom ST. The state-of-the-art of patient portals: adapting to external factors, addressing barriers, and innovating. Appl Clin Inform 2023; 14 (04) 654-669
• 21 Armstrong M, Benda NC, Seier K. et al. Improving cancer care communication: identifying sociodemographic differences in patient portal secure messages not authored by the patient. Appl Clin Inform 2023; 14 (02) 296-299
• 22 Ganta T, Appel JM, Genes N. Patient portal access for caregivers of adult and geriatric patients: reframing the ethics of digital patient communication. J Med Ethics 2023; 49 (03) 156-159
• 23 Sarabu C, Sharko M, Petersen C, Galvin H. Shifting into action: from data segmentation to equitable interoperability for adolescents (and everyone else). Appl Clin Inform 2023; 14 (03) 544-554
• 24 Petersen C, Galvin HK, Lehmann CU, Sharko M. Equitable interoperability through precise control of sensitive health information: an emerging pathway to health equity. Ann Intern Med 2024; 177 (03) 387-388
• 25 Office of the National Coordinator for Health Information Technology (ONC). Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (HTI-1) Final Rule. HealthIT.gov. 2023: 1-5
• 26 Furukawa MF, Machta RM, Barrett KA. et al. Landscape of health systems in the United States. Med Care Res Rev 2020; 77 (04) 357-366

Publication History

Received: 29 February 2024

Accepted: 19 July 2024

Accepted Manuscript online:
22 July 2024

Article published online:
09 October 2024