The solution is for hospitals to make it easy to set up a proxy account, which will allow the patient to limit the kinds of information the proxy can access, Prof. Latulipe said. That way the proxy can have their own account with a different username and password from the patient, she adds.
To take a closer look at proxy accounts, Prof. Latulipe and her colleagues randomly chose one independent hospital and one health system-affiliated general medical hospital from every U.S. state and the District of Columbia to be called by a researcher posing as a caregiver between May and December 2018.
“The study, which included the use of deception, was approved by the Wake Forest School of Medicine Institutional Review Board,” Prof. Latulipe and her colleagues explain. “Informed consent was waived because institutions were considered the study participants and obtaining informed consent would likely lead to social desirability bias.”
The new study highlights issues with the way electronic access is set up for patients and their proxies, says Albert Wu, MD, an internist and a professor of health policy and management at the Johns Hopkins Bloomberg School of Public Health, Baltimore.
“I think the patient portal is one of the best things about the electronic health record, which has been a bit of a mixed blessing, though admittedly an advance,” Dr. Wu says. “It’s a convenient way for doctors and patients to securely communicate, with a guarantee that the patient will actually get the message. But, patient portals have their own perils.”
It’s disturbing that one quarter of the hospitals did not offer a proxy portal, which means that patients who are not tech savvy may not be able to get help accessing their information, Dr. Wu says. “Perhaps even more disturbing is that at half of the hospitals the workaround recommended was for patients to share their password with their proxies,” he adds.
“This suggests the current system is broken,” Dr. Wu says. “It’s vital for patients to be able to stay in touch with their doctors and that’s especially true during this COVID crisis. This study reveals that despite the billions invested in the electronic health record, organizations haven’t taken the basic step of providing proper access for patients to this vital communication channel.”
References
- Latulipe C, Mazumder SF, Wilson RKW, et al. Security and privacy risks associated with adult patient portal accounts in U.S. hospitals. JAMA Intern Med. 2020 May 4. [Epub ahead of print]
- DesRoches CM, Walker J, Delbanco T. Care Partners and patient portals-faulty access, threats to privacy, and ample opportunity. JAMA Intern Med. 2020 May 4. [Epub ahead of print]
