Patient Portal Proxy Access for a Parent: Setup and Visits

Patient portal proxy access is a separate login, in your own name, that lets you see your parent's health system portal and often message their doctors or book appointments. Your parent usually grants it with a form or an invitation inside the portal, and you show ID. If your parent can no longer decide, their health care agent or guardian can request it with a copy of the paperwork. And to hear the appointment itself, you don't need the portal: with your parent's okay, a doctor can talk with you by phone or video.

Portal proxy vs. "health care proxy"

The word does double duty, and it confuses front desks too.

• Portal proxy access is a login that lets you view someone else's portal at one health system.
• A health care proxy is a legal document, called a health care power of attorney in many states, that names someone to make medical decisions. Our guide to health care proxy vs. power of attorney explains which is which.

You can have portal access without being anyone's agent, and you can be the agent without portal access. The two only meet when your parent can't sign for themselves.

Why not just use Mom's password?

Plenty of families do, and some hospitals have told them to. A study published in 2020 in JAMA Internal Medicine had a caller pose as a daughter asking about portal access for her mother at 102 US hospitals. At 42 of the 94 hospitals asked about password sharing (45%), staff endorsed it. The authors note that sharing login credentials has been linked to serious security risks, and that the staff who answered may not reflect each hospital's official policy.

The proxy route is better anyway:

1. Sharing is usually against the rules. Froedtert's adult proxy form, as one example, says sharing a login and password with anyone, including a proxy, is not permitted and that the proxy must use their own account.
2. There's an audit trail with your name on it. The same form says the system logs every login, view, download and action by the patient or the proxy. Logged in as yourself, the record shows that you read the lab result, not your 81-year-old father at 2 a.m. That matters if siblings ever disagree about who knew what.
3. The health system knows who you are. Forms ask for your name, date of birth and relationship, and staff usually check your photo ID.
4. It survives the new phone. When your parent's two-factor code starts going to a number nobody has anymore, your own login still works.

There's a gentler reason too. A password handed over in a hurry can feel like a takeover. A form your parent signs, choosing who sees what, feels like their decision, because it is.

How to request proxy access

Every health system runs its own process, but the shape is similar.

1. List the health systems. Each one is separate: a cardiologist at one system and a primary doctor at another means two requests. Start with the hospital they'd be taken to in an emergency.
2. Find the adult proxy form. Search the system's name plus "proxy access." Many systems keep separate forms for minors, for adults, and for adults who lack capacity.
3. Check for an online option. Some systems let your parent invite a proxy from inside their own portal account, usually under a sharing menu. That's often fastest.
4. Otherwise, fill out the paper form together. Expect your parent's name, date of birth and medical record number, plus your name, date of birth, email, phone and relationship. Your parent signs as the patient, and many forms have you sign as the proxy.
5. Create your own account. Cedars-Sinai's form, for instance, says the proxy must also obtain their own account, and has the proxy promise to keep their password confidential.
6. Bring photo ID. Show it in person or attach a copy, as the form asks.
7. Watch for the invitation. Ask how you'll be notified and how long approval takes. Often it's an email invitation a few days later; paper forms can take longer.
8. Log in once together. Let your parent watch you open their record from your phone. It's a good moment to adjust the access level, before you need it.

Levels of access, and what proxies usually see

Many systems offer more than one level. Full access usually means records, test results, messaging and scheduling. Limited access lets you view some information but not message or schedule.

With full access, a proxy can typically:

• See appointments, and often schedule or cancel them
• Read test results, visit summaries and the medication list
• Message the care team from inside your parent's record
• Request refills or see bills, where the portal offers it

What a proxy often can't see or do:

• Other health systems. Your access stops at that system's door.
• The whole history. Southwestern Vermont Medical Center's proxy form says plainly that the portal account contains limited medical information. For older or outside records you'll need a formal request; our guide to getting a copy of a parent's medical records covers that.
• Message as yourself. At Cedars-Sinai, proxy messages go out from the patient's record and replies come back there. Sign each message with your name and relationship so the nurse knows who's asking.

Your parent should also know what will be visible. That same Vermont form warns that what's released may include information about mental illness, alcohol or drug treatment, HIV and genetic testing. And in the JAMA Internal Medicine survey, only 13 of the 69 hospitals with proxy accounts said patients could limit what a proxy saw. If your parent wants you to see appointments but not everything, ask before signing.

A quick word on the 12 to 17 rules

If you've had proxy access for your own kids, you may remember it shrinking around age 12 or 13. Those teen rules come from state privacy laws and vary by state and health system. None of it applies to your parent: the only question is whether your parent agrees, or whether someone has legal authority to agree for them.

When your parent can't sign

If dementia or a serious illness means your parent can no longer make health care decisions, the person with legal authority can usually request access instead. Expect to provide:

• A health care agent: a copy of the health care power of attorney that names you. Froedtert's adult form is written for the patient, a health care agent under a durable power of attorney for health care, or a legal guardian. Note that it's the health care document they want, not a financial power of attorney.
• A guardian: a copy of the court order appointing you.
• A physician's sign-off: Cedars-Sinai's form for an adult with diminished capacity has the physician certify that proxy access is appropriate, based on things like an earlier health care directive and their own judgment about the patient's capacity.

If your parent's document only takes effect after a doctor finds they can't decide, the portal team may want that finding on file. Our HIPAA authorization guide explains that gap and how a separate release covers it. With no agent and no guardian, ask the medical records office what it accepts; who can act for an adult who never signed anything depends on state law.

Hearing the appointment itself

The portal shows what got written down. It won't tell you what the doctor said about whether Dad should still drive. For that, you need to be in the conversation.

What HIPAA allows

The rule at 45 CFR 164.510(b) lets a provider share information with a family member involved in a patient's care, limited to what's relevant to that involvement. An HHS FAQ gives the everyday version: if the patient is present and able to decide, the provider may talk with family if the patient agrees or, given the chance, doesn't object.

And yes, the phone counts. HHS says that where a provider may share information with someone, it may do so face-to-face, over the phone, or in writing.

HIPAA allows this but doesn't require it. HHS's page for families notes a provider doesn't have to share with family unless they're the patient's personal representative. So the smoothest calls are the ones where your parent has already said, out loud, "Please talk to my daughter."

Joining by phone

1. Tell the office ahead of time. When the visit is booked, have your parent say a family member will join by phone, and ask that it be noted.
2. Have your parent call you from the exam room. Speakerphone works. Ask them to tell the doctor they want you included.
3. Introduce yourself in one line. "I'm Linda, her daughter, I handle her medications."
4. Bring three questions, not eleven. If you have portal access, send them the day before.

Medicare's fact sheet Talking with a Friend's or Family Member's Doctor During an Appointment says the doctor must get your parent's permission, and that once they have it, the doctor can talk directly with you. During your parent's medically necessary appointment, the doctor can spend time talking with you about their condition or treatment plan, even if your parent isn't in the room. Medicare says that time is part of the Part B payment for the visit, so the doctor can't bill Medicare or your parent separately for it.

Joining by video

Many health systems let a patient add a guest to a video visit, often by sending the guest their own link. Ask when booking.

If your parent gets care at VA, VA announced in 2023 that its Caregiver Connect option lets a veteran invite up to five family members or caregivers to a video visit. The care team emails each guest a unique link, and a provider can invite someone after the visit has started.

Medicare.gov and 1-800-MEDICARE

A hospital portal won't tell you why a claim was denied. Medicare keeps its own permissions, and a doctor's proxy form doesn't reach it.

• On the phone. Medicare's fact sheet says 1-800-MEDICARE can share your parent's information with you if your parent gives verbal permission while you're both on the call, or if they've added you as an authorized representative.
• In writing. That's the release form CMS-10106. CMS says your parent must give 1-800-MEDICARE permission in writing before it shares information with anyone else. Done online through their Medicare.gov account, you can call on their behalf right away; by mail, the fact sheet says it generally takes a few weeks.
• Their Medicare.gov account. With your parent's permission, log in to their account, choose "Edit my account settings," then under "My representatives" select "Manage My Representatives" and add yourself.

Medicare Advantage and Part D plans are private companies with their own forms, so call the plan too. Our guide to becoming an authorized representative walks through CMS-10106 and the other agencies' versions.

What quietly breaks proxy access

• A new health system. A new specialist elsewhere means a new request.
• An expiration date. Some proxy authorizations last until revoked. Cedars-Sinai's diminished-capacity form expires five years after the physician signs it.
• A change in who decides. Cedars-Sinai asks the proxy to tell the health system if they stop being responsible for the patient's health care decisions.
• Revocation isn't retroactive. Froedtert's form says revoking doesn't undo what a proxy already viewed.
• A death. Froedtert's form says the patient's and proxy's access are deactivated when the health system learns of the death. If you'll want the last medication list or visit summary, save it while you can.

What to keep in the binder

Most of this lives in phones and inboxes until the day the phone dies. Put it on one page.

• Each health system your parent uses, with its portal web address and support phone number
• Your parent's medical record number at each (it's on bills and visit summaries)
• Who has proxy access at each system, at what level, and since when
• Any expiration date on a proxy form or HIPAA authorization
• A copy of the health care power of attorney or guardianship order you'd send if your parent loses capacity
• Your parent's Medicare number, and whether CMS-10106 is on file and for whom
• Which offices expect a family member to join by phone or video
• For a veteran: their VA facility and its scheduling number

Never write passwords on this page. Nobody should need your parent's password, and a binder travels to hospitals and sits on kitchen counters. Our guide on where to keep important documents covers the copies.

Frequently asked questions

Can I access my elderly parent's patient portal?

Yes, if your parent grants you proxy access through each health system, by form or by an invitation inside the portal. You get your own login. If your parent can no longer decide, a health care agent or guardian can usually request it.

Can my parent's doctor talk to me on the phone?

Usually, if your parent agrees or doesn't object. HHS says a provider who may share information with family can do it by phone. It goes smoother when your parent tells the office directly.

Can I just use my parent's portal password?

Some health systems forbid it outright, and Froedtert's form says it can shut off access for actions it considers unauthorized. Your own proxy login avoids that.

Can more than one sibling have proxy access?

Often. Many health systems let a patient name more than one proxy, so ask. Then decide as a family who sends messages, so the care team isn't answering the same question three times.

If you'd like it organized for you

You can set this up yourself with the steps above and an hour together at the kitchen table. Or Emergency Binder Now can do the organizing: about 25 minutes of guided questions becomes a printable binder for your parent, with pages for their doctors and health systems, a record of which legal documents exist and where they're kept, and a list of what's still missing. You can see a sample binder first.

This article is general information, not legal or medical advice. Proxy access rules are set by each health system, and who can act for an adult who lacks capacity depends on state law. For your parent's situation, check with the health system's medical records office or an elder law attorney in their state.