Quick answer
Approve external portal access from the person’s actual authority and its scope. Emergency-contact status, payment involvement and a legal personal representative are different facts. Record the determination, translate it into tested visibility, and reassess access when authority, resident direction or status changes.
Translate authority into a bounded account
A family portal can expose far more than a phone conversation: medication history, messages, bills, downloaded records and the ability to submit requests. A contact designation copied from admissions should not silently grant every capability.
HHS guidance on personal representatives explains that authority comes from applicable law and that information rights track the scope of representation. The guidance separately recognizes disclosures to family or others involved in care or payment. For certified facilities, 42 CFR 483.10(b) also protects resident decision rights and limits representatives to delegated or legally established authority.
The software buyer needs an authority-to-permission record. Include the resident and proxy identities, legal or resident-direction basis, evidence location, reviewer, scope, activation conditions, effective period, prohibited actions and reassessment triggers. Store sensitive supporting documents in appropriate restricted locations. A portal administrator should be able to implement the reviewed decision without independently interpreting a court order.
Test four conditional cases
These fictional cases assume a qualified reviewer has made the stated authority determination. They are configuration tests, not findings about any state's law.
| Reviewed facts | Expected configuration | Failure to look for |
|---|---|---|
| Resident validly authorizes a daughter to view specified appointment information | Separate daughter identity; only approved information and actions | Full chart access inherited from “family” role |
| A representative has authority limited to a particular health decision | Information relevant to that authority and approved actions | Unrelated billing, historical records or broad export exposed |
| Two relatives disagree and the authority evidence is unresolved | Preserve the resident's own rights; route disputed proxy changes for review | First caller gains access or existing access is erased without assessment |
| An executor is verified after the resident's death with applicable authority | Scope access to PHI relevant to the representation under the reviewed determination | Automatic carryover of every pre-death proxy or automatic deletion of all access |
HHS also describes circumstances involving abuse, neglect or endangerment in which an entity may decline to treat a person as a representative, subject to the rule's conditions and professional judgment. Build a restricted escalation path for that determination. Do not let a broad “safety exception” become an unreviewed administrative override.
Inspect every surface the proxy can reach
Test the account as the proxy, not through an administrator preview. Check home-screen tiles, search, attachments, message notifications, exports, appointment changes and links delivered by email. A hidden menu does not protect data if a previously saved URL or mobile session still opens it.
Separate viewing from acting. Permission to see a bill does not necessarily authorize consent to treatment, an amendment request or a disclosure authorization. Make the action's capacity visible to staff receiving it. Messages should identify both the proxy author and the resident concerned; copied text should not appear to be the resident's own statement.
In a synthetic revocation exercise, the resident withdraws a voluntary delegation that is revocable under the reviewed facts. End new access, invalidate active sessions as supported, stop future notifications and test a saved link. Acknowledge that information already downloaded cannot be recalled simply by disabling the account. Record the change and any follow-up required for information previously disclosed.
Procure for changes, not just invitations
Ask how the system handles a new capacity determination, replacement representative, expired instrument, changed court limitation, resident objection and death. Some changes require immediate access adjustment; others require a legal determination first. Record the review route rather than inventing a universal expiration period for all representatives.
The final acceptance packet should contain the authority determination, implemented permissions, observed proxy views and actions, and a completed change test. If the portal cannot limit a relevant information category, the decision may be to provide an appropriately scoped alternative channel while the gap is resolved. That preserves a usable resident service without granting broader rights merely because the software's family role is coarse.
Questions & answers
Does being an emergency contact confer full chart access?
No. It does not itself establish personal-representative authority. Disclosure to people involved in care or payment and authority to exercise the resident’s rights require separate analysis.
Can a proxy keep using the resident’s own login?
A separate identified proxy account is a useful design requirement because it preserves who acted and permits scoped revocation. The authority decision still comes from applicable law and resident rights.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.