A Link Without A Login
EXPERIENCE GRAND ROUNDS | How a privacy protection designed to help teenagers became a wall
THE ISSUE
JFC, all I need is a link without a portal login.
My teenage son needed his ADHD meds refilled and the doctor requested a parent conference with me before adjusting his dosage. Fine. No big deal. The doctor scheduled the visit and I got a text message and email confirmation that I barely looked at. It was no different than the weekly reminders I get sent for his regular visits. The day of the visit I got a text message with a link to start the virtual visit, and when I clicked it I fell into the special ring of hell reserved for lost passwords, usernames, and gym locker combos.
The link I clicked to join the visit had me log into MY patient portal (all patient portals are helpfully labeled “My-” for some reason) and when I got to my appointments page, there was nothing there. NO visit. No link. Nothing.
Looking back at the text message I realized it read that my son had this upcoming visit - it had been booked in his name because, duh, he’s the patient. But as the mom of a now 15 year old, I no longer have access to his patient portal and its “sensitive” content, including behavioral health info like… hard to schedule visits with his psychiatrist.
Well shit.
HISTORY OF PRESENT ILLNESS
In New York state, young adults between the ages of 13-17 have the right to confidential health information, especially for areas considered sensitive medical information about mental health, sexual health and substance use. This helps to build trust between teens and the health care provider so that they don’t avoid medical care from fear of repercussions from their parents.
The rule is more about denying access to certain medical records, but when medical records are all accessed via a portal, the answer is to shut parents out from their kid’s portal all together, not just to hide the sensitive information.
At age 13, a patient can create their own MyChart account. The parent's access doesn't automatically transfer — the teenager has to grant proxy access. This is not just for bureaucratic inconvenience. It's a protection to put the agency of disclosure into the hands of the teenager, in hopes that this privacy will incline them to actually tell their doctor the truth.
But the implementation drew a line around everything, not just the sensitive stuff. The blunt instrument of 'lock the whole record' was easier to build than the precise instrument of 'lock only the confidential parts.' And the booking system defaults to the patient's name regardless of who books or why — so a parent scheduling a non-confidential appointment loses access to that visit the moment it's created under the kid's account.
PHYSICAL EXAM
So many little choices added up to one pain in the ass moment. First, the reminder texts for this visit were indistinguishable from the ones I get for his weekly therapy sessions. The confirmation email had a join link, a FAQ link, and a help desk number. None of it flagged a potential access problem.
When I clicked to join I got the MyNorthwell login page. MY MyNorthwell Page. My saved passwords created an ever so helpful loop. Even when I logged out, the system brought me back to my- My Logged-in State. Designed for convenience, yes, but not a parent struggling to find a work around to avoid having my MyUnmedicated Teenager.
There was no 'are you a parent trying to join your teenager's visit?' off-ramp. No visible pathway. No sign that anyone behind the scenes was aware of the frustration I was going through.
Eventually found the proxy access instructions via AI-powered search on the website. My MyProxy Options were: appear in person with your teenager, or fill out a form and wait 3-5 business days. Neither was going to help me ten minutes away from a virtual visit.
Then I found this on the same FAQ page:
"If I book a virtual visit for a dependent, do they need their own Northwell Health account? No. Minors cannot create their own Northwell Health account."
Except they can. 13-17 year olds can create their own account with a separate email. Hence the source of My MyFrustration.
THE DIAGNOSIS
So many factors could have prevented this moment. It’s a classic case of Not My Problemitis
1. Communication failure.
The proxy access pathway existed but never surfaced proactively. A single message at time of booking — 'this visit is under your teenager's account, here's what you need to do before visit day' — could have prevented the entire situation.
2. Platform constraint.
The health system may not have had the ability to customize reminder communications at the patient age level even if they wanted to. What looks like a messaging failure might be an Epic configuration limitation requiring an enhancement request, a workflow workaround, or a supplemental communication layer outside the EHR.
3. UX failure at the point of friction.
The login wall had no exit ramp for the “I’m a parent of a teenager” use case. A 'join as guest' or 'I'm a parent trying to access this visit' pathway at the login screen would have caught the failure in real time. The system knew this was a teenager's appointment. It could have triggered a separate workflow. What prevented the team from adding that in? Budget? Competing priorities?
4. Booking system assumption.
Visits default to the patient's name regardless of who books the visit. A non-confidential appointment booked by a parent could reasonably live in the parent's account, or at least trigger a proxy access prompt at booking. Do parents have their own profile in an EHR if they’re not receiving care from that provider? At what point is a parent also a part of the kid’s care team and thus also needs their own meaningful (and book-able) EHR presence?
5. The blunt instrument problem.
The privacy law drew a line around confidential care. The implementation drew a line around everything. The nuance of 'some of this teenager's care is confidential and some isn't' never made it into the data model. Why not?
6. Content governance failure.
The platform evolved but the documentation didn't. The FAQ describing what the system can and cannot do is factually inaccurate. This is not a technology problem. It's a “who owns something boring but important" organizational problem. That gap is sitting there quietly sowing confusion amidst every parent who goes looking.
THE TREATMENT
Not My Problemitis is a persistent condition with occasional flare-ups, kind of like herpes. To provide some relief from this condition, add one line to the visit confirmation for all 13-17 appointments: 'If you're a parent or caregiver joining this visit, click here before visit day.' Link to the proxy access form and the troubleshooting page.
Then audit the FAQ. Find every page that was accurate eighteen months ago and is wrong today. Fix it. Assign someone to own it.
ATTENDING NOTES
Having your sweet kid suddenly become a hormonal teenager is hard enough for parents. Losing access to their medical records all of a sudden is just a secondary punch in the gut. Surprise! You’ve lost even more control over your kid than you thought you had! The mind often understands before the heart can comprehend.
But from a product and feature standpoint, this one’s relatively easy to correct. Some problems are much, much thornier to unravel. I’m going to be telling these stories not to tear down other people’s work, but to show how much power we truly have over the world we make for one another. We can’t always see the threads of our actions, especially inside a big organization. Standing on the outside now looking in, the extent of the tangle becomes all too apparent. Ask anyone who has tried to give care or receive it in our country’s healthcare system and they’ll tell you the same: it doesn't have to be like this. No one wants to be here.