Published
- Patients using portals or telehealth
- Family caregivers
- Older adults
- Parents
Prepared · sources accessed (UTC) · physician review still to be recorded
A patient portal, video visit, health app, and general AI chatbot can look like parts of one system. They may have different operators, privacy rules, permissions, and clinical responsibilities. A workable household plan identifies what each tool does, who may use it, what information it receives, and how to reach care if the technology fails.
This guide builds on sharing health records with apps, checking AI health answers, and the telehealth setup checklist. It does not ask readers to submit health records here.
1. Arrange help through the organization’s access process
If someone assists with appointments or messages, ask the healthcare organization about proxy or delegated access. Determine what the helper can see and do, whether their identity is recorded separately, and how access can be changed or revoked. Sharing the patient’s password can obscure who sent a message and can expose more information than intended.
Distinguish a helpful relative from a legally authorized personal representative. HHS explains that representative authority depends on applicable law and scope, with exceptions in situations involving abuse, neglect, or endangerment. Family involvement alone does not establish unlimited access. (HHS personal representatives)
Write down the purpose of assistance: scheduling, reviewing a visit summary, paying bills, or supporting communication. Ask about age-related changes for adolescents and young adults. The school-to-adult handover guide helps coordinate that transition across different institutions.
2. Check what happens after information leaves the portal
Before connecting an app, identify its operator, the data requested, the permissions, the stated uses, any sharing with other companies, and the deletion or account-closure process. Decide whether the requested information is necessary for the task. A sleep tracker may not need access to an entire clinical record.
The FTC’s joint mobile-health-app guidance explains that HIPAA does not apply to every consumer health app. Other laws, including FTC protections and potentially its Health Breach Notification Rule, may apply. “Outside HIPAA” does not mean unregulated, and “health app” does not establish hospital-level privacy protections. (FTC app guidance)
Record what you authorized and when. If you disconnect an app, ask whether that ends future access, deletes previously copied data, or both. Do not assume those are the same operation. Keep useful clinical information in the treating organization’s accepted channel so that a private app entry is not mistaken for a message the care team has received.
3. Turn an AI answer into questions that can be checked
Use an AI-generated explanation as material to examine: What exactly is the claim? Which original source supports it? Does that source address the same age, condition, medicine, jurisdiction, and date? Does the answer acknowledge information it does not have?
WHO’s guidance on large generative models identifies the risk of inaccurate, incomplete, or biased health statements. A fluent answer and a list of citations do not establish that the cited sources support the conclusion. (WHO guidance summary)
A useful conversion is: “The tool suggested this possibility. Does it fit my situation, and what information would change the next step?” Bring the actual question and source to the clinician when relevant. Do not delay urgent assessment, change a prescribed treatment, or upload identifiable records into a public chatbot merely to obtain a more confident answer.
The source-comparison workshop supplies a repeatable checking method. Institutional selection and oversight of clinical AI are separate questions addressed in the clinical AI change-review guide.
4. Prepare a low-bandwidth telehealth fallback
Confirm the appointment platform, login method, cost or coverage question, and technical-support contact before the visit. Test the camera, microphone, browser, and connection using the actual device. Agree on the number the clinician should call if the connection drops and the point at which the visit should be rescheduled or converted to another format.
HHS advises patients without suitable video or internet access to ask whether a telephone visit is appropriate. It also notes that a phone visit will not fit every health problem. Do not assume that a technical fallback is automatically clinically sufficient or covered on the same terms. (HHS telehealth equipment guidance)
Choose a place where you can speak privately. Public internet access does not guarantee a private conversation. If no workable location exists, tell the office early and ask about another arrangement. Keep the medication list and questions available offline in case the portal cannot load.
5. Make accessibility part of setup
Describe the needed support specifically: captions, a qualified interpreter, screen-reader compatibility, larger text, extra setup time, an accessible input method, or a support person. Ask how an interpreter or helper joins without replacing the patient’s ability to participate.
HHS’s patient preparation guidance recommends requesting needed support and testing technology in advance. Use a trial connection to test the actual communication arrangement, not only whether a camera turns on. (HHS visit preparation)
If an automated translation is used for a nonclinical convenience, identify it as such. Do not assume it is adequate for informed decisions or precise medication instructions. Ask the healthcare organization for appropriate language assistance. After the visit, request a usable summary and confirm who is responsible for orders, results, and follow-up.
6. Respond to a compromised account through a verified route
If you receive an unfamiliar login or password-change notice, go to the service’s known website or application rather than following an unexpected message link. Use its account-recovery instructions. For a health portal, contact the organization’s official support channel and ask it to review unauthorized access or changes.
FTC guidance recommends recovering the account through the provider, changing the password, signing out other sessions, enabling two-factor authentication, and checking recovery information. It also advises checking email forwarding rules because a compromised email account can undermine password resets elsewhere. (FTC recovery guide)
Preserve relevant notices and dates. If a clinical message, appointment, or refill request may have been altered, tell the care team through a verified channel. Account recovery and clinical correction are separate tasks. Do not disclose verification codes to someone who contacts you claiming to provide support.
Fictional worked example: the helper’s account and the patient’s message
Mr. Torres asks his daughter to help with appointments. Instead of sharing his login, they ask the clinic about delegated access and select the available role that fits the task. Later, a consumer app asks to import his entire record for a simple symptom diary. They postpone the connection until they understand what data would leave the portal.
Before a video visit, they discover that the captioning arrangement does not work on his device. The office helps identify an appropriate alternative and confirms a fallback contact. Their preparation improves access, but it does not establish that every app permission or communication method is suitable. Those unresolved questions remain with the organization and the patient’s preferences.
Printable digital-health access record
Keep this sheet private; do not write passwords or verification codes on it.
| Tool/account | Operator and purpose | Authorized helper/permissions | Data shared | Support/recovery route |
|---|---|---|---|---|
| Patient portal | ____ | ____ | ____ | ____ |
| Video platform | ____ | ____ | ____ | ____ |
| Consumer health app | ____ | ____ | ____ | ____ |
| Email used for recovery | ____ | ____ | ____ | ____ |
- [ ] I know which messages actually reach the clinical team.
- [ ] Helpers have appropriate separate access where available.
- [ ] App permissions and retention were checked before connection.
- [ ] Telehealth accessibility and fallback were tested.
- [ ] AI claims needing verification are recorded as questions.
- [ ] Recovery contacts and two-factor options are current.
Questions readers ask
Does an app connected to my medical record automatically follow HIPAA? No. Its operator and relationship to a covered entity matter. Read its practices and ask who is responsible for the copied information.
Can AI replace a clinician’s assessment if it cites studies? Citations need checking, and a model may lack important clinical information. Use the output to prepare questions, not to assume an individualized assessment occurred.
What if video will not work? Contact the office and ask what alternative is clinically appropriate and available. Agree on the fallback before the appointment when possible.
Sources and scope
Primary sources: HHS representatives, FTC apps, HHS telehealth, FTC recovery, and WHO. Prepared November 5, 2026 Pacific; accessed November 6 UTC. This is access and evidence-literacy guidance, not a security certification, legal assessment of an app, or clinical decision service.