Guardian and proxy access setup

How do we set up portal or record access for a parent, guardian or caregiver with the relationship documents and the patient's authorization collected and verified before access is granted?

Make proxy access a verified case with the rules for the patient's age and situation. When a parent, guardian or caregiver asks for access, Callvu classifies the request (a parent of a minor, a legal guardian of an adult, an adult patient's chosen proxy, a healthcare agent under a power of attorney) and the rules that apply (the state's minor consent laws that limit a parent's access to certain services, the court order a guardian must hold, the patient's own authorization for a chosen proxy), requests the documents through a link (the identity, the birth certificate or court order, the patient's signed authorization, the power of attorney), reads and checks each, routes the decision to health information management in the Decision Desk, and writes the proxy relationship with its scope and expiry to the EHR so the portal and the release processes enforce it.

In scopeComplex: multi-party handoffsCallvu moves: chase and verify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The father was given full portal access to his sixteen-year-old's chart, including the visits state law says the teenager controls.

Today, without Callvu

A parent calls the portal help desk and asks for access to a child's record; the agent grants it with the parent's name on the account. A son asks for his elderly mother's portal; the agent takes his word for the guardianship. A spouse asks for a patient's test results; nobody checks the authorization. Each is a disclosure the privacy office cannot defend, and the minor's confidential visits are the hardest case.

Proxy access is governed by the HIPAA personal representative rules, which look to state law for who may act for a minor or an incapacitated adult, by the state's minor consent laws that give adolescents control over certain services and their records, by the court orders and powers of attorney that create guardians and agents, and by the patient's own right to authorize a proxy. The scope of access follows from the classification, and the portal must enforce it.

Access that is classified, documented and scoped is access the privacy office can audit.

How it runs

From the requestto the system of record.

A parent, guardian, caregiver or healthcare agent requests access to a patient's portal or record in any channel. Callvu classifies the request and opens the case.

Requester: Provides identity and the relationship documents through a link.
Patient: Signs the authorization on their own phone where they are an adult or an adolescent with rights over the services.
Health information management: Decides the access and its scope in the Decision Desk.
Callvu: Classifies, lists and chases the documents, checks, routes and writes the proxy to the EHR.

Classify the request
The patient's age and status (a minor, an adolescent with confidential services under the state's minor consent laws, an adult, an adult under guardianship or with a healthcare agent) and the requester's asserted role (parent, legal guardian, custodial parent under a custody order, healthcare agent, caregiver chosen by the patient) classify the documents required and the scope of access the rules allow (full, limited to exclude the confidential services, or as the patient defines).
Chase and verify
The documents are requested through a link with the specifics: the requester's identity, the birth certificate or the custody order for a parent, the letters of guardianship for a guardian, the power of attorney with the healthcare agency for an agent, and the patient's signed authorization for a chosen proxy or for an adult patient's parent; each is read and checked (the names, the court, the dates, the scope of the order, the signature), and the patient's authorization is captured on their own phone where the rules require it.
Decide
Health information management decides in the Decision Desk with the classification and the documents and only the allowed outcomes: grant with the scope the rules allow and an expiry (a minor's proxy ends at the state's age of majority or when confidential services begin), grant limited, or deny with the reason; a custody dispute, a conflicting order or a patient who objects goes to the privacy officer.
Write back
The proxy relationship with its type, scope, documents and expiry is written to the EHR so the portal, the release of information and the patient access processes enforce it, the requester receives the access and the patient is told, and the expiry is tracked so the access ends or is reviewed on the date.

Where it ends: Access was granted only to a classified, documented proxy with the scope the law allows and an expiry, and the EHR enforces it in every channel. The Decision Trace shows the classification, the document checks and the decision; the Audit Trace shows the documents, the authorization and the write with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

HIPAA personal representatives and verification (45 CFR 164.502(g) and 164.514(h)): A person with authority under state law to act for an individual in healthcare decisions is treated as the individual for the privacy rule, including a parent of an unemancipated minor except where state law gives the minor the right to consent to a service, in which case the parent's access to that information follows state law; the covered entity must verify the identity and authority of the personal representative before granting access, and may refuse a representative where abuse or endangerment is suspected.
State minor consent and confidentiality laws: Each state allows minors to consent to certain services (reproductive health, sexually transmitted infection treatment, mental health, substance use) and protects those records from parental access; the scope of a parent's proxy access must exclude them, and the 21st Century Cures Act information blocking rules require providers to segment such data rather than block the whole record.
State guardianship and healthcare power of attorney laws: A guardian acts under letters issued by a court with a defined scope and term, and a healthcare agent under a validly executed power of attorney that becomes effective as the document provides; the checks read the court, the dates and the scope of the instrument.

Company policies

No proxy access without the documents the classification requires, read and checked.
A minor's proxy is scoped to exclude the services state law gives the minor, and expires at the age or event the law sets.
An adult patient's proxy requires the patient's own authorization, captured on their phone.
The EHR holds the proxy relationship, its scope and its expiry, and every channel enforces it.

Controls

Request classification by patient status and proxy role.
Document list with reading and checks.
Patient authorization capture.
Decision Desk decision with scope and expiry.
EHR write enforced by the portal and release processes.
Expiry tracking.

Clocks and deadlines

Expiry: A minor's proxy ends at the state's age of majority or the event the law sets; a guardianship at the order's term; a chosen proxy at the patient's chosen date.
Request handling: The organization's service level, with the requester seeing status.

Documents and checks

The classification
The identity and relationship documents as checked
The patient's authorization
The decision with scope
The EHR proxy record

In the Decision Trace

The classification and the rules applied.
Each document's check.
The decision, the scope and the person.

In the Audit Trace

The request with channel and time.
Each document and the authorization with time.
The write and the expiry.

The handoff

Between the front doorand the back office.

The front door

Any channel; the requester uploads through a link and the patient authorizes on their own phone.

The back office

Health information management decides from checked documents; the portal and the release processes enforce the scope from the EHR.

The Decision Desk

Every request goes to health information management in the Decision Desk with the classification and the documents, and only grant with scope and expiry, grant limited, or deny with the reason; a custody dispute, a conflicting order or a patient's objection goes to the privacy officer.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

23 hospitals in the Ministry of Health network run on Callvu.

Across Callvu customers

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Questions

What buyers ask next,answered plainly.

What does a parent have to provide?

Identity and the birth certificate or the custody order; for an adolescent the access is scoped to exclude the services state law lets the minor control, and it expires at the age of majority.

Can an adult choose a proxy?

Yes. The patient signs the authorization on their own phone defining the scope, and the proxy provides identity; the EHR enforces the scope.

What about a guardian or a healthcare agent?

The letters of guardianship or the power of attorney are read for the court, the dates and the scope, and access matches the instrument.

Related processes

Patient right of access requests Release of information requests HIPAA authorizations Demographic and insurance updates Try it in the sandbox All healthcare processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.