Why ‘Just Give Me Your Login’ Puts Caregivers and Advocates at Risk

“I don’t have trouble getting records. My clients sign a HIPAA release and give me their username and password.”

I hear versions of this every week from professional advocates and consultants who step in to help patients when care gets complicated.

These approaches are understandable. They’re common.
And they are not as safe or as effective as many people believe.

This article isn’t about fear or finger-wagging. It’s about clarity: how to access health records ethically, defensibly, and in ways that actually hold up for the people you’re helping and for you.

If you only read one section, start here.

The Safest Ways to Access Health Records (Start Here)

When you’re helping someone navigate healthcare, how you access information matters just as much as what you access. Below are the primary pathways, in order from most defensible to most risky.

Best Practice #1: Patient-Directed Proxy Access (Recommended)

Many patient portals allow a patient to add a proxy or delegate.

This means:

• Your role is visible
• Access is revocable
• An audit trail exists
• Your authority is clear to providers

This is one of the cleanest and most defensible ways to help, and it’s increasingly expected.

Best Practice #2: HIPAA Right of Access (Most Powerful Tool)

The HIPAA Right of Access is a patient right, not a favor.

It means:

• Providers must provide access
• There are timelines
• There are format requirements
• There are limits on fees
• And there is real enforcement

This is often the most effective way to reliably obtain records, especially when providers are prioritizing other requests, unresponsive, or inconsistent.

Authorization is permission.
Right of Access is leverage.

Best Practice #3: HIPAA Authorization (Useful, but Limited)

HIPAA authorizations can help because they:

• Clarify who may receive information
• Legitimize your role with providers
• Support coordination conversations

But here’s the critical nuance:

A HIPAA authorization does not grant portal access.
It authorizes disclosure, not login.

Authorizations also:

• Don’t require timely responses
• Don’t guarantee format
• Are often routed into administrative limbo

They’re best used as a supplement, not a substitute.

Best Practice #4: Patient-Owned Consumer Health Apps (Where This Is Headed)

Under the 21st Century Cures Act, patients can now:

• Connect multiple portals
• Consolidate records
• Invite collaborators
• Revoke access at any time

Once data enters a consumer app:

• HIPAA no longer applies
• Federal Trade Commission (FTC) consumer protection law does
• Transparency and consent matter more, not less

This is the direction care coordination is heading: patient-controlled, shareable, and auditable.

Best Practice #5: Shared Credentials (Exception, Not the Rule)

Sharing usernames and passwords is common, but it should be treated as a temporary exception, not a default workflow.

If it’s unavoidable:

• Document explicit consent
• Define scope and duration
• Work toward proxy or patient-directed access
• Never normalize it

Now let’s talk about why this shortcut creates risk.

The Core Misunderstanding: HIPAA ≠ “All Health Data Everywhere”

Let’s start with the biggest misconception in care coordination.

HIPAA applies to covered entities and their business associates.
That includes hospitals, clinics, health systems, and the vendors they contract with to provide services they cannot always cover themselves.

If you are:

• a family caregiver
• a next of kin
• an independent patient advocate
• a consultant hired to coordinate care

…you are usually not a HIPAA-covered entity unless you have a formal Business Associate Agreement (BAA) with a provider.

That distinction matters more than most people realize.

What Happens When Data Leaves the Portal

When a patient exports their information out of a portal (MyChart, Athena, Cerner, etc.) into:

• email
• a spreadsheet
• a binder
• a consumer health app
• or your hands

That data is no longer governed by HIPAA.

Instead, it falls under consumer protection law, enforced by the Federal Trade Commission, especially around:

• unfair or deceptive practices
• misleading privacy promises
• data security failures
• breach notification responsibilities

This doesn’t mean the data is unprotected.
It means the rules changed, and transparency matters more than ever.

Common Myths That Create Risk

Myth #1: “If They Gave Me Their Login, I’m Covered”

Sharing portal logins feels convenient, but creates risk

Yes, portal login sharing is common.
No, that does not make it safe.

Here’s why:

1) You are impersonating the patient

When you log in as someone else:

• the system believes the patient is acting
• messages, downloads, and clicks are attributed to them
• your helper or advocate role is invisible

That becomes a problem when:

• records are disputed
• care decisions are questioned
• audit trails are reviewed
• disagreements arise

2) You may violate the portal Terms of Service

Most portals explicitly prohibit credential sharing. That can put the patient at risk of:

• account suspension
• loss of access
• locked records during emergencies

3) You inherit silent liability

If information is misunderstood, misused, or leaked:

• there’s no clear consent artifact
• no defined scope of access
• no auditable boundary of responsibility

That’s not a HIPAA problem.
That’s a professional and personal risk problem.

Myth #2: “I Only Help a Few People, So It’s Fine”

Risk isn’t proportional to caseload size.

One complex case involving:

• minors
• dementia
• behavioral health
• estranged families
• guardianship disputes
• contested records

…can expose more risk than twenty “simple” ones.

Professionalism isn’t about how many people you help. It’s about whether your access, authority, and decisions hold up when they’re questioned.

HIPAA Authorization vs. HIPAA Right of Access (The Difference That Matters)

This is where many well-meaning helpers get tripped up.

HIPAA Authorization

• Grants permission
• Allows disclosure
• Offers no timelines
• Has limited enforcement

HIPAA Right of Access

• Is a patient right
• Requires response
• Specifies format
• Limits fees
• Has enforcement teeth

Use Right of Access when your goal is to get the records.

Don’t let providers downgrade a Right of Access request into an authorization because it’s easier for them administratively.

A Simple HIPAA Right of Access Script (Bookmark This)

You can have the patient use this script:

“This is a request made under my HIPAA Right of Access.
I am requesting an electronic copy of my designated record set.
Please provide the records in electronic format.
Please send the records to [patient / designated recipient].
Thank you.”

If you’re helping someone else, they can add:

“I am working with [Insert name, title, company], who is assisting me with this request.”

No permission language. Clear, rights-based framing.

Why “Is This HIPAA-Compliant?” Is the Wrong Question

The better questions are:

• Who owns the data?
• Who controls access?
• How is consent documented?
• Can access be revoked?
• Is the activity visible and auditable?

Many consumer tools aren’t HIPAA-covered, yet can still be secure, ethical, and appropriate when used honestly.

Mislabeling tools or practices as “HIPAA-compliant” when they’re not creates more risk, not less. FTC  created an interactive tool to help apps navigate laws and rules that apply.

What Ethical, Professional Help Actually Looks Like

Whether you’re a caregiver, advocate, or coordinator, ethical support looks like:

• clear, client-directed consent
• defined scope of help
• transparent access methods
• documented authority (not vibes)
• auditability
• a clean offboarding process
• insurance appropriate to your role
• language that reflects reality

This isn’t bureaucracy.
It’s credibility and responsibility around some of the most sensitive information we have.

Final Thought: Access Without Structure Isn’t Help

If you want:

• healthcare teams to trust you
• families to rely on you
• regulators to leave you alone
• and your help to actually work

Then the goal isn’t access at all costs.
It’s access with structure, consent, and transparency.

That’s what modern care coordination looks like, whether you’re a professional advocate or the family member everyone turns to when things fall apart.

Helping someone navigate healthcare shouldn’t require you to break the rules or carry the risk alone.

Most advocates and caregivers are doing the best they can with the tools available, but that doesn’t mean you should absorb unnecessary legal or ethical risk. Primary Record was built by nurses and care coordinators who’ve lived this problem, to give advocates a safer way to access, organize, and share information with patients firmly in control.

If you want your workflows to be as strong as your intentions, we’d love to support you.

Explore Primary Record for advocates and families.