Children, My Health Record and the messy question of consent

A child's health information has always been a three-body problem. The child lives in the body. The parent or carer makes most of the decisions, signs the forms, and remembers the immunisation dates. The clinician has duties to both, and those duties start to pull apart the first time a teenager says, "Can we talk without Mum in the room?"

My Health Record did not create that problem. It nationalised a slice of it. A shared record that a parent can open from myGov is convenient when a child is seven and has a new inhaler. It is a different object when the child is fifteen, the record might one day hold a sexual health visit, and an estranged parent still has a login from 2019.

This is a map of the mess, written for clinicians and for adults who are trying not to use a portal as a weapon. It is not family-law advice and not a ruling on any particular teenager's capacity. Official My Health Record guidance is the place to check current age settings before you press a button.

The age rules people half-remember

In the national system, a child's record is typically managed by a parent or legal guardian. The well-known public rule is that a young person can take control of their My Health Record from the age of 14. At 18, they hold it as an adult. Those numbers are administrative thresholds for a national database. They are not a complete theory of childhood.

In the consulting room, capacity is still assessed in the old way: can this person understand the decision in front of them? A 13-year-old with a long-term condition may be a better historian than a distracted adult. A 16-year-old in crisis may not be able to weigh a disclosure. Gillick-style maturity, however Australian clinicians phrase it, does not snap into existence on a birthday because a portal said so.

What the birthday does change is who can walk in through the consumer front door. If a parent remains the nominated controller after a young person has taken over, or if an old myGov link still works, you have a confidentiality leak dressed as family organisation. If a young person takes control and then cannot manage myGov, you have a practical problem dressed as autonomy.

Clinicians should ask, as a habit, who can see the digital copy. Not because every parent is a threat. Because who can see a My Health Record is now part of history-taking for adolescents, in the same way "who lives at home" always was.

What a child's record actually holds

It holds the same kinds of things an adult record holds, when someone uploads them: immunisations from the Australian Immunisation Register, medicines, discharge summaries, the occasional pathology report, a shared health summary if a GP created one. It does not hold the school counsellor's notebook, the paediatrician's full letter unless uploaded, or the argument the parents had in the corridor.

That incompleteness is worth explaining to families who think "it's all in My Health Record". It is also worth explaining to teenagers who think hiding the national record will hide the clinic file. The practice software remains. The hospital remains. My Health Record explained is the longer inventory. The short version: locking one cupboard does not empty the house.

Immunisation history is the piece parents have the strongest ordinary claim to manage. Schools and childcare services still ask for it. The Australian Immunisation Register is the backbone. Using My Health Record as a convenience copy is fine. Using it as the only place an anxious parent looks, while the child is due a catch-up, is how people get surprised.

Medicines lists become sensitive earlier than adults expect. A tablet for acne, a contraceptive, an antidepressant, a medicine for gender-related care — the clinical facts may be ordinary and the household politics may not be. A parent who opens a dispense record "to help with the chemist" can learn something the young person was not ready to share. That is not a reason to abandon shared records. It is a reason to talk about timing and control.

Separated families, passwords and the long afterlife of access

Family separation is where digital health stops being a brochure. Two adults may both have parental responsibility. One may have a recovery order. One may be using information to harass the other. One may simply be the parent who still does the GP trips and therefore "owns" the myGov account in the sloppy way families own everything.

A shared password is not a custody arrangement. It is a security incident waiting for a narrative. If both parents should be nominated representatives, make that formal and review it. If one parent should not have access — because a court said so, because there is violence, because the young person is now in charge — revoke the access and change the myGov credentials. Do not rely on politeness.

Practices get dragged into this. A parent phones and asks for "everything on the file". Another parent phones and says the first parent must not be told about an appointment. Reception staff are not family-court registrars. They need a written practice rule: verify identity, check who has parental responsibility as far as the clinic can know it, escalate safety concerns, and do not settle a dispute by emailing a PDF to whoever sounds more organised.

If there is family violence, treat digital access as a safety question. Location data in appointment SMS, a portal that shows a new treating psychologist, a nominated representative who should have been removed — these are not IT niggles. They are how people get found. Official support services and the My Health Record team's own safety processes exist because this pattern is known.

Do not use the child's record as a communications channel between adults who will not speak. A consumer note that says "Dad is not to be informed" may be important. A consumer note that litigates last weekend is a gift to nobody and a discoverable document to everybody.

Adolescent confidentiality is the real subject

The ethical centre of this topic is not a 14th birthday. It is the moment a young person needs care they will not seek if a parent will read the note tonight.

Sexual health, pregnancy, contraception, drug use, mental health, gender, and experiences of abuse are the usual chapters. Australian clinicians already know how to see a young person alone, how to explain confidentiality and its limits (risk of serious harm, some mandatory reporting), and how to document in the local file with a bit of care. The national record and the parent login can undo that work in one tap.

A practical clinic habit: if you are providing confidential care to a mature minor, ask who can open My Health Record and the pathology app. If a parent can, discuss whether this visit should generate uploads at all. A result that lands in a consumer portal at 7pm is a disclosure. So is a Medicare item a parent sees on a statement, which is an older problem the apps have not invented.

You cannot promise a young person that "nothing will appear anywhere". You can be honest about the local file, the invoice, the national record, and the school. Honesty is how they decide whether to tell you the actual history.

Parents deserve honesty too, just not the confidential content. "I saw Alex alone, as I do with teenagers, and I will tell you if I am worried about serious harm" is a sentence that keeps families in the room. "I cannot mention today's visit" may be necessary and will sometimes cause a fight. The fight is still better than a young person who never comes back.

A parent login is not the same thing as a right to sit in on every future consultation, and a national record is a poor place to postpone a conversation about confidentiality.

School apps are a second health system

While everyone argues about My Health Record, children accumulate another medical file in tools that look like school administration. Permission apps. Sick-bay logs. Wellbeing platforms. Sports medical forms. A survey about mood that a year coordinator can see. A note that a child took a paracetamol at 11:20.

These systems are not the national record. Restricting My Health Record does not touch them. Consent is often a checkbox in a start-of-year pack, signed by whichever adult does the stationery. The child may not know the app exists. The other parent may not either.

Clinicians hear the consequences. A child is collected from sick bay and a notification goes to both parents, including the one who should not know the address that day. A counsellor's appointment is labelled in a way that makes a peer group curious. A chronic-condition action plan is uploaded at full identifying detail to a platform with generous staff access.

Parents can do a few unfancy things: read the permission, ask who can see sick-bay notes, turn off dual notifications if safety requires it, and stop putting diagnoses in free-text fields that were meant for "left-handed, wears glasses". Schools can remember that health information is still health information when the vendor's logo is a cartoon mascot.

If you work in Aboriginal and Torres Strait Islander digital health contexts, or in any community where families are large, mobile, and already over-surveilled, the same caution applies with more weight. Extra copies of a child's story are not a neutral good. They travel.

When a young person should take control

Earlier handover, or a reason to wait

Take control is a term of art in the My Health Record consumer settings. It is also an ordinary developmental event. The question is when the convenience of a parent manager is costing the young person safety or honesty.

Consider an earlier handover when:

• The young person is already attending appointments alone.
• There is a confidential issue in play or likely to be.
• Parents are in conflict about access.
• The young person asks, in a way that sounds like a request for privacy rather than a request for a new gadget.
• A parent is using the record to monitor rather than to help.

Consider delay when:

• The young person cannot manage myGov and has no safe adult helper to appoint.
• There is no confidential issue and the parent is the person who actually gets them to the chemist.
• Cognitive disability means an adult representative remains appropriate — which may be true well after 18, and should be set up properly, not by sharing a password forever.

A handover is a conversation, not a punishment. Show them the record. Show them the access list. Show them how to hide a document and how that does not hide the GP file. Offer to be the clinic that will see them without a parent in the room. Write down the official support number for when myGov locks them out, because it will.

Clinicians can put a reminder in the local file at 13 or 14: discuss digital access at the next long appointment. That is more useful than a poster about "empowerment". Empowerment that the parent still logs into is a slogan.

A short list for adults who want to do less harm

• Use nominated representatives, not shared passwords.
• Review access after separation, reconciliation, a new partner, or a change of carer.
• Ask teenagers who can see the portals, including pathology apps.
• Keep school tools in mind; they are a health system with worse governance.
• Do not upload a sensitive adolescent visit to the national record by default.
• Do not refuse all sharing either. Immunisations and medicines still save people in emergency departments.
• If safety is in question, treat logins as part of the safety plan.
• If you are the young person, taking control is allowed to be boring: new password, multi-factor authentication, a look at who is listed, then get on with your life.

The messy question of consent is messy because two true things sit together. Children need adults to organise care. Young people need a zone in which they can speak. Digital records are bad at zones unless someone configures them on purpose. Configure them on purpose. Then go back to the work that never fitted in a portal: talking, in a room, about what happens next.