In a custody dispute, HIPAA treats both parents as their child’s personal representative, which means each parent generally has the same right to see the child’s medical records that the child would have. A court order, a credible concern about abuse, court-directed care, or a treatment the minor lawfully consented to on their own can narrow that access. Your co-parent’s own medical records are a different matter: those require the co-parent’s authorization or a court order. This is how HIPAA and child custody medical records fit together in practice.
Both Parents Are Personal Representatives of the Child
Under the HIPAA Privacy Rule, a parent with authority under state law to make healthcare decisions for a minor is that child’s personal representative. The provider must treat that parent as if they were the patient for access, copies, and other HIPAA rights.1U.S. Department of Health & Human Services (HHS). Personal Representatives That covers diagnoses, treatment plans, lab results, prescriptions, and billing.
Primary physical custody, on its own, does not strip the other parent’s access. Where a custody decree exists, the personal representative is whoever the decree authorizes to make healthcare decisions, and in most joint-custody arrangements that means both parents.2HHS.gov. Personal Representatives Unless a court has terminated a parent’s rights or removed their healthcare decision-making authority, both parents retain the right.
To get records, submit a written request to the provider and show proof of your parental relationship, such as a birth certificate or a custody order. The provider will usually have its own request form. Once your relationship is verified, the provider must produce the records.3Department of Health & Human Services Office for Civil Rights. The HIPAA Privacy Rule and Parental Access to Minor Children’s Medical Records
When a Provider Can Refuse to Treat You as the Personal Representative
The exceptions are narrow. They exist to protect the child, not to let providers pick sides in a custody fight.
A provider can deny access if they reasonably believe the child has been or may be subjected to domestic violence, abuse, or neglect by the requesting parent, and, in their professional judgment, granting access would not be in the child’s best interest. Both conditions have to be met.4eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information
A judge in a custody case can also issue an order that limits or removes one parent’s right to see the child’s medical records. When that order exists, the provider must follow it. Separately, when a child receives care at the direction of a court or a court-appointed individual, the parent is not the personal representative for records tied to that specific treatment.3Department of Health & Human Services Office for Civil Rights. The HIPAA Privacy Rule and Parental Access to Minor Children’s Medical Records
Care the Minor Consented to on Their Own
A parent loses personal-representative status for a specific treatment when the minor lawfully consented to it themselves. HIPAA identifies three situations: the minor consents and no other consent is required by law; the minor may lawfully obtain the care without parental consent; or the parent has agreed to a confidentiality arrangement between the provider and the child.4eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information
Which treatments a minor can consent to depends on state law and varies a lot. Most states allow minors to consent to substance use treatment, often starting around age 12. Mental health treatment consent typically starts later, around 14 or 15, depending on whether it is outpatient or inpatient. Many states also let minors consent to reproductive healthcare without parental involvement. Where the minor lawfully consents, the minor controls access to records tied to that treatment. Everything else in the child’s file remains available to the parent.
Psychotherapy Notes Are Not Part of the Access Right
Being a personal representative does not entitle you to everything a therapist writes down. HIPAA draws a sharp line between general mental health information and psychotherapy notes.
General mental health information — diagnoses, treatment plans, symptoms, medications, progress summaries — sits in the regular medical record. A parent acting as personal representative can access all of it.5HHS.gov. Does a Parent Have a Right to Receive a Copy of Psychotherapy Notes About a Child’s Mental Health Treatment
Psychotherapy notes are the therapist’s private notes documenting or analyzing the content of counseling sessions, kept separate from the rest of the medical record. They do not include session times, medication monitoring, or treatment summaries.6U.S. Department of Health & Human Services (HHS). Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information HIPAA excludes them from the right of access; neither the patient nor a personal representative can demand them.7eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
A therapist may share psychotherapy notes voluntarily, but HIPAA does not require it. If you need those notes for a custody case and the therapist refuses, the reliable path is a court order. State law may add further restrictions.
Substance Use Disorder Records Have Extra Protection
If your child was treated for a substance use disorder at a federally assisted program, those records get an added layer of protection under 42 CFR Part 2. The rule restricts use and disclosure of any records that would identify someone as having, or having had, a substance use disorder.8eCFR. Part 2 – Confidentiality of Substance Use Disorder Patient Records
These records cannot be used or disclosed in any civil proceeding, including a custody case, without either the patient’s written consent or a specific court order. A regular subpoena is not enough, and the restriction applies to a requesting parent the same as anyone else.8eCFR. Part 2 – Confidentiality of Substance Use Disorder Patient Records
Getting a court order under Part 2 clears a higher bar than a standard medical records order. The applicant must use a fictitious name to protect the patient’s identity, give the patient notice and a chance to respond, and show good cause. The judge must find that no other way to get the information is available or effective and that the public interest outweighs the potential harm to the patient and the treatment relationship.9eCFR. Subpart E – Court Orders Authorizing Use and Disclosure Even when the order issues, disclosure is limited to what is essential, and any hearing is conducted privately.
Getting the Other Parent’s Medical Records
A custody case does not give you a right to see your co-parent’s private medical records. HIPAA protects adult health information, and a co-parent has no special exception.10HHS.gov. HIPAA and Marriage – Understanding Spouse, Family Member, Marriage, and Personal Representatives in the Privacy Rule There are, however, legitimate paths when a parent’s health is directly relevant to custody.
Signed Authorization
The simplest route is a HIPAA-compliant authorization signed by the parent whose records are sought. A valid authorization describes the information to be disclosed, names the person releasing it, identifies the recipient, states the purpose, and includes an expiration date or event.11HHS.gov. Disclosures for Emergency Preparedness – A Decision Tool: Authorization
Subpoena or Motion to Compel
When a parent refuses to sign, which is common in contested cases, your attorney can use the discovery process. That usually means a subpoena for the records or a motion asking the court to compel their release. Judges tend to allow this where a parent’s physical or mental health is directly at issue, such as allegations of substance abuse or untreated mental illness that affects parenting. The court will often limit the scope to what is relevant.
Qualified Protective Orders
When medical records enter a custody case through litigation, a qualified protective order limits misuse. It prohibits using the disclosed information for anything other than the litigation and requires the records to be returned or destroyed when the case ends.12HHS.gov. May a Covered Entity Not Party to Legal Proceedings Disclose Protected Health Information in Response to a Subpoena, Discovery Request, or Other Lawful Process If you subpoena records from a provider that isn’t a party to the case, either the parties agree to a qualified protective order or you ask the court for one. Without that safeguard, the provider may refuse to comply.
Making the Request and What to Expect
For your child’s records, put the request in writing, use the provider’s form if they have one, and bring documentation of your parental relationship, such as a birth certificate or custody order. Narrowing your request to specific portions can speed things up.
You have the right to receive the records in the format you prefer. If the provider maintains records electronically and you ask for an electronic copy, they must provide it that way if they can readily do so; if not, you and the provider agree on an alternative electronic format. Paper copies come only if you decline all available electronic options.13HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
The provider has 30 days from receiving your request to produce the records or issue a written denial explaining why. If they cannot meet that deadline, they can extend it once by another 30 days, but they must notify you in writing with the reason and a new response date.7eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information If you are working against a court deadline, submit early and follow up in writing after two weeks if you haven’t heard back.
Providers can charge a reasonable, cost-based fee for copies. For electronic copies of electronically maintained records, a provider may charge a flat fee of no more than $6.50 instead of calculating actual costs. That figure is a simplified billing option, not a cap on all record requests; providers using actual-cost calculations may charge more or less.14HHS.gov. $6.50 Flat Rate Option Is Not a Cap on Fees Paper copies, records scanned from paper originals, and attorney-directed requests often cost more, and fees vary by state.
If a Provider Wrongfully Denies Access
If a provider refuses to release your child’s records and you believe the denial violates HIPAA, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). File within 180 days of the denial, though OCR can extend for good cause.15HHS.gov. How to File a Health Information Privacy or Security Complaint
The fastest method is the OCR online complaint portal at ocrportal.hhs.gov. You can also submit by email to OCRComplaint@hhs.gov or by mail. Identify the provider, describe what happened, and explain why you believe your rights were violated.16HHS.gov. Filing a Health Information Privacy Complaint The provider cannot retaliate against you for filing.
An OCR complaint is useful for accountability, but investigations take months. If you need the records for an upcoming custody hearing, filing a motion in family court to compel production is the more practical move, and the HIPAA complaint can proceed on its own timeline alongside your case.