HIPAA for Minors: Parental Access, Exceptions, and Age 18

Under the HIPAA rules for minors’ medical records, a parent, legal guardian, or person acting in a parental role is usually treated as the child’s personal representative and can see the child’s records the same way an adult patient could see their own. The default flips in a few defined situations: when state law lets the minor consent to a service on their own, when a court directs the child’s care, when the parent agrees to a confidential relationship between the child and the provider, or when the provider reasonably believes access could expose the child to harm. Two record types — psychotherapy notes and federally protected substance use disorder records — sit under stricter rules that limit everyone’s access, parents included.

The Default: Parents Act as the Child’s Personal Representative

For routine care, HIPAA treats a parent as the minor’s personal representative. A personal representative stands in the shoes of the patient and can exercise every right the child would have: viewing the medical record, requesting corrections, and authorizing releases to third parties. Covered entities — hospitals, clinics, health plans — must treat that parent as though they were the patient for purposes of the Privacy Rule.¹²

That full access holds as long as the child is unemancipated and the parent’s consent was required for the treatment. Pediatric check-ups, ER visits, lab work, immunization records — all of it sits within the parent’s reach on the same terms the child would have as an adult.

When a Parent Loses Access

HIPAA doesn’t decide who can consent to treatment. It defers to state law on that question entirely.³ Once state law lets a minor consent to a service without parental involvement, HIPAA follows: the minor becomes the “individual” for privacy purposes for those records, and the parent is no longer the personal representative for that slice of care.⁴

What minors can consent to on their own varies from state to state, but common categories include:

Testing and treatment for sexually transmitted infections. Most states allow this at any age or above age 12.
Outpatient mental health counseling, typically starting somewhere between ages 12 and 16 depending on the state.
Evaluation and treatment for drug or alcohol use.
Contraception and pregnancy-related care, and in some states, abortion services.

A parent can be the personal representative for the same child’s well-visits and vaccinations while having no access rights at all to that child’s therapy records — the same federal law, same child, different answer for each type of care. Two other situations produce the same result: a court orders the child’s treatment or appoints someone else to make healthcare decisions, or the parent agrees, even informally, to a confidential relationship between the child and a provider. In either case the parent loses personal representative status for the records generated within that arrangement.¹

Even in these three scenarios, HIPAA doesn’t automatically block a parent. If state law expressly forbids parental access, the provider must deny it. If state law expressly requires or permits access despite the minor’s consent, the provider must or may grant it. When state law is silent — and many states are silent on specific scenarios — the provider exercises professional judgment.⁵ That is where most real disputes live, and it is why a provider in one practice may grant access while another denies it for the same type of care.

Emancipated Minors

An emancipated minor is treated as an adult for all healthcare purposes. Once a court grants emancipation, the minor controls all of their health information and the parent has no personal representative role. Anyone the emancipated minor designates through a power of attorney or similar authority becomes the representative instead.³

Psychotherapy Notes and Substance Use Records

Two categories carry protections that go beyond ordinary HIPAA rules, and both surprise parents who assumed personal representative status covered everything.

Psychotherapy notes are the personal notes a mental health professional writes during or after a private counseling session, kept separate from the rest of the record. They do not include diagnosis summaries, treatment plans, medication information, session times, or progress notes — those items live in the regular medical record. The Privacy Rule gives no one a right of access to psychotherapy notes, not the patient, not a parent, not any personal representative.⁶ A therapist may choose to share them but cannot be compelled to under HIPAA’s access provisions. The rest of the mental health record follows the ordinary parental access rules.

Substance use disorder treatment records get a separate layer of federal protection under 42 CFR Part 2, and it sits on top of HIPAA. When a minor has legal capacity under state law to seek substance use treatment alone, only the minor can authorize disclosure of those records, including disclosure to a parent seeking insurance reimbursement.⁷ Where state law requires parental consent for treatment, both the minor and the parent must sign any release of records; neither one alone is enough. A treatment program can only tell a parent that a minor even applied for treatment if the minor consents, or if the program director determines the minor cannot make a rational decision and faces a substantial threat to life or physical safety. Part 2 records also can’t be used against the patient in any civil, criminal, or administrative proceeding without written consent or a court order.

When Providers Can Deny Access to Protect the Child

Even a parent who otherwise qualifies as personal representative can be shut out. HIPAA lets a covered entity refuse to treat a parent as the personal representative when two conditions are both met: the provider reasonably believes the child has been or may be subjected to domestic violence, abuse, or neglect by that parent, or that access could otherwise endanger the child; and the provider decides, in professional judgment, that denying access is in the child’s best interest.²

Both prongs matter. A vague concern isn’t enough. And this is a discretionary power, not a mandate — a provider who suspects abuse may deny access but is not required to. Denying access and reporting suspected abuse are separate obligations that run alongside each other. The Privacy Rule expressly permits reports to public health or child protective authorities, and where state mandatory reporting laws apply, they prevail.⁸

Divorced and Non-Custodial Parents

HIPAA doesn’t distinguish between custodial and non-custodial parents. The test is whether the parent has authority under state law to make healthcare decisions for the child. In most states, both parents retain that authority after divorce unless a court order specifically removes it.⁴

So if a non-custodial parent asks a pediatrician for the child’s records and no court order strips them of healthcare decision-making authority, the provider generally must produce the records. The same three exceptions apply — the minor consented alone, a court directed the care, or the provider invokes the abuse/neglect safety valve — but “non-custodial” by itself is not a basis for denial. Providers caught in custody disputes should ask to see the custody agreement or court order; if the order limits one parent’s access to medical information, the provider has clear grounds to deny. Without one, refusing risks a HIPAA right-of-access complaint.

The Insurance EOB Problem

A minor who consents to care alone can still have that privacy undermined by insurance paperwork. When a claim is processed, the health plan usually sends an Explanation of Benefits to the policyholder — often a parent — showing the provider, the service type, and the date. That happens even for care the minor legally consented to without the parent.

HIPAA offers a partial fix. Under the confidential communications rule, any individual can ask a health plan to send communications to an alternative address or by an alternative method. A health plan must accommodate the request if the individual states that disclosure could endanger them.⁹ The plan can require the request in writing and can ask for an alternative mailing address, but a healthcare provider can’t demand an explanation for why the request was made.

For minors, the reality is narrower. A dependent’s request typically covers only services the minor can legally consent to alone; redirecting all health information usually requires a parent’s signature. The endangerment standard is a high bar, so a teenager who simply wants privacy without a safety concern may not meet it. Some states have layered on stronger EOB confidentiality protections than HIPAA requires, so the options depend partly on where you live.

When the Child Turns 18

On the child’s 18th birthday, or the state’s age of majority, the parent’s personal representative status ends automatically for all future care. The now-adult patient controls every HIPAA right — access, amendments, authorizations — and the provider must stop sharing information with the parent unless the patient signs a new authorization.

The shift reaches backward too. The former minor can exercise HIPAA rights over health information created during childhood, including records the parent had full access to at the time.³ A parent who wants continued access to an adult child’s records — a common issue for college students still on a family insurance plan — needs a signed HIPAA authorization from the child, or in some states a healthcare power of attorney. Providers sometimes miss this transition and continue sharing out of habit. A young adult who wants records kept private should say so directly and in writing to each provider.

How to Request the Records

When you are the personal representative, you have the same access rights the child would as an adult. A covered entity must act on a records request within 30 days. A single 30-day extension is available, but only if the provider notifies you in writing with the reason and a specific completion date.¹⁰ The outer limit is 60 days, with no further extensions.

Fees are capped. A covered entity can only charge a reasonable, cost-based amount for copies, and only for labor to copy, supplies, and postage. No search fees, no retrieval fees, no charges for maintaining records systems. For electronic copies of records maintained electronically, the provider may instead choose a flat fee of no more than $6.50 covering all labor, supplies, and postage.¹¹ A quote in the hundreds of dollars for a child’s records likely exceeds what HIPAA allows.

Filing a Complaint if You’re Wrongly Denied

If a provider refuses to release the records and you believe the denial is unjustified, you can file a complaint with the HHS Office for Civil Rights. OCR has treated right-of-access violations as an enforcement priority, settling at least 25 cases under its Right of Access Initiative.¹²

Name the provider or entity, describe what happened, and submit within 180 days of when you learned about the denial. OCR may extend that period for good cause. You can file online through the OCR Complaint Portal, by email to OCRComplaint@hhs.gov, or by mail to the HHS Office for Civil Rights in Washington, D.C.¹³ OCR won’t investigate anonymous complaints, but you can ask that your identity stay confidential during the investigation.

Before going to OCR, it usually pays to escalate inside the practice or hospital first. Ask for the denial in writing, request the privacy officer, and cite the specific right-of-access provision. Many denials come from staff confusion about the rules rather than deliberate obstruction, and a targeted conversation with the right person resolves the issue faster than a federal complaint.

1
U.S. Department of Health & Human Services. Personal Representatives
2
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules
3
U.S. Department of Health & Human Services. Personal Representatives and Minors
4
U.S. Department of Health & Human Services. The HIPAA Privacy Rule and Parental Access to Minor Children’s Medical Records
5
U.S. Department of Health & Human Services. Does the HIPAA Privacy Rule Allow Parents the Right to Access Medical Records
6
HHS.gov. HIPAA Privacy Rule and Sharing Information Related to Mental Health
7
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
8
HHS.gov. Does the HIPAA Privacy Rule Preempt State Law to Report Child Abuse
9
eCFR. 45 CFR 164.522 – Rights to Request Privacy Protection for Protected Health Information
10
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
11
HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
12
HHS.gov. Five Enforcement Actions: HIPAA Right of Access
13
HHS.gov. How to File a Health Information Privacy or Security Complaint