A son moved home from college during the pandemic when his classes moved online. He slept in the same room he had in high school, ate dinner with the family and helped out around the house. He went to his doctor for a checkup and his parents wanted to know how did it go. Are parents of an 18-year old entitled to call the doctor and find out? His younger sister, at 15, struggled with the stress of the pandemic, developed anxiety, and entered counseling. Do the parents have access to her medical records related to her treatment?
While a child is a minor – in most states and for most purposes, that means under the age of 18 – parents are responsible for their care, and when it comes to health privacy, the general rule is that parents are entitled to know their minor child’s protected health information (PHI). In fact, under HIPAA, parents are considered to be their children’s personal representative, meaning they can make decisions about their medical care, obtain access to their PHI, and authorize their PHI to be shared with a third party. The Department of Health and Human Services (HHS) discusses the parent as personal representative of a minor child here.
Privacy and confidentiality rights are a matter of both state and federal laws – HIPAA will preempt state law unless the state law is more stringent, i.e., more favorable toward the individual’s rights.
Exceptions to the General Rule
Under HIPAA a parent may not be considered a minor child’s personal representative or be able to obtain their medical records if:
- the child independently consented to a health care service, no other consent is required by law, and the child has not requested that the parent be treated as the personal representative;
- the state allows minors to obtain a health care service without the consent of a parent, guardian, or other person acting in loco parentis, and the child, a court, or another authorized person has consented to that treatment; or
- the parent voluntarily agreed that the child’s information would be kept confidential from the parent.
Note that number 2. above refers to state law – the laws around adolescent health privacy, discussed below, are largely a matter of state laws that have given more confidentiality rights to minors in recent years. The American Medical Association also recognizes a need to maintain confidentiality of minors in certain circumstances, and has published a Code of Medical Ethics Opinion on the topic.
Note too, neither the parent nor the child has a right under HIPAA to access notes of psychotherapy sessions that are kept separate from the medical record.
Health Privacy for Adolescents
HIPAA is a federal law and governs most privacy matters across the country but as noted, all fifty states also have privacy laws.
For example, many states have special laws protecting adolescents’ health privacy, especially related to information about sexual activity, pregnancy, HIV and other sexually transmitted diseases (STDs), substance abuse and mental health. The idea behind this shift in the law is that confidentiality is necessary to encourage some minors to seek health care who otherwise would not.
A health care provider treating an adolescent for a sensitive health issue like those described above should not assume a parent or guardian has the right to be involved, or have access to the adolescent child’s PHI. The state law should be consulted, because if it requires maintaining the child’s confidentiality the HIPAA general rule that the parent is the personal representative does not apply.
The Department of Health and Human Services (HHS) discusses what parents of children being treated for mental illness, substance abuse or addiction need to know here.
When Children Become Adults under HIPAA
Minor children become adults under the law based on their chronological age, not whether they continue to be economically dependent on their parents, or live with their parents. At age 18, children become adults and can vote, enter contracts, get a job and live at home or away from home. At 18 they have a right to health privacy on all matters, not only sensitive matters related to behavioral or sexual health, even if they’re economically dependent on a parent.
HIPAA permits providers to speak with family and friends under certain circumstances. If the patient is available and can speak, the provider should give the patient “an opportunity to agree or object” to the sharing of information. So, for example, if a health care provider receives an inquiry from the parent of a individual/patient who is a legal adult, the provider should give the patient an opportunity to agree or object. It does not need to be formal, or even in writing. This is not the same as an “authorization” to provide PHI to a third party, which should be in writing. You can speak to the patient on the phone, or ask them in person. But always document that you asked, and keep the record in the patient’s file: the date you asked, what you asked, and and the patient’s reply. Read more about speaking with family and friends here.
Special Needs Individuals
The same is also true for special needs individuals. If a child has special needs that a court finds makes him or her unable to make their own healthcare decisions, when they turn 18, a parent or other legal guardian is appointed to be their personal representative to continue to direct their medical care or have access to their medical records.
Personal Representatives
When someone tells a healthcare provider that they are a patient’s personal representative, it is essential to verify and document the identity, legal authority and scope of the personal representative’s authority to act in making decisions on behalf of a patient.
Answers to the Questions Posed
- Question: Are the parents of an 18-year old entitled to call their child’s doctor and find out his condition? Answer: No. HIPAA is clear about this, that individuals have a right to privacy and security of their protected health information. A health care provider may talk to family and friends of a patient, but only if they clear it with the patient first, by giving them the opportunity to agree or object. This is true even if the child is on the parents’ health insurance plan.
- Question: Are the parents of a 15-year old entitled to information related to the child’s mental health counseling? Answer: This answer depends on the law of the state where the 15-year old lives. If the state law protects the adolescent’s privacy and confidentiality (and many states do), HIPAA does not require the parent be recognized as the child’s personal representative, with regard to that health topic.
Practical Advice for Every Day from The HIPAA E-Tool®
The HIPAA E-Tool® covers the technical side of HIPAA and the basics you face every day staying compliant. Our glossary and the search box answer all your HIPAA questions, with up to date legal citations if you need additional research. And our HIPAA experts are a phone call away if you want to ask a question.