Parental Access to Medical Records

​Under the HIPAA Privacy Rule, a parent in most cases is considered a child’s personal representative and has the right to access the child’s protected health information (PHI), including medical records, though exceptions may apply. 

Who is a Personal Representative?

A personal representative for purposes of the Rule is someone who, under applicable law, has authority to act on behalf of an individual in making health care decisions. For an unemancipated minor child (hereafter, “child”), a personal representative may be a parent, guardian, or other person acting in loco parentis (hereafter collectively, “parent”). 

As a child’s personal representative, a parent can generally exercise a child’s rights to his/her/their PHI, but there are some exceptions.

Exceptions: When a Parent is Not a Child’s Personal Representative

There are three circumstances in which a parent is not a child's personal representative under the Rule:

1. When a child consents to a health care service and no other consent is required by law for that service, and the child has not requested that the parent be treated as his/her/their personal representative;
2. When a child may lawfully obtain a health care service without parental consent and the child, a court, or another authorized person consents to the service; and
3. When a parent agrees to a confidential relationship between a health care provider and child. 

See HHS guidance on personal representatives for examples of each of the three exceptions.

As stated in the U.S. Department of Health and Human Services (HHS) fact sheet, Am I my child’s “personal representative” under HIPAA?, such exceptions are generally confined to particular types of health care services. In other words, a parent may be considered a child’s personal representative for most health care services that the child receives but not recognized as the child’s personal representative for specific services.

In its Dear Colleague letter on the HIPAA Privacy Rule and parental access to minor children’s medical records, HHS states that a parent is not a child’s personal representative under exceptions #1 and #2 above for purposes of PHI related to that specific health care service. For exception #3, the extent of the parent’s agreement for the child to have a confidential relationship with a provider determines the parent’s status as the child’s personal representative with respect to PHI maintained through that health care provider.

Abuse, Neglect, or Endangerment

Consistent with the Rule for all personal representatives, if a physician or other covered entity reasonably believes that a child has been or may be subjected to domestic violence, abuse, or neglect by a parent, or that treating the parent as the child’s personal representative could endanger the child, the physician may choose not to treat the parent as the child’s personal representative when in the best interest of the child.

State or Other Applicable Law

As covered in the FAQ, Does the HIPAA Privacy Rule allow parents the right to see their children’s medical records?, whether a parent is a child’s personal representative and may access his/her/their medical records is determined in part by state or other applicable law. State or other applicable law may require or prohibit parental access to a child’s PHI in certain circumstances. See the HHS Office for Civil Rights fact sheet for a list of things to find out about your state’s laws that may affect whether a parent is a child’s personal representative under HIPAA and can access the child’s PHI.

The Takeaway

While a parent is generally considered a child’s personal representative under the Rule and has the right to access the child’s PHI, exceptions exist, and state or other applicable laws may impact this right. Familiarity with the HIPAA Privacy Rule and state law is important to understanding parental access rights.

Additional Resources

• See the HHS webpage, Information Related to Mental and Behavioral Health, including Opioid Overdose, for fact sheets on what to know about HIPAA and information sharing related to mental and behavioral health.

Disclaimer: The recommendations in this publication do not indicate an exclusive course of treatment or serve as a standard of medical care. Variations, taking into account individual circumstances, may be appropriate. This content is for informational purposes only. It is not intended to constitute financial or legal advice. A financial advisor or attorney should be consulted if financial or legal advice is desired.