Minor Children and Parental Rights to PHI

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.

This article summarizes the HIPAA rules regarding minors and protected health information. Co Compliancy Group does not provide legal advice. Specific questions about what laws apply (and how they apply) to your unique factual circumstances (e.g., "Someone claiming to be a parent of a child that I treat is demanding access to the child's records. Can I give them the records?") should be directed to an attorney. 

Introduction 

This article covers HIPAA rules that discuss minor children and parental rights to PHI. 

What are Some General Rules Regarding When Parents Can Access PHI of Minor Children? 

Regardless of whether a parent is the personal representative of a minor child, the HIPAA Privacy Rule permits a covered entity to disclose to a parent, or provide the parent with access to a minor child’s protected health information, when and to the extent it is permitted or required by state law. This means that if the disclosure is permitted or the access can be provided under state law, the Privacy Rule permits the disclosure and the access is allowed - to the extent permitted by state law. In some instances, state law requires that a provider disclose PHI to a parent, or requires that a provider give a parent access to a minor child's PHI. In these instances, the HIPAA Privacy Rule permits the disclosure or access.

When and to the extent it is prohibited under state or federal law, the HIPAA Privacy Rule prohibits organization from disclosing a minor child’s protected health information to a parent, or providing a parent with access to that information.

What Factors Might Play a Role in Determining Whether a Parent Can Access a Child's PHI?

Examples of factors under state law that might play a role in determining whether a parent can access a child's PHI include (but are not limited to):


1. The age of the child
2. Whether the child is emancipated.
3. The nature of the PHI being sought - for example, a state law might not permit a parent to obtain PHI related to a specific procedure.
4. Whether the terms of a relevant court decree (such as a custody decree) prohibit a parent from accessing a child's PHI, or require such access.

Emancipation: If the minor is emancipated, a covered entity should honor that minor's ability, as set forth in their emancipation, to act on their own behalf or to select an appropriate personal representative. For more information about minors and personal representatives, please click here.

If the minor is unemancipated but is granted rights under federal, state or other applicable law, to make decisions, provide consent or block access to their PHI, a covered entity should honor the minor’s authority to act as an individual, and should not treat another person as their representative. Circumstances where minors are granted these rights include:

• Law requires no consent beyond that of the minor and the minor has not asked for someone to act as their personal representative, even if consent from another person has already been obtained. 
  • Example: State law provides an adolescent the right to obtain mental health treatment without the consent of his or her parent, and the adolescent consents to such treatment without the parent’s consent.
• Law allows minors to obtain specific health care services without the consent of a parent, guardian, or other person acting in loco parentis, and either the minor, a court, or another authorized person consents to that health care service. 
  • Example: A court may grant authority to make health care decisions for the minor to an adult other than the parent, to the minor, or the court may make the decision(s) itself.
• A parent, guardian, or other person acting in loco parentisassents to an agreement of confidentiality between organization and the minor with respect to such healthcare service.
  • Example: A physician asks the parent of a 16-year-old if the physician can talk with the child confidentially about a medical condition and the parent agrees
    
    

Situations Involving Endangerment, Domestic Violence, Abuse, or Neglect

When a covered entity reasonably believes that an individual, including an unemancipated minor, either

(1) has been or may be subject to domestic violence, abuse, or neglect by a personal representative; or (2) that treating a person as the personal representative could endager the individual, the covered entity can decide whether to share a minor's information with the individual, or allow that individual to make healthcare decisions on behalf of the minor. If in the exercise of professional judgment sharing or allowing decision making would not be in the best interests of the minor individual, the covered entity may choose not to treat that person as the minor’s personal representative.

Resources

For HHS guidance on personal representatives and minors, please click here.

For information about the HIPAA Privacy Rule and sharing information related to mental health, please click here.