Can a Parent Get a Child’s Therapy Records Under HIPAA?

Under HIPAA, a parent can generally get a child’s therapy records, because federal privacy rules treat a parent or legal guardian as the minor’s “personal representative” for health information. That default gives you the right to inspect and copy your child’s therapy chart, but it has real limits: the therapist’s private psychotherapy notes are excluded, state laws that let minors consent to their own mental health care can transfer control to the child, substance use treatment records carry their own tighter rules, and custody orders or safety concerns can restrict or end your access entirely.

The Default Rule: Parents as Personal Representatives

The HIPAA Privacy Rule, at 45 CFR 164.502(g), requires providers to treat a parent, guardian, or other person acting in a parental role as the “personal representative” of an unemancipated minor when that adult has authority under applicable law to make health care decisions for the child.¹ Personal representative status means you stand in the child’s shoes for privacy purposes. You can request, inspect, and receive copies of the child’s protected health information on the same terms the child could as an adult.

For therapy, that generally covers diagnoses, treatment plans, medication information, session dates, progress notes kept in the medical chart, clinical test results, and billing records. HHS has confirmed that the Privacy Rule “generally allows a parent to have access to the medical records about his or her child, as his or her minor child’s personal representative when such access is not inconsistent with State or other law.”²

Legal guardians, stepparents with formal authority, and other adults acting in loco parentis get the same status if state law gives them health care decision-making authority.³ A grandparent raising a child under a guardianship order, for instance, needs to present the court paperwork to the therapist’s office to establish that authority.

Psychotherapy Notes Are Off-Limits

One category of therapy record sits behind a much higher wall, and it trips up almost every parent who asks. Federal regulations define “psychotherapy notes” narrowly as a therapist’s personal notes documenting or analyzing conversations during a counseling session, kept separate from the rest of the medical record.⁴ These are the therapist’s private working notes: impressions, hypotheses, and session-by-session observations that never become part of the official chart.

The definition excludes a lot of what parents typically want. Medication information, session start and stop times, clinical test results, and summaries of diagnosis, treatment plan, symptoms, prognosis, and progress are all part of the standard medical record, not psychotherapy notes.⁴ Those items remain accessible to a parent with personal representative status.

Actual psychotherapy notes, though, are excluded from the right of access entirely. HIPAA does not give anyone, including the patient or the personal representative, a right to inspect or copy them.⁵ A therapist has discretion to share them voluntarily but is never required to, and a denial cannot be appealed.⁶

When a Therapist Can Deny Access

Beyond the psychotherapy notes carve-out, a provider can refuse a parent’s request in a few specific situations. The rules distinguish between denials you can appeal and denials that are final.

Reviewable Safety Denials

A licensed health care professional may deny access if, in their professional judgment, releasing the records is reasonably likely to endanger the life or physical safety of the child or another person. A provider can also deny a personal representative’s request if release is reasonably likely to cause substantial harm to the child or someone else.⁷ A teenager who disclosed a volatile home situation in therapy is the classic case: if the therapist believes handing those notes to the parent could trigger real danger, access can be blocked.

When a provider denies access on these grounds, you can request a second opinion. The review must be conducted by a different licensed professional who had no involvement in the original denial, and the provider must carry out whatever the reviewer decides.⁷

Revoking Personal Representative Status

A separate provision goes further. If the provider reasonably believes the child has been or may be subjected to domestic violence, abuse, or neglect by the parent, and determines in their professional judgment that treating the parent as the representative is not in the child’s best interest, the provider can revoke that status altogether.⁷ That ends the parent’s access rights for that provider relationship, not just for one record request. HHS has emphasized this requires “an individualized, patient-specific professional determination by the health care provider,” not a blanket policy.³

When the Minor Controls Their Own Records

HIPAA defers to state law on whether a minor can consent to their own mental health treatment. When the minor has that legal right, the parent may lose personal representative status for that treatment. The regulation identifies three scenarios where this happens:

The minor consents to the care alone and no other consent is required by law, whether or not the parent also consented.
The minor may lawfully obtain the care without parental consent, and the minor or a court has consented.
A parent agrees to a confidentiality arrangement between the provider and the minor for that treatment.¹

In any of these situations, the minor controls the records from that treatment. Ages and conditions vary by state. Many states let minors starting around age 12 to 14 consent to outpatient mental health care on their own. Some use a “mature minor” framework where the provider evaluates whether the adolescent can make informed decisions. The state-law consent threshold drives the HIPAA access question: if your state lets your 14-year-old walk into a therapist’s office and consent to care independently, that teenager likely controls the resulting records too.²

Where state law is silent or ambiguous, the regulation gives the provider a tiebreaker: they may exercise professional judgment to decide whether to grant or deny parental access.¹

Substance Use Records Are Stricter

If the child is receiving treatment for a substance use disorder at a federally assisted program, a separate federal regulation, 42 CFR Part 2, applies on top of HIPAA and its protections are significantly tighter.

If the minor can legally consent to substance use disorder treatment on their own under state law, only the minor can authorize any disclosure of the records, including disclosure to a parent. Your HIPAA personal representative status does not override Part 2. Even confirming the child is a patient in the program requires the minor’s written consent.⁸

If state law requires parental consent for the minor to enter substance abuse treatment, both the minor and the parent must consent to any disclosure. Neither alone can release the records.⁸ Even where a parent otherwise has broad authority, the child keeps a veto over who sees their addiction treatment records.

Custody Orders and Court-Directed Care

Family court documents can reshape the default rules entirely. A custody agreement, divorce decree, or protective order may specify which parent can make medical decisions, which parent can access health records, or both. Those are not always the same right. A custody arrangement might allow one parent to consent to therapy while restricting that parent’s access to the resulting records.

In joint legal custody arrangements, both parents typically keep the right to access the child’s medical information. But the therapist’s office should review the actual paperwork rather than relying on either parent’s description. Where a court has restricted one parent’s rights, that order controls, and a provider who ignores it and releases records to the wrong parent faces both legal liability and a HIPAA violation.³

When a child receives care at the direction of a court or a court-appointed person, the parent is not the child’s personal representative for records related to that court-directed care.³ A parent whose rights have been terminated has no access at all.

What Happens at 18 or Emancipation

Once a child reaches 18, or the age of majority in their state, your personal representative status ends. The now-adult child controls all of their own protected health information, including records created while they were a minor. Continued access requires their authorization or separate legal authority such as a power of attorney or guardianship.² The same applies to emancipated minors: once a court grants emancipation, access requires the minor’s own consent.¹

If you anticipate needing ongoing access for insurance coordination, continued treatment, or family therapy, discuss written authorization with your child before that birthday. Providers will not keep sharing simply because they always have.

If the Portal Locks You Out

Patient portals add a practical wrinkle. Many electronic health record systems default to blocking or granting parental access at certain ages, and those defaults don’t always match the law. In a December 2025 guidance letter, HHS’s Office for Civil Rights told providers that if a portal’s default settings improperly deny a parent’s right of access, the provider must reconfigure the portal to comply with the Privacy Rule.³

A portal that automatically cuts off parental access when a child turns 13 may be violating federal law if the parent still has personal representative status under state law. If you find yourself locked out, contact the provider’s office directly. The block may be a technology default, not a legal determination.

How to Request the Records

Start with a written request submitted to the therapist’s office, typically on the provider’s authorization form. Expect to include the child’s name and date of birth, your name and relationship to the child, a description of the records and dates of service, your signature and date, and sometimes the purpose of the request.⁹ Some offices will also want a copy of the custody order or guardianship paperwork before processing.

Be specific. Asking for “all therapy records” can trigger a longer review and larger fee than asking for “treatment summaries and diagnoses from January through June 2025.” Targeted requests move faster.

How Long the Provider Has

The provider must act on your request within 30 calendar days. One extension of up to 30 additional days is allowed, but only if the provider notifies you in writing within the initial 30 days explaining the delay and when to expect a response. Only one extension per request.¹⁰

What They Can Charge

Fees must be reasonable and cost-based. The provider can charge only for the labor of creating the copy, the supplies used (paper, CD, USB drive), and postage if you want the records mailed. Search and retrieval time, data system maintenance, and general overhead cannot be included. For electronic copies of records already maintained electronically, HHS offers a flat fee option capped at $6.50 that covers all labor, supplies, and postage. The provider must tell you the approximate fee before processing the request.¹⁰

If You’re Wrongly Denied or Find an Error

If a provider refuses records you’re entitled to, you can file a complaint with the HHS Office for Civil Rights. Complaints must be filed within 180 days of when you learned about the violation, though OCR may extend that deadline for good cause. The complaint needs to identify the provider, describe what happened, and include your contact information and signature.¹¹

If you review the records and find something inaccurate, you can request an amendment in writing. The provider has 60 days to act, with a possible one-time 30-day extension if they notify you in writing. If they deny the amendment, they must explain the basis and tell you how to submit a written statement of disagreement, which then travels with the disputed information in any future disclosure.¹²

1
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules
2
HHS.gov. Personal Representatives and Minors
3
U.S. Department of Health & Human Services. The HIPAA Privacy Rule and Parental Access to Minor Children’s Medical Records
4
eCFR. 45 CFR 164.501 – Definitions
5
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
6
U.S. Department of Health & Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health
7
eCFR. 45 CFR Part 164 – Security and Privacy
8
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
9
U.S. Department of State. Authorization For Release of Protected Health Information
10
U.S. Department of Health & Human Services (HHS). Individuals’ Right under HIPAA to Access their Health Information
11
HHS.gov. How to File a Health Information Privacy or Security Complaint
12
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information