Does HIPAA Apply to Parents of Minor and Adult Children?

HIPAA does apply to parents, and how it applies flips at the age of majority. If your child is a minor, federal law generally treats you as the child’s “personal representative,” which means you can see the medical record and authorize disclosures the same as the patient could. Once your child turns 18 (19 or 21 in a few states), that automatic access ends, and you need a signed HIPAA authorization or a healthcare power of attorney to see anything. Between those two poles sit a handful of situations — teen consent laws, divorce, insurance billing, emergencies, substance use treatment — where the answer is more complicated.

Parents of Minor Children: The Personal Representative Rule

The baseline is simple. If you have legal authority to make healthcare decisions for your minor child, HIPAA treats you as that child’s personal representative, and a covered entity must treat a personal representative the same as it would the patient.¹ You can request the complete medical record, authorize disclosures to third parties, and exercise every privacy right the child would otherwise hold.²

In most states, a minor is anyone under 18. Alabama and Nebraska set the age of majority at 19, and Mississippi at 21, so the cutoff for automatic parental access depends on where you live.

When You Cannot See Your Minor Child’s Records

The personal representative rule has real exceptions, and they come up more often than most parents expect with teenagers. A covered entity can withhold records in three situations:

The minor lawfully consented to the care on their own, no other consent was legally required, and the minor has not asked that you be treated as their representative. This usually involves reproductive health, sexually transmitted infection testing, mental health counseling, or substance use treatment. The ages at which minors can consent vary by state, starting as young as 12 in some places.¹
A court, or someone the court appointed, directed the treatment. The parent is not the personal representative for records tied to that care.²
You agreed to a confidential relationship between your child and a provider, most commonly with a therapist. That agreement waives access to those records.²

On top of these three, a provider can refuse to treat a parent as the personal representative if the provider reasonably believes the child has been or may be subjected to abuse or neglect by that parent, or that giving the parent access could endanger the child.³

One nuance matters here. These exceptions are usually limited to the specific type of care they cover. Losing personal representative status for your teenager’s counseling sessions does not strip your access to their orthopedic visits. HIPAA does not shut parents out wholesale because one exception applies to one category of treatment.²

Two related doctrines can also shift the picture. Some states recognize a “mature minor” principle allowing a teenager who demonstrates sufficient understanding to consent to certain treatment without a parent, and any records tied to that care fall outside parental reach under HIPAA. And a minor who has been legally emancipated (through a court order, marriage, military service, or another state-recognized process) is treated as an adult; the parent is no longer the personal representative.¹

Divorced or Separated Parents

HIPAA does not resolve custody disputes. It defers to “applicable law,” meaning state law and any existing court orders determine which parent has authority to make healthcare decisions and therefore qualifies as the personal representative.⁴ In many states, both parents keep access unless a court order restricts one of them. A custody agreement that strips one parent of medical decision-making also strips that parent of personal representative status.

Providers occasionally get pulled into these disputes. HHS guidance is clear that a covered entity may not add restrictions the law does not impose, so if both parents have legal authority, a provider cannot deny one parent access simply because the other parent objects.⁴

What Happens the Day Your Child Turns 18

This is where most families get caught off guard. On the day your child reaches the age of majority, your status as personal representative disappears. It does not matter that your child still lives at home, is on your health plan, or that you pay the bills. Without written authorization from your adult child, a provider cannot share a diagnosis, test result, treatment plan, or anything else in the medical record with you.¹

The remedy is a signed HIPAA authorization. Most families do not think about it until they are standing in a hospital hallway being told the doctor cannot talk to them.

What a Valid HIPAA Authorization Must Include

An authorization is not a blank permission slip. Federal regulations spell out what the form must contain to be valid:⁵

A specific description of the information that can be shared.
The name or identification of the person or people authorized to receive it, such as “my mother, Jane Smith.”
The name or identification of the provider or plan authorized to release it.
The purpose of the disclosure. If the patient is the one asking, “at my request” is enough.
An expiration date or event.
The adult child’s signature and the date.

The form must also tell the signer that the authorization can be revoked in writing at any time, that the provider cannot condition treatment on signing, and that information disclosed under the authorization may no longer be protected by HIPAA once it reaches the recipient.⁵ Most hospitals and clinics have their own version, and you can also prepare one independently.

Insurance Billing Can Leak Information

The Affordable Care Act lets adult children stay on a parent’s plan until age 26. That helps with coverage and complicates privacy. When a claim is processed, the plan typically mails an Explanation of Benefits to the primary policyholder, usually the parent. The EOB shows what services were provided, to whom, and what the plan paid. An adult child who saw a psychiatrist, was tested for an STI, or filled a prescription may have that information land in a parent’s mailbox.

HIPAA offers a partial fix. Under the confidential communications rule, an individual can ask a health plan to send communications to an alternative address or by an alternative method. Plans must accommodate the request when the individual states that normal disclosure could endanger them. Providers must accommodate reasonable requests without requiring an explanation.⁶

The plan-side bar is higher than many adult children realize. Some states have laws requiring plans to communicate directly with adult dependents about their own care, but coverage is uneven. The most reliable route to full privacy is paying out of pocket for a sensitive service and asking the provider not to submit the claim; under HIPAA, a provider must agree to restrict disclosures to a health plan for any service paid in full by the patient.⁶

Emergencies and Incapacitated Adult Children

The scenario every parent fears is an adult child unconscious in a hospital and staff who will not say what happened. HIPAA has a release valve. When a patient is incapacitated or not available, a provider may share health information with family members if, in the provider’s professional judgment, doing so is in the patient’s best interest. The provider can share only information directly relevant to that family member’s involvement in care.⁷ That is how a surgeon can update a parent about an unconscious patient’s condition without violating federal law.⁸

When the patient is conscious and has capacity, the provider can share information with a family member if the patient agrees, does not object when given the chance, or the provider reasonably infers from the circumstances that the patient would not object.⁷ No written form is required for these informal disclosures.

Healthcare Power of Attorney

Emergency disclosures are limited in scope. For ongoing decision-making authority, a healthcare power of attorney is the stronger tool. It lets your adult child designate you to make medical decisions if they cannot. Under HIPAA, a person with legal authority to make healthcare decisions for an adult is that adult’s personal representative and gets full access to relevant records.¹ The document only activates when a physician certifies that the patient cannot make their own decisions, so it does not override an adult child’s autonomy while they are competent. Many families pair it with a HIPAA authorization so the parent can see records even when the power of attorney has not been activated.

Court-Appointed Guardianship

If an adult child becomes incapacitated and no power of attorney exists, a court can appoint a guardian or conservator to make healthcare decisions. Guardianship is slower, more expensive, and more intrusive because it involves a court proceeding and ongoing judicial oversight. The appointed guardian becomes the personal representative under HIPAA and gains access to the medical record.¹

Substance Use Records Are Locked Down Further

A separate federal rule, 42 CFR Part 2, sets stricter privacy protections for records from federally assisted substance use disorder treatment programs. These protections go beyond HIPAA and can limit what a parent learns even about a minor’s treatment.

If state law lets a minor consent to substance use treatment on their own, only the minor can authorize disclosure of those records, including a disclosure to a parent for insurance reimbursement. If state law requires parental consent for the minor to enter treatment, both the minor and the parent must agree to any disclosure.⁹

There is a narrow safety exception. If the program director determines that a minor lacks the capacity to make a rational decision about disclosure (because of extreme youth or a mental or physical condition) and the minor’s situation poses a serious threat to their life or someone else’s safety, the program may share relevant facts with a parent.⁹ Outside that exception, Part 2 records cannot be released, cannot be overridden by state law, and cannot be used in legal proceedings against the patient.¹⁰

After a Child’s Death

HIPAA protections do not end when someone dies. The Privacy Rule continues to protect a deceased individual’s health information for 50 years after the date of death.¹¹ Being a parent alone does not automatically grant access to a deceased adult child’s records.

The personal representative of a deceased individual is the executor or administrator of the estate, or someone otherwise legally authorized by a court or state law to act on the deceased person’s behalf.¹² If you are the executor of your child’s estate, you can request records relevant to that role. If no estate has been opened, state law governs who qualifies.

A separate pathway exists for surviving relatives who need the deceased person’s information for their own medical care. A provider can disclose a decedent’s information to another individual’s treating provider without any authorization, because disclosures for treatment purposes do not require one.¹³ If you need your child’s genetic or family history for your own treatment, your doctor can request it directly from the facility that treated your child.