A minor can authorize access to their own health records whenever state or federal law lets that minor consent to the underlying care without a parent’s permission. The HIPAA Privacy Rule ties record control to treatment consent: if a minor can legally receive a service on their own, the parent generally loses the right to see those particular records.1eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules The most common triggers are reproductive health, substance use treatment, and mental health counseling, and a minor’s legal status (emancipation, for example) can shift control across the board.
The Default Rule for Parents
Under HIPAA, a parent or guardian of an unemancipated minor is normally the child’s “personal representative.” That status carries the same rights the child would have: requesting copies, authorizing disclosures to schools or specialists, and receiving information about treatment.2U.S. Department of Health & Human Services. The HIPAA Privacy Rule and Parental Access to Minor Children’s Medical Records Parents manage their children’s healthcare, so the default gives them the information they need to do it.
HIPAA does not create that authority on its own. It defers to “applicable law,” which usually means state law. And state law is where the exceptions live.
How Consent to Care Determines Who Controls the Record
Under 45 CFR 164.502(g)(3), a parent is not the personal representative for a particular health care service, and the minor controls the associated records, when any of these applies:1eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules
- The minor consents to the care and no other consent is legally required. If state law lets a 14-year-old consent to mental health counseling on their own, the parent cannot access those counseling records unless the minor invites them in.
- The minor may lawfully obtain the care without parental consent, and the minor or a court has consented.
- The parent has agreed to a confidentiality arrangement with the provider about that treatment.
The practical consequence: whenever a state statute allows a minor to consent to a category of care, the privacy of those records follows automatically. There is no need for a separate privacy law for each service. The consent rule builds the privacy consequence in.
Reproductive and Sexual Health
Reproductive care is the broadest and best-established area where minors control their own records. The vast majority of states allow minors to consent to some or all of the following without parental involvement: contraception, testing and treatment for sexually transmitted infections, and prenatal care. Because the minor can legally consent, the HIPAA mechanism kicks in, and the minor decides whether anyone else sees the records.
Federally funded family planning clinics operating under Title X add another layer. Title X regulations prohibit project staff from requiring parental consent for services to minors and bar them from notifying a parent before or after a minor receives family planning services.3eCFR. 42 CFR Part 59 – Grants for Family Planning Services A minor visiting a Title X clinic for contraception or STI testing can be confident the clinic itself will not contact their parents. Title X providers must still comply with state mandatory reporting laws for child abuse or sexual abuse.
Substance Use Treatment
Substance use records carry some of the strongest federal privacy protections in health information. The regulations at 42 CFR Part 2 restrict use and disclosure of records from substance use disorder treatment programs, in some ways more strictly than HIPAA.4eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
For minors, Part 2 defers to state law on one question: can the minor apply for and obtain substance use treatment without parental consent? If state law says yes, only the minor can authorize disclosure of those records. A parent cannot access them, even for insurance reimbursement, unless the minor signs a written consent.5eCFR. 42 CFR 2.14 – Minor Patients If state law does require parental consent for treatment, both the minor and the parent must authorize any disclosure.
Part 2 includes a narrow safety valve. If a minor applicant lacks the capacity for rational choice due to extreme youth or a physical or mental condition, the program director may disclose limited information to a parent when necessary to reduce a substantial threat to the minor’s life or physical well-being.5eCFR. 42 CFR 2.14 – Minor Patients
Mental Health Services
Mental health is where state laws diverge most. The age at which a minor can independently consent to outpatient mental health treatment ranges from as young as 12 in some states to the standard age of majority in others. Many states set the threshold at 14 or 16, sometimes with additional conditions like a cap on sessions before parental involvement is required. Roughly a third of states have no explicit statute granting minors consent rights for mental health care, so parental consent is required by default.
Where state law does allow the minor to consent, HIPAA gives the minor control of the records for that treatment.
Psychotherapy Notes Are Treated Separately
HIPAA draws a hard line between psychotherapy notes and the rest of the medical record. Psychotherapy notes are a therapist’s personal notes from a counseling session, kept separate from the chart. No one has a right of access to psychotherapy notes under HIPAA, not even the patient, and not a parent acting as personal representative.6eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information A provider who keeps proper psychotherapy notes has significant discretion to refuse a parent’s request for them.7U.S. Department of Health & Human Services. Does a Parent Have a Right to Receive a Copy of Psychotherapy Notes About a Child’s Mental Health Treatment?
The rest of the mental health record is different. Diagnoses, symptoms, treatment plans, and medications sit in the standard medical record, and a parent acting as personal representative can access them. A parent might learn their child has been diagnosed with depression and prescribed medication without being entitled to read the therapist’s session-by-session notes. This distinction matters most when the parent consented to the treatment (and kept personal representative status) but the child still wants privacy in what they say to the therapist.
When Legal Status Shifts Control Entirely
The exceptions above attach to specific services. Two others apply across all of a minor’s care.
Emancipated Minors
An emancipated minor is someone under 18 who has been legally freed from parental control, typically through a court order, marriage, or military enlistment. HIPAA treats an emancipated minor as an adult for record-access purposes, and any person with authority to act on their behalf is their personal representative, not a parent.1eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules Once emancipated, the minor holds complete control over their medical records and healthcare decisions.
The Mature Minor Doctrine
The mature minor doctrine is a case-by-case assessment, not a blanket status. A provider evaluates whether a non-emancipated minor has the maturity and understanding to consent to a specific treatment. If the provider determines the minor is sufficiently mature, the minor can consent and control the records for that care. Roughly three-quarters of states recognize some version of this doctrine through statute or case law, and the criteria vary widely. Unlike emancipation, the determination applies only to the treatment at hand.
The Billing Blind Spot
This is where many minors lose the privacy they thought they had. A teenager may consent to confidential STI testing, and the clinic may handle the record perfectly, but if the visit is billed to a parent’s insurance, the parent may receive an Explanation of Benefits (EOB) that reveals the service. The EOB does not contain the medical record, but the description of services and provider name can say enough.
HIPAA offers a partial fix. Under the confidential communications rule, healthcare providers must accommodate reasonable requests for confidential communications without requiring any explanation.8eCFR. 45 CFR 164.522 – Rights to Request Privacy Protection for Protected Health Information The standard for health plans is higher: the individual must state that normal disclosure could endanger them, and the plan may require the request in writing.
In practice, a minor on a parent’s plan who wants to prevent an EOB from reaching home faces a real obstacle. Some states have passed laws requiring insurers to suppress EOBs for sensitive services or to honor confidential communication requests from dependents, but no uniform federal standard guarantees this. Ask the provider’s office before the visit whether the service can be billed confidentially, whether a sliding-fee-scale option exists, or whether the visit can be covered under a program like Title X that does not bill a parent’s insurance at all.
When a Provider Can Override the Minor’s Privacy
Even when a minor clearly controls their records, providers keep limited authority to override that privacy in serious situations.
Serious and Imminent Threats
A provider may disclose a minor’s protected health information without authorization if the provider believes in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to health or safety, and the disclosure goes to someone reasonably able to reduce that threat.9eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required If a therapist determines a teenager is at immediate risk of self-harm, contacting the parents falls squarely within this exception. General concern about risky behavior does not.
Mandatory Reporting of Abuse
Every state maintains laws for mandatory reporting of known or suspected child abuse and neglect as a condition of federal child protection funding.10Office of the Law Revision Counsel. 42 USC 5106a – Grants to States for Child Abuse or Neglect Prevention and Treatment Programs If a provider learns of abuse during a confidential visit, the duty to report overrides the minor’s privacy. The report goes to child protective services or law enforcement, not to the parent.
Suspected Abuse by the Parent
HIPAA also addresses the reverse scenario. A provider may decline to treat a parent as personal representative if the provider reasonably believes the minor has been or may be subjected to domestic violence, abuse, or neglect by that parent, or that granting the parent access could endanger the child. This is an individualized professional judgment that withholding access is in the child’s best interest.11U.S. Department of Health & Human Services. Personal Representatives The parent loses personal representative status for the relevant records.
What Changes at 18
Once a child reaches the age of majority (18 in most states), parental personal representative status under HIPAA ends automatically. The now-adult child controls all their health information, including records created while they were a minor. A parent who wants continued access needs the child to sign a HIPAA authorization, which the child can revoke at any time. Being on a parent’s health insurance plan does not restore any right to see medical records.
If the young adult becomes incapacitated and cannot make decisions, a healthcare proxy or medical power of attorney can restore a parent’s access, but only if executed in advance. Without those documents, providers may still share limited information with a family member involved in the patient’s care, but the broad personal representative authority the parent once held is gone.
School Health Records Follow a Different Rule
Records created or maintained by a school, including records from school nurses and school-run health clinics, fall under the Family Educational Rights and Privacy Act (FERPA) rather than HIPAA. Under FERPA, parents of students under 18 control education records, including health records embedded in them. A minor generally cannot block parental access to school health records the way they can with a private provider.12United States Department of Education. A Parent Guide to the Family Educational Rights and Privacy Act (FERPA)
When the student turns 18 or enrolls in a postsecondary institution at any age, FERPA rights transfer from parent to student. For students dually enrolled in high school and college, an unusual split applies: the parent keeps rights over the high school records, while the student controls the college records. School-based health centers operated by an outside healthcare system rather than the school itself may follow HIPAA instead of FERPA, which can change the privacy picture for sensitive services delivered on school grounds.