Providing parents with access to their child’s healthcare information is not a new legal requirement, but given recent guidance and statements from federal regulators, it is an area of renewed enforcement focus. Now is a good time for healthcare providers who treat children to ensure their policies reflect applicable legal requirements and are being followed internally.
On the podcast this week, attorney Susan Freed discusses a parent’s right to access their minor child’s healthcare records, how this right can be limited, and situations that can lead to disputes between providers and parents.
Key HIPAA principles to understand
While confusion around parental access is common, especially when teenagers or sensitive services like mental health care are involved, the governing legal principles are relatively straightforward.
1. The HIPAA Right of Access
HIPAA gives individuals a legally protected right to access and obtain copies of their medical records from covered healthcare providers.
2. The right extends to personal representatives
That right of access also applies to a patient’s personal representative, someone legally authorized to make healthcare decisions on the patient’s behalf.
3. State law determines who is a personal representative
HIPAA defers to state law to determine who qualifies as a personal representative. For minors, parents are generally considered the child’s personal representatives unless their rights have been limited or terminated under state law.
When a parent’s access rights may be limited
There are several situations where a parent may not be treated as a minor’s personal representative for HIPAA purposes:
- Minor consent laws
If state law allows a minor to consent to certain types of care without parental consent, and the minor does so, then the parent is not the personal representative for that specific encounter. Records related to that care generally may not be disclosed to the parent without the minor’s authorization.
- Court-ordered or guardian-directed care
When care has been ordered by a court or a court has appointed another individual as the child’s healthcare decisionmaker.
- Agreed-upon confidentiality
In some cases, parents may agree that their child can have a confidential relationship with a provider or may agree to limit their access to certain information. If the parent has expressly agreed to limit their access, providers may withhold records consistent with that agreement. This exception requires careful documentation.
Even when a parent is the child’s personal representative, HIPAA allows providers to deny access if, in the provider’s professional judgment, granting access could endanger the child or if there is a reasonable belief of abuse, neglect, or domestic violence. This is a fact-specific determination and should be handled with care.
Common problem areas for providers
Situations that can pose challenges for organizations when it comes to parent access, include:
- Patient portals
Technical limitations may prevent providers from separating records a minor consented to independently from those requiring parental consent. While this can complicate portal access, it does not eliminate the parent’s underlying right to the information they are entitled to receive. Clear communication with parents and alternative access methods are critical.
- Non-custodial parents
Staff may hesitate to provide records to non-custodial parents, or a custodial parent may object to the other parent’s access. Providers need to understand each parent’s rights and the laws of their specific state to ensure they are providing the appropriate access.
- Provider discomfort without legal justification
Sometimes providers simply want to deny access without meeting a legal exception. Make sure your individual providers understand what the laws are on parent access and what is required to withhold access.
Please see full Podcast here.
