A mother is at the front desk asking for a copy of her daughter's visit notes. The daughter is sixteen, came in alone last week, and the visit was for something she told the physician she did not want her parents to know about. The receptionist looks at the practice manager. The practice manager looks at the binder. The binder says "parents can access minors' records," which is true most of the time and wrong in exactly the situations that end up as complaints.
HIPAA's answer lives in one paragraph, 45 CFR 164.502(g), and the paragraph does something unusual for a federal rule: it hands the decisive questions to state law. This post quotes the paragraph, walks through the three exceptions, explains what the practice does when state law is silent, and sets out a front-desk procedure and policy language. It does not state any state's minor-consent rules, because those are the part you must look up for your own state.
HIPAA Minors Parents Access Rules: The Personal Representative Test
1. The Default: The Parent Stands in the Patient's Shoes
Under 164.502(g)(1), "a covered entity must, except as provided in paragraphs (g)(3) and (g)(5) of this section, treat a personal representative as the individual for purposes of this subchapter." A personal representative gets everything the patient gets: the right of access under 164.524, the right to an accounting, the right to sign an authorization, the right to request restrictions.
For a minor, (g)(3)(i) says who that is: "If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation." Two limits are built in. The parent's authority comes from "applicable law," meaning your state. And the representation covers P.H.I. (Protected Health Information) "relevant to such personal representation," not necessarily the entire chart.
2. The Three Exceptions
The same paragraph continues: the parent "may not be a personal representative of an unemancipated minor, and the minor has the authority to act as an individual, with respect to protected health information pertaining to a health care service, if" one of three things is true.
| 164.502(g)(3)(i) | Regulation text | Plain English |
|---|---|---|
| (A) | "The minor consents to such health care service; no other consent to such health care service is required by law, regardless of whether the consent of another person has also been obtained; and the minor has not requested that such person be treated as the personal representative" | State law let the minor consent alone, the minor did, and the minor has not asked for the parent to be treated as the representative |
| (B) | "The minor may lawfully obtain such health care service without the consent of a parent, guardian, or other person acting in loco parentis, and the minor, a court, or another person authorized by law consents to such health care service" | State law allows the service without parental consent, and someone other than the parent (the minor, a court) consented |
| (C) | "A parent, guardian, or other person acting in loco parentis assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service" | The parent agreed that this care would stay between the clinician and the minor |
Notice the scope. Each exception is tied to "such health care service." A seventeen-year-old who consented on her own to one category of care is the "individual" for that care. Her parent remains the personal representative for the sports physical, the broken wrist, and the rest of the chart. The record has to be able to separate them, which is a documentation problem before it is a privacy problem.
3. Then State Law Speaks Again
Even where an exception applies, 164.502(g)(3)(ii) sends the practice back to state law on the specific question of disclosure to the parent:
- (A): "If, and to the extent, permitted or required by an applicable provision of State or other law, including applicable case law, a covered entity may disclose, or provide access in accordance with § 164.524 to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis."
- (B): "If, and to the extent, prohibited by an applicable provision of State or other law, including applicable case law, a covered entity may not disclose, or provide access in accordance with § 164.524 to," that information to the parent.
- (C): Where the parent is not the personal representative "and where there is no applicable access provision under State or other law, including case law," the practice "may provide or deny access under § 164.524" to the parent "if such action is consistent with State or other applicable law, provided that such decision must be made by a licensed health care professional, in the exercise of professional judgment."
So the sequence is: does state law give the parent decision-making authority for this care (default representative)? Does one of the three exceptions apply? If so, does state law permit, require, or prohibit telling the parent? If state law is silent, a licensed professional decides, and the front desk does not. That last rule is the one to put on the wall. The general preemption logic, where a more protective state law wins under 45 CFR 160.203(b), is explained in state privacy laws vs HIPAA.
4. Abuse, Neglect, and Endangerment
164.502(g)(5) lets a practice refuse to treat someone as a personal representative regardless of state law when the practice "has a reasonable belief" that the minor "has been or may be subjected to domestic violence, abuse, or neglect by such person," or that "treating such person as the personal representative could endanger the individual," and a professional decides that recognizing the representative "is not in the best interest of the individual." This is a professional judgment call, documented at the time it is made.
5. Involved Parents Who Are Not Representatives
A parent who is not the personal representative for a particular service is not shut out of everything. 164.510(b)(1)(i) permits disclosure "to a family member, other relative, or a close personal friend of the individual" of "the protected health information directly relevant to such person's involvement with the individual's health care," with the individual's agreement or a professional's reasonable inference that the individual does not object, and 164.510(b)(3) allows a professional-judgment disclosure when the individual is not present or cannot object. That is how a clinician tells a parent about medication timing for a teenager who is receiving care the parent cannot access in full, and it is why the conversation belongs to the clinician, not to the person printing records.
6. Front Desk Procedure
Under 164.514(h)(1), before any disclosure a practice must "verify the identity of a person requesting protected health information and the authority of any such person to have access," if not already known. For minors, that means four questions, in order, before anything is printed:
- Who is asking? Verify identity. For a non-parent (stepparent, grandparent, guardian) obtain the document that gives them authority; "acting in loco parentis" is a legal status, not a family role.
- Which records? Match the request to specific visits and services, because the answer can differ by service.
- Is any of it exception care? Check the chart flag. If the practice has not been flagging minor-consent services, that is the first fix.
- Route it. Ordinary requests: process under the 30-day clock in 164.524, as described in the right of access post. Anything involving flagged care: to the treating clinician or privacy officer for the state-law step, and the decision is written down.
Two more details. When a personal representative signs an authorization for a minor's records, 164.508(c)(1)(vi) requires "a description of such representative's authority to act for the individual" on the form, so the release form needs that line, as covered in the HIPAA release form guide. And when the patient turns eighteen, or is emancipated, 164.502(g)(2) applies instead: a parent is a personal representative only "if under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor." Portal proxy accounts that quietly continue past the birthday are a common failure.
7. What to Write Into Policy
The minors section of the privacy policy states: the default that a parent or guardian with health care decision authority under state law is the personal representative; the three exceptions in 164.502(g)(3)(i), quoted; the state-law provisions the practice relies on for minor consent and parental access, cited by section, with the date they were last checked; the rule that any request touching exception care goes to a licensed professional; the chart-flagging procedure for minor-consented services; the 164.510(b) involved-person pathway and who may use it; the identity and authority verification steps; the portal proxy cutoff at eighteen or emancipation; and where each decision is documented. Then train the front desk on it, using the scenario at the top of this post, because that scenario is the whole reason the section exists. The related patient rights are summarized in the patient rights guide, and front-desk handling generally is in the front desk rules post.
---
FAQ
Can parents always access their minor child's medical records under HIPAA?
Usually, as the personal representative under 45 CFR 164.502(g)(3). Not for care the minor consented to alone under state law, care the minor could lawfully obtain without parental consent, or care the parent agreed to keep confidential, and state law then controls what the parent may see.
Does HIPAA set an age at which minors control their own records?
No. HIPAA defers to state law on who may consent to care and whether parents may be told. The practice must know its own state's rules and cite them in policy.
What if state law says nothing about parental access?
164.502(g)(3)(ii)(C) applies: a licensed health care professional decides, in the exercise of professional judgment, whether to provide or deny access, and the decision is documented.
Can we tell a parent anything about care the minor consented to alone?
Possibly, under 45 CFR 164.510(b), limited to information relevant to the parent's involvement in the minor's care, with the minor's agreement or a professional's reasonable inference of no objection, and only where state law does not prohibit it.
What happens to a parent's access when the patient turns 18?
The parent is a personal representative only if state law gives them authority to act for the adult patient (164.502(g)(2)). Cut off proxy portal access at eighteen and require the adult patient's own authorization.
Conclusion
The minors section of a privacy policy is the one most practices copy from a template without checking their own state, and it is the one a complaint tests first. One Guy Consulting's Full-Scope plan includes the personal representative and access policies, the front desk verification procedure, and consulting time to map your state's minor-consent provisions into them. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.502 (personal representatives, paragraph (g))
- 45 CFR 164.524 (right of access)
- 45 CFR 164.510 (disclosures to persons involved in the individual's care)
- 45 CFR 164.514 (verification requirements, paragraph (h))
- 45 CFR 164.508 (authorization signed by a personal representative)
- 45 CFR 160.203 (preemption of state law)
- HHS OCR, Personal Representatives guidance
Related Reading