Very frequently we are asked who may access information contained in minor patients' medical records, and to whom such information may be disclosed. State statutes, regulations, and case law typically address when disclosure or access to the health information of a minor child is required, permitted, or prohibited, and the HIPAA Privacy Rule defers to state laws in this regard, but several general rules apply.
Most states allow minor patients to consent to medical treatment—and, accordingly, to authorize release of medical record information of such treatment—when seeking services for prevention, diagnosis, and treatment of venereal diseases, pregnancy, abuse of controlled substances or alcohol, or emotional disturbances. However, if a parent, legally appointed guardian, or person standing in loco parentis of a minor (any of which is referred to as a "personal representative" in the Privacy Rule) has consented to any of the above treatments for the minor, the personal representative is entitled to access and authorize release of this information. The exception to this is when a minor receives outpatient treatment for drug or alcohol abuse; in this situation, even if the personal representative has consented to such treatment, he or she is denied access and authority to release information unless the minor also provides authorization. Additionally, if a personal representative agrees to a confidential relationship between a minor and a health care provider about any type of treatment (which frequently arises in the mental health context), then the personal representative may not access or authorize release of information about such treatment.
Minors also may consent to treatment and release of information if they have been emancipated by marriage or when they have been emancipated by court decree. In addition, most states allow minor patients to consent to treatment in emergency circumstances, although personal representatives have the right to access and consent to release of information about that treatment. Unless a minor is a Medicaid beneficiary or is requesting services at the emergency department, however, providers are under no obligation to treat an unaccompanied minor, even if the minor is an established patient.
A health care provider may deny a minor's parents access to a minor's health care information if the patient has been or may be the subject of domestic violence, abuse, or neglect by the parent, or if treating the parent as a personal representative could otherwise endanger the minor patient. The health care provider must exercise his or her professional judgment in making such a determination. In addition, if a minor is adopted, his or her birth parents' parental rights have been terminated, so the biological parents may not access the minor's medical records without a court order or consent of the adoptive parents.
Apart from the above noted exceptions, a minor patient's personal representative generally must consent to treatment and authorize the release of information regarding such treatment on behalf of the minor. If the minor's parents are legally separated or divorced, either parent, regardless of which parent has custody, may access or authorize release of the minor's medical records absent a court order to the contrary. Foster parents should provide documentation certifying that they are the foster parents, and they must have authorization from the appropriate state agency in order to access or authorize release of medical records of minor children. Step-parents generally may not access or authorize the release of a minor patient's medical records without the consent of a biological (or adoptive) parent. If questions arise as to an individual's authority to act as the minor patient's personal representative, legal counsel should be consulted.