HIPAA Compliance for Pediatric Practices

Advanced HIPAA guide for pediatric practices covering minor rights, parental access, adolescent privacy, and school records.

HIPAA and Minors: Understanding the Framework

Pediatric practices operate within one of the most complex areas of HIPAA compliance. The intersection of parental rights, minor privacy, state law variations, and evolving patient autonomy creates challenges that no other healthcare specialty faces to the same degree. Every pediatric provider must develop a nuanced understanding of how HIPAA applies to patients under 18.

Under HIPAA, a minor's health information is protected just like an adult's. However, the rules governing who can access that information — and under what circumstances — involve additional layers of complexity. The foundational concept is the personal representative rule (45 CFR § 164.502(g)), which generally grants parents the same rights regarding their minor child's PHI that the child would have if the child were an adult.

Core Principles

• Parents are generally personal representatives of their minor children for HIPAA purposes
• State law plays a critical role — HIPAA defers to state law in many situations involving minors
• Exceptions exist where parents do NOT have access to a minor's records
• The minor's age and maturity may affect their rights under state law
• Evolving capacity means a child's HIPAA rights may change as they grow and approach adulthood

Who Is a Personal Representative?

Under 45 CFR § 164.502(g)(3), a parent, guardian, or other person acting in loco parentis is generally the personal representative of an unemancipated minor, with authority to exercise the minor's HIPAA rights. This means parents can typically:

• Access their minor child's medical records
• Authorize disclosures of their child's PHI
• Request amendments to their child's records
• File complaints about privacy violations on behalf of their child

However, HIPAA provides three important exceptions to this general rule, which are discussed in detail below.

Parental Access Rights: When Parents Can and Cannot Access Records

When Parents CAN Access Records

In most situations, parents have full access to their minor child's medical records. This includes:

• Routine pediatric care: Well-child visits, immunizations, acute illness visits, chronic disease management
• Surgical and procedural records: Pre-operative evaluations, surgical notes, post-operative care
• Diagnostic testing: Lab results, imaging reports, developmental assessments
• Hospitalization records: Inpatient and emergency department records
• Prescription information: Medications prescribed and dispensing records

When Parents CANNOT Access Records (HIPAA Exceptions)

HIPAA identifies three situations where a parent is NOT the personal representative and does NOT have automatic access to the minor's records (45 CFR § 164.502(g)(3)(i)):

Exception 1: The minor consents to treatment and parental consent is not required under state law

• When state law allows a minor to consent to their own treatment (e.g., sexual health services, mental health treatment, substance abuse treatment), and the minor has done so, the parent does not have automatic access to those records
• The minor effectively becomes their own personal representative for that specific treatment

Exception 2: The minor obtains care at the direction of a court or a person appointed by the court

• When a court authorizes treatment for a minor, the parent may not have access rights depending on the court's order
• This commonly occurs in foster care situations, juvenile justice proceedings, or custody disputes where the court limits parental access

Exception 3: The parent agrees that the minor and the provider may have a confidential relationship

• If a parent agrees that certain communications between the minor and provider will be confidential, the parent has effectively waived their access rights for that information
• This may occur when a parent brings a teen to counseling and agrees the therapy sessions will be confidential

When State Law is Silent

When state law does not specifically address parental access to a particular type of minor's health information, HIPAA allows the covered entity to exercise professional judgment to determine whether to grant or deny parental access (45 CFR § 164.502(g)(3)(ii)(C)). This is a significant responsibility:

• Document the basis for your professional judgment decision
• Consider the best interest of the minor
• Consult with legal counsel when uncertain
• Apply consistent standards across your practice
• Note that this discretion applies only when state law is genuinely silent — not when state law clearly grants or denies access

Adolescent Privacy: Sensitive Health Services

As children reach adolescence, their privacy needs become more complex. Many states grant minors the right to consent to treatment for certain sensitive health services without parental involvement. When a minor has the legal right to consent, HIPAA's exception to parental access typically applies.

Reproductive and Sexual Health

Many states allow minors to consent to:

• Contraceptive services
• STI testing and treatment
• Pregnancy-related care
• Sexual assault examination and treatment

HIPAA implications:

• If state law allows the minor to consent to these services, the minor controls access to the related records
• Do not disclose these records to parents without the minor's authorization
• Be cautious with billing — Explanation of Benefits (EOBs) sent to the primary policyholder may inadvertently reveal services. Work with insurance companies on confidential billing when possible
• Document the minor's consent and the legal basis for confidentiality

Mental Health Services

Many states allow minors (typically adolescents age 12-16+, varying by state) to consent to:

• Outpatient mental health counseling
• Crisis intervention
• Inpatient mental health treatment (in some states, with limitations)

HIPAA implications:

• Records from mental health treatment the minor consented to independently are subject to the HIPAA exception
• General mental health records vs. psychotherapy notes distinctions apply (see our Mental Health guide)
• Coordination with parents may be clinically desirable but legally restricted — discuss with the minor and seek their agreement before involving parents
• Document all decisions about parental disclosure carefully

Substance Abuse Treatment

Federal and state laws provide strong protections for minor substance abuse treatment records:

• 42 CFR Part 2 provides additional protections for substance use disorder treatment records, beyond HIPAA
• Many states allow minors to consent to substance abuse treatment independently
• Records from substance abuse treatment generally cannot be disclosed to parents without the minor's consent
• These protections persist even if the minor is covered under a parent's insurance
• Violations of 42 CFR Part 2 carry separate penalties

Balancing Confidentiality and Safety

Pediatric providers must balance adolescent confidentiality with safety concerns:

• Mandatory reporting obligations (child abuse, neglect, danger to self or others) override confidentiality protections
• Imminent danger exceptions — if a minor is at immediate risk of harm, disclosure to parents may be permitted or required
• Document your clinical reasoning when making disclosure decisions
• Consult with ethics committees or legal counsel for difficult cases
• Establish clear practice policies for handling these situations

State Law Variations for Minors

HIPAA explicitly defers to state law when state law provides greater protection for the minor's privacy or when state law specifically addresses parental access to minor's health information (45 CFR § 160.203). This creates a patchwork of rules that pediatric practices must navigate.

Common State Law Variations

• Age of consent for medical treatment: Varies from 12 to 18 depending on the state and the type of service
• Emancipated minor definitions: States define emancipation differently (marriage, military service, court order, financial independence)
• Mature minor doctrines: Some states recognize that minors who demonstrate sufficient maturity may consent to their own care, regardless of specific statutory authority
• Mental health consent ages: Range from 12 to 16 depending on the state
• Reproductive health access: Varies significantly, with some states allowing minors to consent to all reproductive health services and others restricting access
• Substance abuse treatment consent: Most states allow minors to consent, but the minimum age varies

Compliance Strategies

• Research and document the laws of every state in which your practice operates
• Create reference guides for clinical staff summarizing minor consent and access rules
• Update these guides whenever state laws change
• Train all staff on the applicable state laws
• When in doubt about a specific situation, consult legal counsel before making a disclosure decision
• If you practice in multiple states (e.g., telemedicine), know the rules for each state

School and Daycare Record Requests

Pediatric practices frequently receive requests for health information from schools and daycare centers. These requests must be handled in compliance with HIPAA.

Types of School Requests

• Immunization records: Required for school enrollment in most states
• Physical examination forms: Required for school entry, sports participation, or camp attendance
• Medication authorization forms: For administering medications during school hours
• Allergy and emergency action plans: For managing allergic reactions or chronic conditions at school
• Behavioral and developmental assessments: For educational planning or accommodations
• Absence verification: Confirming medical reasons for school absence

HIPAA Requirements for School Disclosures

General rule: Schools are not covered entities under HIPAA (they operate under FERPA — the Family Educational Rights and Privacy Act). Disclosing PHI to schools requires:

• Parent or guardian authorization: A signed HIPAA authorization from the parent or guardian (or the minor if they are their own personal representative for the relevant information)
• Minimum necessary standard: Provide only the information specifically requested and necessary for the school's purpose
• Proper authorization form: The authorization must meet 45 CFR § 164.508 requirements

Exception for immunization records: HIPAA provides a specific exception allowing covered entities to disclose proof of immunization to schools where state law requires immunization for enrollment, with only informal agreement from the parent or guardian (45 CFR § 164.512(b)(1)(vi)). This agreement can be verbal and does not need to be a full HIPAA authorization.

Best Practices for School Record Requests

• Verify the identity and authority of the person making the request
• Obtain proper authorization before releasing records
• Use standardized forms specific to the type of request (sports physical, school entry, etc.)
• Do not include more clinical information than is necessary — a school physical form does not need to include the child's entire medical history
• Document all disclosures to schools in the patient's record
• Train front desk staff on proper procedures for handling school record requests

Immunization Records Sharing

Immunization records represent one of the most commonly shared types of pediatric health information. Multiple parties may request immunization data, and each has different rules.

State Immunization Information Systems (IIS)

Most states maintain immunization registries (also called IIS). HIPAA permits reporting immunization information to public health authorities (45 CFR § 164.512(b)):

• Reporting to state immunization registries is generally permitted without patient authorization
• However, some states require parental opt-in or opt-out for registry participation
• Know your state's specific requirements for immunization registry reporting
• Ensure data submitted to registries is transmitted securely

Sharing with Other Healthcare Providers

• Immunization records may be shared with other healthcare providers for treatment purposes under the treatment exception (45 CFR § 164.506)
• When patients transfer to a new pediatrician, immunization records should be included in the transferred records
• Use secure methods for transmitting immunization records between providers

Sharing with Schools (as discussed above)

• The HIPAA exception for school immunization disclosures simplifies this common request
• Obtain informal parental agreement (can be verbal or written)
• Provide only the immunization records, not additional medical information

Custody Disputes and Record Access

Custody disputes create some of the most challenging HIPAA situations for pediatric practices. When parents are separated or divorced, access to a child's medical records can become a contentious issue.

General Principles

• Both parents generally have access to their minor child's medical records, even if they are divorced or separated, unless a court order specifically limits one parent's access
• Court orders take precedence: If a court order restricts a parent's access to medical records, you must comply with the order
• Custody agreements: Review custody agreements carefully — they may address medical decision-making and record access
• Request documentation: Ask for copies of custody orders, parental agreements, or court orders that affect medical decision-making

Practical Guidance

• Request and file copies of custody and court orders at the first opportunity
• Clearly document in the patient's record which parent(s) have authority to access records and make medical decisions
• If there is no court order restricting access, provide records to either parent upon request
• If one parent objects to the other parent's access, explain that both parents generally have rights and suggest they resolve the dispute through the legal system
• Do not take sides in custody disputes — apply the law consistently
• Consult legal counsel when presented with conflicting court orders or ambiguous custody situations

Avoiding Common Pitfalls

• Do not accept a verbal claim from one parent that the other parent is restricted from access — require written court orders
• Do not refuse access to a biological parent based solely on a stepparent's or significant other's request
• Do not provide records to non-parent relatives (grandparents, aunts, uncles) without a valid authorization or court order establishing their authority
• Document all custody-related record access decisions and the basis for each decision

Minor Turning 18: Transition of Rights

When a pediatric patient turns 18, a significant legal shift occurs. Under HIPAA, the now-adult patient assumes full control over their own health information. This transition must be managed carefully.

What Changes at Age 18

• Parents lose personal representative status (unless the adult child grants them access or the parent becomes a legal guardian due to the child's incapacity)
• The patient controls access: Only the patient can authorize access to their records, request amendments, or make privacy decisions
• Existing authorizations may expire: Review any existing authorizations signed by parents — they may need to be re-executed by the now-adult patient
• Communication preferences change: The practice must direct communications to the patient, not the parents, unless the patient authorizes parental involvement

Managing the Transition

• Flag records for patients approaching their 18th birthday to ensure timely transition planning
• Educate families in advance about the change in access rights
• Obtain new consent and authorization forms from the patient at or after their 18th birthday
• Update contact information to reflect the patient's preferences
• Discuss parental involvement: Many young adults still want their parents involved in their healthcare. Facilitate this by having the patient sign an authorization permitting parental access to the extent they desire
• Patient portal access: Transfer portal credentials from parent accounts to patient accounts
• Billing considerations: If the patient remains on a parent's insurance, the EOBs may still go to the primary policyholder. Discuss this with the patient and explore confidential billing options if needed

Special Situations

• Patients with disabilities: If a minor turning 18 has a cognitive or mental disability that prevents them from making their own healthcare decisions, the parents may need to obtain legal guardianship or healthcare power of attorney to continue serving as personal representatives
• College students: Turning 18 while living away at college does not change the rules — the student has full HIPAA rights regardless of where they live or who pays for their insurance
• Military service: Minors who enter military service may have specific rules regarding medical records — consult military regulations as applicable

Pediatric Telehealth

Telehealth for pediatric patients introduces additional HIPAA considerations, particularly regarding parental involvement and minor privacy.

Parental Presence During Telehealth Visits

• For young children, a parent or guardian will typically need to be present during the telehealth visit
• For adolescents, consider whether a portion of the visit should be conducted with the teen alone (consistent with your in-office practice)
• Discuss and document parental involvement preferences at the beginning of telehealth relationships
• Be aware that parents may be listening even when the teen appears to be alone — address this sensitively

Platform and Security Requirements

• Use HIPAA-compliant telehealth platforms with signed BAAs
• Ensure the platform supports authentication appropriate for the patient's age and the parent's role
• For adolescent patients, consider whether the patient should have their own portal access or whether it should be through the parent's account (considering the privacy issues discussed above)
• Document informed consent for telehealth from the parent or guardian (and from the minor, when applicable)

State Licensing and Privacy Law Considerations

• If you provide telehealth across state lines, you must comply with the minor consent and access laws of the state where the patient is located
• Different states may have different rules about parental involvement in telehealth versus in-person visits
• Document the patient's location at each telehealth visit

Staff Training for Pediatric-Specific Issues

All staff in a pediatric practice must understand the unique HIPAA considerations that apply to minor patients.

Training Topics

All staff:

• Understanding personal representative rules for minors
• When parents can and cannot access records
• How to verify parental or guardian authority
• Handling custody disputes and court orders
• Managing the transition when patients turn 18
• Immunization record sharing rules
• School and daycare record request procedures
• State-specific minor consent laws

Clinical staff (physicians, NPs, PAs, nurses):

• Adolescent privacy and confidential services
• Balancing confidentiality with safety (mandatory reporting, imminent danger)
• Professional judgment decisions when state law is silent
• Documenting consent and access decisions
• Telehealth-specific pediatric considerations
• Coordination of care involving minor patients

Front desk and administrative staff:

• Verifying parental authority before releasing records
• Handling record requests from schools, daycares, and courts
• Managing dual-parent access in custody situations
• Processing requests when patients turn 18
• Phone and communication protocols for minor patients
• Insurance and billing considerations for confidential services

Training Documentation

• Document all training sessions with dates, topics, and attendees
• Require signed acknowledgments from all trained staff
• Conduct annual refresher training with updates on state law changes
• Provide additional training when new scenarios arise
• Retain all training documentation for at least six years

How HIPAA Agent Helps Pediatric Practices

HIPAA Agent provides specialized compliance tools for the complexities of pediatric HIPAA:

• Minor access decision tools to help determine parental access rights based on the specific situation and applicable state law
• State law reference database covering minor consent laws, emancipation rules, and parental access provisions across all states
• Custody situation guidance with decision trees for handling record requests during custody disputes
• Age 18 transition checklists to ensure all legal and administrative steps are completed when patients reach adulthood
• School and daycare record request templates with built-in minimum necessary safeguards
• Adolescent privacy assessment tools to evaluate your practice's compliance with confidential service requirements
• Staff training modules with pediatric-specific scenarios, case studies, and quizzes
• Policy templates tailored to pediatric practice operations

Frequently Asked Questions

Can both divorced parents access their child's medical records?

Generally, yes. Both parents typically have the right to access their minor child's medical records unless a court order specifically restricts one parent's access. A custody agreement alone may not be sufficient to restrict access — look for specific court orders addressing medical records. If you receive conflicting instructions from the parents, consult the court documentation and, if necessary, legal counsel.

At what age can a minor consent to their own mental health treatment?

This varies by state. Many states allow minors to consent to outpatient mental health treatment between ages 12 and 16, but the specific age, type of treatment, and any limitations differ significantly. Research your state's specific laws and document the applicable rules for your practice.

Can I share a child's records with their school without parental permission?

For most records, no — you need a signed HIPAA authorization from the parent. The exception is immunization records, which can be shared with schools that require immunization for enrollment with only informal parental agreement (verbal or written). For all other records (physicals, medications, diagnoses), a proper authorization is required.

What happens to parental access when a patient turns 18?

The patient assumes full control of their own PHI. Parents lose their status as personal representatives and can no longer access records, make privacy decisions, or authorize disclosures without the patient's explicit consent. The practice should obtain new authorization forms from the now-adult patient and update all access permissions. If the patient wants continued parental involvement, they should sign an authorization permitting it.

How do I handle a request from a non-custodial grandparent for a child's records?

Grandparents are not automatically personal representatives of their grandchildren under HIPAA. They can only access records if they have a valid, signed authorization from the personal representative (usually the parent or guardian), or if a court order grants them guardianship or legal authority over the child's medical decisions. Without one of these, you must deny the request.

Can an adolescent patient prevent me from telling their parents about substance use?

If the adolescent consented to substance abuse treatment under state law (and many states allow this), you generally cannot disclose the treatment information to parents without the adolescent's consent. However, if the adolescent is in immediate danger (overdose, suicidal ideation), the serious threat exception (45 CFR § 164.512(j)) and mandatory reporting obligations may permit or require disclosure. Document your clinical reasoning for any decision.

Ready to Automate Your Compliance?

HIPAA Agent handles all of this for you automatically.

Related Guides