Technical Assistance Services Center

December 1, 2004

Q&A by Susan Stefan

Center for Public Representation

What right does a minor have under HIPAA to claim his or her own privilege to deny access to records under HIPAA? If the minor does not want parents or others to have access to his or her records, can the provider refuse to provide the records to the parents?

The short answer to this question is that if the health care provider or facility concurs with the minor that the parents should not have access to his or her treatment records, the minor has a good chance of precluding parents from access to the records or granting access to others. However, if the facility or provider does not concur, the minor’s chances of precluding such access are minimal. This is the short answer; the route to this answer is longer and more circuitous.

I. The Language of the Regulations

The rights of parents to authorize access to their children’s protected health information are covered in the section of HIPAA regulations governing the rights of “personal representatives,” 45 C.F.R. 164.502(g). A “personal representative” is a person authorized under applicable law (presumably state law) to make health care decisions on an individual’s behalf. (Thus, an attorney is not ordinarily a “personal representative” under HIPAA). In general, a covered entity must accord a personal representative the same rights as would be accorded the individual with regard to access to records, 45 C.F.R. 164.502(g)(2). In most cases parents (or guardians or those acting in loco parentis) will be considered personal representatives of a minor or unemancipated child, and therefore, in most cases, parents can exercise the right of access to the medical record on the child’s behalf. 45 C.F.R. 164.502(g)(3).

However, there are a number of exceptions to this general rule, which may be particularly applicable in the mental health setting, depending on your state’s law.

A. Minor’s Right to Seek Independent Treatment

First, the regulations permit the minor to exercise control over his or her own records if, under applicable state law, he or she did obtain or could obtain the health care for which the records are being sought without the requirement of parental consent, and if the minor did not ask for the parent to be treated as a personal representative, 45 C.F.R. 502(g)(3)(i). Thus, if state law permits a minor to seek mental health treatment without parental authority, the minor can exclude parents from seeing his or her records and from authorizing access to the minor’s records. This is true even if the parents have consented to the treatment. If the minor could have legally received the treatment solely on the basis of his or her consent, the fact that the parents did consent to the treatment does not necessarily entitle them to see or authorize access to the records, id..

In good legal fashion, there is an exception to this exception. If explicit state law (including case law) permits or precludes disclosure of protected health information about a minor to a parent, guardian or other person acting in loco parentis, then HIPAA defers to the state law, 45 C.F.R.(g)(3)(ii)(A) and (B). However, it is also true that if state law explicitly prohibits parental access, HIPAA will not be interpreted to thwart this protection of the child’s privacy, id.

B. Professional Judgment that Parents Should Not be Allowed Access to the Records

If there is no applicable state law about the rights of parents to the protected health information of their children, then HIPAA regulations permit the covered entity (the doctor or health care facility) to provide or deny access to the records, as long as the decision is “made by a licensed health care professional, in the exercise of professional judgment.” 45 C.F.R. 164.502(g)(3)(ii)(C).

C. Parental Abuse, Neglect, or Endangerment

Regardless of the applicable state law, if the covered entity has “a reasonable belief” that the personal representative may be abusing or neglecting the individual, or subjecting him or her to domestic violence; or that treating the parent as the personal representative could endanger the individual, or (most broadly of all) if the covered entity “in the exercise of professional judgment” decides that it is not in the “best interest of the individual to treat the person as the individual’s personal representative,” the provider may refuse to provide the records, 45 C.F.R. 502(g)(5).

II. Interpretive Guidelines

This section of the HIPAA regulations was one of the ones that was most substantially altered by the Bush administration’s reconsideration of the Clinton administration HIPAA regulations. The changes made by the Bush administration were explicitly intended to strengthen parents’ rights, states rights, and professional rights, see Comments, 67 Fed. Reg. No. 157, 53199 (August 14, 2002). In making the amendments, the Department noted that there were three goals with respect to the parents and minors provisions of the Privacy Rule. First, the rule seeks to balance parents’ rights to access to health information about their children in order to make important health care decisions about them with the minors’ ability to “consent to and obtain health care under State and applicable law.” Id. at 53200. Second, the provisions attempt to not interfere with State or other applicable laws related to parental rights. Third., “the Department does not want to interfere with the professional requirements of State medical boards or other ethical codes of health care providers with respect to confidentiality of health information or with the health care practices of such providers with respect to adolescent health care.” Id.

Of course, these goals are not necessarily always congruent. For example, the changes to “assure that parents have appropriate access to health information about their children,” were generally opposed by health care providers, who were concerned that the changes would “decrease the willingness of adolescents to obtain necessary health care for sensitive types of health care services.” The Bush administration felt that the appropriate balancing for these concerns would be accomplished by leaving as much as possible to be determined by state law in this area. Id. at 53202.

The Department also announced that to meet the above goals, it would continue to defer to State laws and professional standards with respect to parents and minors. Id. This was especially true when State law was silent or unclear, at which point the Department “attempted to create standards, implementation specifications, and requirements that are consistent with such state laws and that permit States the discretion to continue to define the rights of parents and minors with respect to health information without interference from the Federal Privacy Rule.” Id.

There were two primary changes made by the Bush administration to the Clinton administration’s regulations concerning parents and minors, in areas where the Department felt that the standards “did not operate as intended and did not adequately defer to State or other applicable law with respect to parents and minors.” Id.. Thus, both changes reflect the policy that state law should be deferred to when decisions relating to disclosure or access to minor’s health records are made.

First, language was added to make it clear that nothing in the provision would prevent the disclosure of health information about a minor to a parent “if, and to the extent that, State or other law permits or requires such disclosure.” Id. at 53201. Specifically, the Department wanted to “make it clear that State and other applicable law governs not only when a State explicitly addresses disclosure of protected health information to a parent but also when such law provides discretion to a provider.” Id. at 53200. In order to accomplish this, relevant language about the disclosure of health information was moved to the standards regarding parents and minors (see § 164.502 (g)(3)).

Second, language was included that assured that “State or other applicable law governs when the law explicitly requires, permits, or prohibits access to protected health information about a minor to a parent.” Id. at 53201. In order to accomplish this, the Department added a new paragraph (iii) to § 164.502(g)(3) to “establish a neutral policy regarding the right of access of a parent to health information about his or her minor child under § 164.524, in the rare circumstance in which the parent is technically not the personal representative of his or her minor child under the Privacy Rule.” Id.. at 53200. Again, this policy changed was effectuated in order to help ensure deference to State law, as the regulations note that it would apply particularly when State law is silent or unclear. Id. The Department noted that this specific amendment would not apply in the majority of cases, as “typically, the parent will be the personal representative of his or her minor child and will have a right of access to the medical records of his or her minor children under the Privacy Rule.” Id. at 53201.

III. State Laws: The Ambiguity of “Deference” to Conflicting State Laws

The regulations and interpretive guidelines refer to “state law” as though each state either has uniform state guidelines or is silent on the subject of parental access to children’s health records. In fact, a plethora of “state law,” often conflicting, governs parental access to their minor children’s mental health records in most states. First, many states contain confidentiality requirements in their state mental hygiene statutes, e.g. Tx Health and Safety Code 611.004 and 611.0045 (2003). Second, many states have statutes requiring mental health professionals, including psychiatrists, psychologists, and social workers, to maintain their patients’ confidentiality, e.g. Fla.Stat. 490.0147 (2004). Ct. Code 52-146 (2003). Finally, most states have statutes giving both parents a right of access to a child’s medical records after a divorce, e.g. Minn.Stat. 518.17(3)(b), Ct.Code 46b-56(e) (2003).

Ironically for the promoters of “family values,” the most extensive access to a child’s medical records explicitly given to a parent by state statute is often given in statutes relating to the rights of divorced parents. The Texas Supreme Court found it necessary to hold that it could not have been the Texas Legislature’s intention to give divorced parents a greater right of access to their children’s medical records than parents who remained married, Abrams v. Jones, 35 SW3d 620 (Tx. 2000)(holding that the Health and Safety Code limitations on parental right of access to minors’ mental health records trumped other statutory provisions giving divorced parents apparently unrestricted rights of access to their children’s medical records).

However, even in states with statutes granting divorced parents access to their children’s medical records, courts tend to override or ignore these statutes when a mental health professional testifies that parental access to the records would not be in the best interests of the child. A child’s chances at blocking his parents’ access to his or her records increases even more if the records sought are specifically records maintained by mental health professionals of treatment sessions. First, most states have confidentiality statutes prohibiting mental health professionals from disclosing such records without the client’s permission, and few of those statutes contain exceptions for the age of the client. Second, the mental health professional tends to side with the child in these cases, and refuse disclosure, so that the parent’s claim is against the mental health professional. Courts tend to side with the professional in these cases, Clatterbuck v. Clatterbuck, 2002 Va.App.LEXIS 728 (Va.App. Dec. 10, 2002); L.C.S. v. S.A.S., 19 Va.App. 709, 724 (Va.App. 1995).

In some cases, if the child has good legal representation, or a court-appointed guardian ad litem, the court rules for the child based on his or her rights to refuse to disclose the material, see, e.g. Attorney Ad Litem for D.K. v. Parents of D.K., 780 So.2d 301 (Fla.4^th D.C.A. 2001)., Sheiman v. Sheiman, 72 Conn.App. 193, 194 (Conn.App. 2002). Despite the clear and mandatory language of many state statutes granting parents in a divorce proceeding the right of access to their children’s medical records, judges have shown themselves skeptical that the request for access is truly “for the benefit of the child,” and willing to turn down the parents’ request if the mental health professional opposes release, Abrams v. Jones, 35 SW3d 620 (Tx. 2000)(but see In re Marriage of Folise 54 P.3d 222 (Wash.App. 2002), holding that mental health facility did not have standing to contest application of parents for access to records, even though application was made in the context of a divorce proceeding).

IV. Other Federal Statutes Restricting Release of Records

If the child has received treatment for alcohol abuse or substance abuse, 42 U.S.C. 290dd (2003) may prevent the facility from releasing treatment records to the child’s parents. This federal statute contains extremely strict confidentiality protections for treatment at facilities meeting certain federal statutory definitions.

V. Conclusion

Ultimately, attorneys seeking to protect the confidentiality of their minor clients’ mental health records should cast such attempts in the framework of state law requiring mental health professionals to maintain confidentiality and “the best interests of the child,” rather than framing the dispute as a matter of the child’s rights, under HIPAA or any other law.