OCR Makes Parental Access to Minor Children’s Medical Records a HIPAA Enforcement Priority
The Director of the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has written a “Dear Colleague” letter to remind HIPAA-covered entities about their obligations under the HIPAA Privacy Rule to provide parents and legal guardians of minor children with the complete medical records of their minor children if they submit a request.
The letter is in response to an investigation by the HHS into an alleged illegal vaccination at an unnamed Midwestern school. The school is alleged to have vaccinated a child without parental consent, having ignored a religious exemption submitted under state law. OCR is seeking to determine whether the school failed to comply with the requirements of the Vaccines for Children Program (VFC). The VFC conditions the provision of vaccines on compliance with state religious and other exemptions from compulsory vaccination.
In the letter, OCR Director Paula M. Stannard said, “OCR has become aware that there may be instances in which the parents of minor children are not receiving access to their children’s medical records to the extent required by the HIPAA Privacy Rule.” Examples provided include a healthcare provider denying a parent or legal guardian access to their minor children’s medical records or seeking consent from the child before any disclosure. Stannard explained that, “If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under [the HIPAA Rules], with respect to [PHI] relevant to such personal representation . . . .”
In most circumstances, a parent is the personal representative of their unemancipated minor child; therefore, the HIPAA Privacy Rule gives the parent the right to access their minor child’s medical records. Stannard explained that there are limited exceptions:
- When the child consents to health care, and the consent of the parent is not required under state or other applicable law.
- When the child obtains health care at the direction of a court, or a person appointed by the court.
- When, and to the extent that, the parent agrees that the child and the health care provider may have a confidential relationship.
The first exception concerns an important right given to children in certain states, often in relation to treatment for a sexually transmitted infection under state minor consent law. The second may apply when a minor child has sought and received court approval for an abortion without parental consent or notification. The third exception may apply when the parent has assented to an agreement of confidentiality between the healthcare provider and the minor, for instance, when an adolescent is seen by a physician who knows the family. In the first two examples, the parent is not considered the personal representative of the child with respect to that specific health care. In the third example, the scope of the parent’s agreement to the confidential relationship determines the degree to which the parent is the child’s personal representative for purposes of PHI maintained by that health care provider.
There is another important exception to the disclosure of a child’s medical records to a parent or legal guardian to ensure that the child is protected, such as in cases where the parent is suspected to be a source of harm. A provider may determine, using their professional judgment, that a child has been subject to domestic violence, abuse, or neglect, and therefore not treat the parent as the child’s personal representative, or if treating the parent as a child’s personal representative could potentially endanger that child. Such cases require an individualized, patient-specific professional determination.
“Providing parents who are their children’s personal representatives with easy access to their children’s PHI empowers parents to be more in control of decisions regarding their children’s health and well-being,” explained Stannard. “OCR is making parental access to children’s medical records an enforcement priority and will use all civil remedies available, including civil money penalties, to ensure compliance with this Privacy Rule requirement.” The Dear Colleague letter (PDF) is available on this link.
