Whether a minor can request medical records begins with HIPAA and often turns on state law. Under the HIPAA Privacy Rule, a covered entity treats a parent, guardian, or person acting in loco parentis as the personal representative of an unemancipated minor when that person has authority under applicable law to make health care decisions for the minor.
That default has three regulatory exceptions and yields to state or other law that expressly permits, requires, or prohibits parental access to a minor's protected health information. The result depends on request validation, consent authority, and the records-access rule governing the service.
This article covers HIPAA personal-representative status, confidential-care carve-outs, mature minor and emancipation rules, authority validation, and state-by-state records-control flags.
When a Parent Is the Personal Representative Under HIPAA
HIPAA defers to state law on who holds health care decision-making power for an unemancipated minor. When state law gives a parent that authority, the HIPAA Privacy Rule generally treats the parent as the personal representative entitled to access the minor's PHI.
Three service-specific conditions remove the parent from that status and vest access in the minor as an individual:
- Minor consents, no other consent required: The minor consents to the service and has not asked that the parent be treated as personal representative.
- Minor may lawfully obtain service without parental consent: The minor, a court, or another authorized person consents to a service the minor may lawfully obtain alone.
- Parent agrees to confidentiality: A parent assents to a confidentiality agreement between the provider and the minor.
Each exception attaches only to the protected health information for the service at issue, not to the entire chart.
Confidential-Care Carve-Outs That Override Parental Access
Four care categories can trigger the carve-out when state law authorizes independent minor consent and does not otherwise permit parental access: reproductive health, mental health, STI and communicable disease, and substance use. Those statutes trigger the 45 C.F.R. § 164.502(g) carve-out for the specific records tied to the service.
STI services are a broad carve-out where state law authorizes independent minor consent. Reproductive health is more fragmented because contraception, pregnancy-related care, and abortion can be governed by separate state rules.
Substance use records carry a second federal layer under the minor-patient rule. Where state law lets a minor consent to treatment alone, only the minor may authorize disclosure; where state law requires parental consent to treatment, both the minor and the parent must consent. The table identifies substance-use minor-consent authority only where a cited or stated authority is provided.
Mature Minor Doctrine and Emancipation Rules
Two legal statuses can shift records access away from the parental default independent of the service-specific carve-outs. The mature minor doctrine permits an unemancipated minor with sufficient maturity to consent to particular treatment, while emancipation is a broader status conferring adult rights generally.
The doctrine exists in common law in Tennessee, West Virginia, and Michigan by case law. In Cardwell v. Bechtol, 724 S.W.2d 739 (Tenn. 1987), the Tennessee Supreme Court held that the mature minor exception is part of the state's common law. In Belcher v. Charleston Area Medical Center, 422 S.E.2d 827 (W. Va. 1992), maturity is treated as a question of fact.
Emancipation produces a broader access rule. Several states grant emancipated minors full medical-consent authority, including California (Fam. Code § 7050(e)(1)). The HIPAA Privacy Rule treats an emancipated minor as the individual for access purposes, and West Virginia bars parental access where the minor is emancipated (W. Va. Code § 16-29-3(b)(2)).
How HIPAA and State Law Control Minor Records Access
The Privacy Rule sets a federal floor. State law controls parental access where HIPAA expressly defers to state law or where state law is more stringent under the preemption definitions and preemption exceptions.
A records department resolves the controlling-law question through three steps:
- Identify a relevant state law on health-information privacy or parental access to minor PHI, which varies considerably by state.
- Apply the "contrary" test: HIPAA preempts if compliance with both is impossible or the state law obstructs HIPAA's objectives, unless a preemption exception applies.
- Apply the minor-parent and "more stringent" tests: state law controls when it expressly permits, requirs, or prohibits parental access to a minor's PHI; state privacy laws granting greater privacy protection or greater individual access rights are not preempted.
The covered entity bears the analysis because HHS does not issue entity-level determinations on whether a state law is more stringent.
Authority Validation and Audit-Risk Documentation
Records departments and law firm intake staff validate a minor's records request by verifying identity and documenting authority before assessing carve-outs, the same discipline that governs a standard records request workflow. The HIPAA Privacy Rule requires reasonable steps to verify identity under 45 C.F.R. § 164.514(h), with no required form.
Authority documentation depends on the claimed role:
- Parent: Birth certificate, adoption record, or paternity acknowledgment.
- Legal guardian: Court-issued guardianship order distinct from a conservatorship.
- Healthcare power-of-attorney agent: The POA document.
- Attorney: A HIPAA-compliant authorization signed by the verified personal representative or the minor where the minor holds independent rights.
When a parent personal representative requests a minor's full chart, carve-out records are segregated before release and withheld where state minor-consent statutes authorized independent consent under 45 C.F.R. § 164.502(g), unless state law otherwise permits or requires parental access. Identifying which categories of records carry these protections is the first step before any release.
Substance use disorder records carry the strictest requirement. 42 C.F.R. pt. 2 requires segregation within the EHR and bars disclosure to a parent without the minor's written consent where the minor had capacity.
Over-disclosure of carve-out records to an unauthorized parent is an impermissible disclosure of PHI and can trigger breach-related notification obligations to HHS and the individual. Delay in releasing the non-carve-out portion implicates the Right of Access, which OCR settlements have enforced.
State-by-State Minor Consent and Records-Control Flags by Care Category
The following table maps cited minor independent-consent authority across three confidential-care categories that can trigger the personal-representative carve-out: mental health, STI and communicable disease, and substance use. Records teams separately check whether state law permits, requires, or prohibits parental access to the PHI for the service.
This table covers the highest-volume records-control categories. N/A indicates that no statute with a verified citation and source was identified for that cell, not necessarily that no authority exists. Reproductive and pregnancy-related care, discussed above as a carve-out category, is governed by separate state-specific rules and is not mapped here.
Key Takeaways for Records-Request Processing
A minor's records request resolves through a service-specific authority analysis. HIPAA installs the parent as personal representative by default, with exceptions that can transfer control to the minor for specific care. 42 C.F.R. pt. 2 adds a federal layer for substance use records, and state law governs parental access where HIPAA defers to a state rule that expressly permits, requires, or prohibits disclosure.
Legal AI tools support this work by organizing medical records, record segregation of sensitive documentation, and defensible chronologies tied to verified release authority across jurisdictions.
