The HIPAA Privacy Rule expressly covers minors in two distinct ways: (i) it designates parents as the personal representatives of their minor children, and (ii) it permits health plans to disclose PHI about minors (and about other covered dependants) to the subscriber of the health plan. The general rules with respect to each of these areas (and exceptions to the general rules) are discussed below.
The HIPAA Privacy Rule
The HIPAA Privacy Rule provides that when a parent "has authority to act on behalf of an unemancipated minor in making decisions related to health care," the parent is a "personal representative" of that minor. The HIPAA Privacy Rule permits a minor's parents access to the minor's PHI and, absent a court order, other judicial finding, or state law to the contrary, both parents are given this right equally.
In other words, under the HIPAA Privacy Rule parents become their minor's personal representatives in most typical situations, unless an unusual exception applies. Therefore, particularly in the exercise of "individual rights" under the HIPAA Privacy Rule, parents will be permitted to exercise individual rights on behalf of minors by requesting, for example: (i) copies of the minor's PHI in a designated record set, (ii) that PHI in the designated record set be amended; or (iii) that the Plan provide an accounting of certain disclosures of the minor's PHI. Accordingly, in the typical situation, the HIPAA Privacy Rule recognizes the right of both parents — irrespective of their marital or custodial status — to serve as personal representatives of any minor dependants and, in this role, request (or receive) the minor's PHI on the minor's behalf.
Exceptions
The HIPAA Privacy Rule includes several explicit exceptions relating to the treatment of parents as personal representatives of unemancipated minors (i.e., the personal representative privilege). As a general matter, these exceptions apply to any parent — regardless of custodial status. The three exceptions to the personal representative privilege described below in essence provide minors the right to control certain of their own health care related decisions (and, hence, to control the PHI relating to those decisions). As a result, the minor, through this control, is given the right to terminate his/her parents' status as personal representatives with respect to those health care services over which the minor has taken control. Once a parent's right as a personal representative ceases, he/she would not be permitted (by virtue of this status) to obtain the PHI of the minor, or to implement (on the minor's behalf) the minor's individual rights with respect to such PHI (e.g., receive an accounting of certain disclosures). Each of these exceptions is explained below.
A parent will not be treated as the personal representative of an unemancipated minor with respect to health care services to which a court, or other person authorized by law, consents.
To the extent that a court gives permission for a minor to receive medical treatment or the court has appointed a guardian to make such decisions for the minor, the minor's parents will not be "personal representatives" with respect to any health care services consented to by the court, or by the guardian.
A parent will not be treated as the personal representative of an unemancipated minor with respect to health care services to which the minor consents, when no other consent is required by law.
Also derived from authority that might be granted by state law, this exception means that if there is a state law that permits a minor to consent to treatment without the consent of a parent (e.g., receive treatment for drug addiction), then through the integration of state law and the HIPAA Privacy Rule, a parent would not be treated (i.e., a Plan would not be permitted to treat the parent) as a "personal representative" of the minor with regard to drug treatment services. However, those state laws that give minors the right to consent to treatment for medical services often relate only to certain specified health care services (e.g., treatment for drug addiction), rather than to all health care services a minor might wish to obtain. Thus, for medical services outside the scope of those for which minors are permitted to consent, a parent generally would remain the minor's personal representative.
A parent will not be a personal representative to the extent the parent "assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service."
A parent may voluntarily relinquish his/her rights as a personal representative by agreeing to allow confidential communications directly between the minor and the minor's health care provider.