The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has released a “Dear Colleague” notice telling HIPAA-covered entities about their responsibilities under the HIPAA Privacy Law to give parents a complete copy of their minor children’s health data. OCR mentioned it has learned about instances when parents of minor kids were refused access to their children’s healthcare data to the degree mandated by the HIPAA Privacy Law.
The HIPAA Privacy Law honors the rights of patients regarding their protected health information (PHI). Individuals, or their representatives, should get a copy of their health data and other PHI in a specified file upon request. A similar right is applicable to the minor children’s parents or legal guardians.
OCR explained in the Dear Colleague letter that, in case of applicable law, a father or mother, guardian, or any individual acting in loco parentis has the power to decide on behalf of someone who is an underage minor with regard to health care, a regulated entity should deal with such individual as a personal representative.
Parents normally can decide about the healthcare of their minor children and are usually regarded as the personal spokespersons of their underage children. Therefore, a parent could exercise their young child’s right to request a copy of their PHI as per the HIPAA Privacy Law, with the exception of a few instances.
OCR mentioned that there are just three exceptions when a parent isn’t deemed as the personal rep of their minor child. In case these instances are applicable, then giving the parent access to their minor child’s PHI is not allowed and may mean a HIPAA violation. All three scenarios generally apply solely to minimal types of medical care services, for instance, mental health care.
If the child agrees to health care, and the permission of the parent isn’t necessary according to the state or other appropriate legislation.
If the child receives medical care as directed by a court, or an individual designated by the court.
In these two cases, the parent isn’t deemed as the child’s personal representative regarding that particular health care.
If the parent concurs that the child and the medical care provider have a private relationship
OCR stated that in this scenario, the extent of the parental agreement to the private relationship decides the extent to which the parent is regarded as the child’s personal representative with regard to the PHI kept by the medical care provider.
A healthcare company may decide not to give a parent a copy of some or all medical records or other PHI of the minor child if, in their expert opinion, the child might have been the victim of neglect, physical violence, or abuse, or in case of treating the parent as the personal representative of the child, could put the child at risk. In such instances, a personalized, patient-specific expert decision is necessary.
The letter was given in reply to an OCR’s investigation after receiving a complaint about the illegal vaccination of a child with a government-provided vaccine by a Midwestern school, without the consent of the parents, by disregarding a religious exemption filed under state legislation.
HHS Secretary Robert F. Kennedy, Jr. stated that any time providers disregard parental permission, violate mandates of vaccine exemptions, or do not inform parents about their children’s treatment, OCR will take action to defend families and regain accountability.
OCR likewise directed the Health Resources and Services Administration (HRSA) to include a new grant prerequisite. All recipients need to follow all applicable government and state parental-authorization laws for any care or services offered to minors at HRSA-recognized health centers as a condition of getting Health Center Program finances.
HRSA will advise all health centers that get grants about their responsibilities. Particularly, any HRSA-funded health center providing a minor with dental, medical, behavioral health, or any health service must get parent or legal guardian permission according to pertinent state or government law. This requirement applies to all types of care, such as counseling, treatment, preventive services, and services involving sensitive issues like reproductive health or sexual identity.