Who has the right to consent or the right to request restrictions with respect to whether a covered entity may electronically exchange a minor’s protected health information to or through a health information organization (HIO)?

As with a minor’s paper medical record, generally a parent, guardian, or other person acting in loco parentis with legal authority to make health care decisions on behalf of the minor is the personal representative of the minor under the HIPAA Privacy Rule and, thus, is able to exercise all of the HIPAA rights with respect to the minor’s health information. Thus, a parent, guardian, or other person acting in loco parentis who is a personal representative would be able to consent to, if the covered entity has adopted a consent process under the Privacy Rule, or to request restrictions on, disclosures of the minor’s health information to or through a HIO for treatment or other certain purposes. However, there are a few exceptions when the parent, guardian, or other person acting in loco parentis is not the personal representative of the minor child, such as:

(1) when State or other law does not require the consent of a parent or other person before a minor can obtain a particular health care service, and the minor consents to the health care service;

(2) when a court determines or other law authorizes someone other than the parent, guardian, or person acting in loco parentis to make treatment decisions for a minor; and

(3) when a parent, guardian, or person acting in loco parentis agrees to a confidential relationship between the minor and a health care provider. In such cases, it is only the minor, and not the parent(s), who may exercise the HIPAA rights with respect to the minor’s health information.

Created 12/15/08