Minors, parents, and who can see an ABA client's records

A parent calls asking for their teenager’s full ABA file. A second parent, separated from the first, calls the same week asking that the file not go to the other parent at all. An RBT doing a home visit gets asked by a grandmother, not a parent, for a summary of how the session went. None of these are edge cases. They are an ordinary week at a clinic that serves minors, and each one has a different right answer.

The default: a parent is the personal representative

HIPAA’s personal representative rule says a covered entity must treat someone with authority, under other law, to make health care decisions for an individual as if they were that individual, for purposes of the Privacy Rule (45 CFR 164.502(g)). For an unemancipated minor, that is ordinarily a parent, guardian, or other person acting in loco parentis. In practice: the parent gets the access rights, the amendment rights, and the disclosure-accounting rights the client would get as an adult, because the parent is standing in for the client.

That is the default. It is not the whole rule.

Three situations where the parent is not automatically in charge

HIPAA carves out three specific situations where a parent is not treated as the minor’s personal representative for a given health care service, because in each one, state or other law has already taken the decision out of the parent’s hands:

The minor lawfully consents on their own, and no one else’s consent is required. If state or other law lets the minor obtain a specific service without a parent’s consent, and the minor consents to it themselves, the parent is not the personal representative for that service, unless the minor asks for the parent to be treated that way.

Someone else authorized by law consents instead. If a court, or another person the law authorizes, consents to the service on the minor’s behalf, that person, not the parent, is standing in for the minor regarding that service.

The parent agrees to confidentiality with the provider. If a parent agrees that the minor and the provider can keep a particular matter confidential between them, the parent has, by that agreement, stepped back from being the personal representative for it.

In each of these, HIPAA itself does not hand the record to the parent. What HIPAA does next is point back to state law.

What HIPAA says about disclosing to the parent anyway

Being outside personal-representative status does not automatically mean a parent is locked out of the record. HIPAA defers to whatever the state actually says: a covered entity may disclose, or give the parent access, to the extent state law permits or requires it, and must not disclose, or give access, to the extent state law prohibits it. Where state law is simply silent on the question, a covered entity has discretion to allow or deny parental access, consistent with whatever state law does say, as long as a licensed health care professional makes that specific call using professional judgment, not a front-desk guess.

“HIPAA tells you who usually speaks for a minor. It does not pretend to settle who speaks for this minor, in this state, in this family”

That three-way structure, state law permits, state law prohibits, or state law is silent and a clinician decides, is the actual rule a clinic is operating under in every one of these calls. HIPAA supplies the structure. The state supplies the answer.

ABA scenarios this actually shows up in

Divorced or separated parents with conflicting requests. This is a custody question first and a HIPAA question second. The starting point is whatever custody order or decree governs decision-making for the child; a parent with sole legal custody or sole authority over health care decisions is the one HIPAA treats as the personal representative, and a parent who was never granted that authority is not entitled to override the other parent’s instructions just by asking. A clinic should have the current custody order on file, not a verbal description of it from one parent.

Guardianship and foster care. A legal guardian, or a child-welfare agency with custody under a court order, generally steps into the personal representative role the same way a parent would, because the authority to make health care decisions, not the biological relationship, is what HIPAA is tracking. Foster placements can change who holds that authority, and when they do, the clinic’s authorized contact needs to change with it, not lag behind it.

Adolescents who can self-consent to some mental or behavioral health care in some states. This scenario is narrower for ABA than it first looks, which is exactly why it is worth naming carefully rather than skipping. A number of states let a minor, at a stated age or under stated conditions, consent on their own to specific categories of outpatient mental or behavioral health care, which is the kind of state law HIPAA’s exceptions point to. These statutes are written for self-consent to counseling, crisis care, or mental health treatment generally. None names ABA or autism services specifically, and many ABA clients are younger than the ages most of them use, but some are not. Where it becomes live is the older adolescent ABA client who is also receiving, or could receive, a separately named service, such as counseling or crisis intervention, under one of these laws. Texas lets a minor consent to counseling for suicide prevention, chemical dependency, or abuse, without a parent’s consent, and separately lets a 16-or-older minor who lives independently and manages their own finances consent to broader treatment. Florida lets a minor age 13 or older in an emotional crisis consent to a limited run of outpatient crisis, diagnostic, and counseling services, capped at two visits a week before parental consent is required for more. Virginia treats a minor as an adult for the limited purpose of consenting to outpatient treatment for mental illness or emotional disturbance, and separately lets the treating clinician withhold the minor’s health records from a parent if disclosure would be reasonably likely to cause the minor substantial harm. California lets a minor age 12 or older consent to outpatient mental health treatment or counseling on their own, where the treating professional judges them mature enough to take part intelligently, and expects the parent or guardian to be involved unless that same professional decides, after consulting the minor, that involvement would be inappropriate. Whether any of these statutes reaches ABA services, for a specific client, in a specific state, is a question for counsel in that state, not an assumption carried over from a neighboring state or from mental health law generally.

A parent demanding records another parent wants withheld. Absent a court order resolving it, this is not a call a front desk should make under pressure on the phone. It is the custody-order question above, arriving in its least convenient form.

An RBT asked for information in the home by a non-parent relative. A grandmother, an adult sibling, or a new partner asking about the session is not a personal representative merely by being present or related. Information may still be shareable with someone involved in the client’s care under HIPAA’s separate provision for that (45 CFR 164.510(b)), but that is a narrower, different basis than treating them as standing in for the client, and it is worth training RBTs to tell the difference rather than answering from politeness.

What a clinic should have in writing

None of the following is a legal requirement by itself; each is a practice worth discussing with counsel and then writing down, so the clinic is not improvising it in the moment:

• Who is currently authorized to receive information about each client, kept current as custody or guardianship changes, not assumed from whoever called last.
• How a custody order or confidentiality agreement changes that authorization, with the actual document on file rather than a summary of what one parent said it says.
• Who makes the access decision when state law is silent and the record falls to professional judgment, named in advance so it is not decided for the first time under pressure.
• How front-desk staff and RBTs are trained to recognize a request from someone who is not a personal representative, and to escalate rather than answer in the moment.

Where state law genuinely varies and this page has not named your state, say so to the family and the staff member asking, and confirm the actual answer with counsel before documents move. A confident wrong answer is worse than an honest pause.