Parents are often deeply involved in their child’s healthcare — scheduling appointments, reviewing records, and making sure they receive the care they need. However, as children grow, privacy laws change, sometimes sooner than expected.
In many states, including California, children as young as 12 can make certain healthcare decisions on their own, which might limit the information parents can access. You might notice changes in the patient portal or find that some medical details are no longer visible. Then the big milestone — they turn 18.
To break down these complex changes, we reached out to Shannon Cogan, attorney and associate executive director for individual rights at Disability Rights California; Deven McGraw, JD, MPH, chief regulatory and privacy officer at Citizen Health; Linda Tirabassi-Mathis, PhD, RN, CPNP, CNS, program director, healthcare transition from pediatric to adult care at Miller Children’s and Women’s Hospital; and Leslie Lobel, director of health plan advocacy services at Undivided.
Many parents are surprised to lose access to parts of their child’s medical records once their child turns 12 — and understandably so. After years of managing appointments and staying involved in their care, it can feel like a sudden shift. But behind this change is a set of privacy laws designed to protect minors as they gain the ability to make certain healthcare decisions independently.
Cogan explains that in California, specific laws allow minors (children under 18) to consent to some medical treatments without parental involvement. And the law allows minors to keep this sensitive healthcare information private. While parents usually have decision-making authority, that’s not always the case. Cogan states, “When a child has the right to consent to medical treatment, then they control the access to the information about that treatment, so they control access to and release of their own health information.” In many cases, this means parents won’t be able to see certain details.
This shift typically begins at age 12, though the exact age varies by state. That’s because age 12 is a legal trigger for many of these consent laws — meaning it’s the point at which minors gain new rights under state law to consent to specific types of care. McGraw explains that these laws exist because some minors might hesitate to seek care if they had to involve their parents. These laws are intended to ensure that young people can seek care without fear of judgment or repercussions, especially for sensitive issues. But the change can still be jarring for families, particularly when electronic health systems limit parental access across the board to stay in compliance.
Understanding privacy laws
In California and many other states, children can legally consent to specific types of care — such as mental health services and substance use treatment — beginning at age 12. When they gain the right to consent, they also gain the right to control who can access related health information. California, for instance, ensures kids can privately discuss sensitive issues with a doctor. Cogan explains that in California, teens have the right to talk privately with a doctor about certain sensitive topics without their parents being notified.
State laws define confidentiality rules for specific types of medical care, including:
While this can create challenges, especially for parents of children who need extra support, access might still be possible in some cases — with the child’s consent or by submitting the appropriate documentation to the provider. Understanding your rights and your child’s privacy protections is the first step in navigating this transition with clarity and confidence.
Many parents don’t realize these privacy laws exist until they suddenly lose access to their child’s medical records. This shift happens when a child turns 12, but the experience can feel abrupt because of how healthcare systems implement these protections.
McGraw explains that patient portals often cannot separate sensitive health information from general medical data. To comply with privacy laws, many healthcare systems take a broad approach by restricting parental access entirely once a child reaches the minimum age of independent consent. Even if a child has not yet sought treatment in a protected category, access might still be affected.
“So that’s why you see parents getting all of a sudden no online access to their teenage or pre-teenage child’s records. It’s because of law that protects the ability to receive confidential care,” McGraw states. McGraw explains the technical and practical reasons why portals cut off access when children turn 12:
McGraw describes the difficulties parents encounter when seeking access to their child’s medical information: “I have had parents come to me when I was a regulator. This used to happen a lot, and they would get very angry with me. And I wasn’t a state regulator, I was a HIPAA regulator, and I would say, ‘Look, the state where your daughter receives care gives her the right to consent to this care all on her own, and that means we protect her privacy rights to ensure that she’s able to get the care that she needs without worrying about the repercussions of telling you.’ Not suggesting that it’s an abusive situation, but kids sometimes cannot fathom disappointing their parents, and we don’t necessarily want them to go without the care that they need because they don’t feel comfortable talking to a parent.”
This shows the core intent behind these privacy laws: ensuring minors receive necessary care without fear of judgment or consequence. It’s a difficult adjustment. Dr. Tirabassi-Mathis acknowledges, “It’s a tough intersection for families because parents expect to be able to have full capacity and understanding of what’s going on with their kids.”
How does HIPAA affect state laws about medical record access?
While these privacy protections vary by state, they also interact with federal regulations. Specifically, the Health Insurance Portability and Accessibility Act, also known as HIPAA, which “establishes federal standards protecting sensitive health information from disclosure without [the] patient’s consent.” In most cases, under HIPAA’s Privacy Rule, “parents are the personal representatives for their minor children. Therefore, in most cases, parents can exercise individual rights, such as access to the medical record, on behalf of their minor children” when access is not inconsistent with state or other law. In certain cases, state laws take precedence.
For example, in California, minors who have the legal right to consent to their own medical treatment also control access to those medical records. This means that even though HIPAA would typically allow a parent to review their child’s health information, California law limits that access in specific cases.
But, as Cogan explains, “Most of us are familiar with attending doctor appointments and having lots of forms to sign. One of those is a HIPAA release. HIPAA is a federal medical records protection statute, and you can just sign a HIPAA release that says, ‘I’d like my mom to have access to this. I’d like my best friend.’ You can delegate anyone that you want.”
Privacy protections are meant to safeguard minors, but they can unintentionally create barriers for parents of children with disabilities. Many patient portals don’t distinguish between general and sensitive medical information, leading to a sudden and complete cutoff at age 12.
Cogan shares her experience: “I’m a parent of someone with a disability, and we noticed that we had full electronic access to our child’s medical information for a while, and then it was restricted in some way, and that’s typically triggered by those laws that provide minor access.”
This loss of access can make it harder for parents to advocate for their child’s healthcare needs, especially when children require ongoing support to manage medical conditions. McGraw explains how these laws can affect children with disabilities and their families in a few different ways:
Your child is a minor and is competent to make medical decisions for some types of care (like mental health, sexual health, or substance use treatment) in your state. In these cases, you might not have access to their medical records or the patient portal with the consent of your child.
Privacy law enforcement differs among healthcare providers due to varying state regulations. Not all healthcare providers implement these privacy rules the same way. Some might allow limited access or provide general updates, while others take a stricter approach. If you’re unsure, contact your child’s healthcare provider to ask about their specific policies. Cogan and McGraw explain how several elements determine how these policies are applied:
Different states, different rules
Because there’s no single law that dictates when parental access must be restricted, healthcare systems operating in multiple states often face conflicting privacy requirements. To simplify compliance and reduce legal risk, providers typically adopt the most restrictive state’s rules as their default, even when those standards aren’t required in every location, according to Cogan.
No one-size-fits-all law
Cogan explains, “There isn’t one law in place that says, ‘Hey, doctors, you need to shut off all parental access right at 12.’ It depends on what the treatment is about, and sometimes ages are different in the law.” But since it’s hard for healthcare providers to separate sensitive info from the rest, they often block all access to be safe and stay within legal boundaries.
Business practices and provider size matter
Smaller or state-specific providers might have more flexibility. Some California-based providers don’t cut off access automatically but instead discuss changes with families first. However, Cogan states that Kaiser is “pretty serious about” this policy and “immediately cuts off access at 12” after sending a notice. Cogan adds that there are other providers that don’t do that and instead might have conversations with parents so they have a little more notice. “I think the best practice for a provider is to have discussions with their patients and their parents leading up to those age cutoffs, and then to send a letter or a notice that describes what the change is going to be and how it will affect their office procedures so people know going in, and they know what they can do just to maintain access if that’s what their child wants.”
Technical and administrative capabilities of the portal system
Whether a parent gets cut off from the portal often comes down to the health system’s technology and how much effort they’re willing to put in. Some systems can separate sensitive info or let a minor choose to give a parent access, but not all can. So, for ease or to avoid legal risk, providers might just shut off parent access completely, even if the parent might still have a legal right to the info through other means. “I think it’s just about technical capacity,” McGraw explains, “in terms of the computer systems that these healthcare providers are using, as well as how much effort they want to focus on trying to maximize parent access while still being compliant with the law. Sometimes I think it’s an ease of administration to say we’re just going to cut the parent off. The parent may find other ways to get access to the data that the parent has the right to, but just not through the portal. It’s not a great solution, but I definitely can see why it ends up that the parent loses that access.”
Figuring out parental rights after a child turns 12 can be confusing, especially when your child has a disability. As McGraw explains, there can be emergency situations where a parent can access their child’s health info without the child’s permission: “In some states, there are what are called ‘break-the-glass exceptions,’” she says. “This is when ordinarily the parent wouldn’t be able to access those records, but if it’s an emergency — medical emergency, psychiatric emergency — the parent is able to be granted access in certain circumstances. But it really depends on what the law says. And again, it’s a state law issue.” Here are a few things you and your child can do if they do consent to you accessing their medical information.
Speak to your providers
The best way to understand how you can keep supporting your child after age 12 is to ask your healthcare provider about their process. Cogan explains that providers should be able to walk you through what changes after age 12, how your child can give permission for you to keep accessing their records, and what steps you need to take. They may also have resources to help you understand your options.
Don’t panic — try creating a new login
For parents facing immediate barriers, Lobel advises against panicking. Instead, she suggests a technical workaround. She advises, “They just have to create a new login in their child’s name, and then in that account, the permission is given for the adult to be able to see the claim.” However, hospitals or large clinics might require a signed release before granting access. If the child is willing, they can provide written consent to share their records.
Sign a release or minor authorization form
In California, as Cogan explains, a child can sign a “minor authorization form” to give their parent permission to access medical records, including through the online patient portal. These forms might go by different names depending on the healthcare provider or health plan, but the purpose is the same: to allow continued parental access if the child agrees. Parents can typically request this form directly from their child’s provider or health plan for children ages 12 or older. Leslie notes that in many cases, the provider’s patient portal or front desk staff can explain the process and provide the appropriate paperwork. It’s a good idea to ask early, as some systems might require the form to be signed in person or submitted in a specific way.
Cogan shares how a child can grant parent access to their medical records:
What if your child can’t consent?
Cogan explains that when your child turns 12 and does not have the capacity to consent (i.e., they are unable to understand the right to medical privacy and to give consent to you having access), you should have a direct discussion with your child’s healthcare provider. Cogan explains that in these situations, it’s important to ask how the provider will make sure the right person is making healthcare decisions for your child. “So everything is fact-dependent,” Cogan explains. “It depends on your child’s capacity, which is something that is a discussion. I would say even if a child lacks capacity to consent, the provider should still discuss their care with the minor in a way that’s appropriate for their age and their understanding and also involving their parent as well.”
Balancing privacy laws with family dynamics
Families often find this transition emotionally difficult. McGraw explains that even within the same family, parents can have very different reactions to minor consent laws. One parent might feel it’s more important for their child to get the care they need — even if they don’t share it — while the other might feel strongly that a child shouldn’t make those decisions without a parent’s involvement.
Although these privacy laws are designed to protect minors, they can also make parents feel excluded. Successfully handling this challenge requires maintaining open communication while respecting legal limitations. McGraw stresses that building a strong foundation of trust between parents and children is the best way to support a child’s healthcare needs.
“The best situation is always when the parent and the child have that relationship where the child, even though it’s hard, can share with the parent whatever is happening to them, healthwise. That might be very embarrassing or cause some shame to the child, but certainly, at least then the parent is aware and can help the child through those decisions.”
State laws might offer alternative pathways for parental access when a child can’t consent, but solutions aren’t always clear-cut. McGraw acknowledges that these laws can leave parents feeling stuck. ”The law creates an avenue for the child to get those things on their own, and there may be situations where there’s nothing the parent can do about that, and this is true even if the parent is paying up for the health insurance that paid for that care; the child still has the right to keep that care private if the state law allows them to do that,” she adds.
Here’s something important to keep in mind: when your child turns 18, they are legally an adult — ready or not — even if they still rely on you for every health decision. McGraw explains that once your child reaches this age, you no longer have automatic access to their medical records or decision-making unless you take legal steps. As she puts it, “They are still an independent adult individual with full autonomy to make decisions.”
California law presumes that all adults, regardless of disability status, have the capacity to make their own decisions. That means that turning 18 automatically shifts control over medical information and decision-making to your child. However, if your child has a disability that prevents them from being able to make their own medical decisions, their privacy rights might not automatically apply the same way. In that case, you’ll likely need legal authorization — like a court order or formal paperwork — to continue making medical decisions on their behalf once they turn 18. With that authorization, you can also access their medical records.
But note, as Cogan explains, that “the mere diagnosis of a mental or a physical disability is not enough to say that someone lacks capacity to do a certain act. There has to be more information. It’s not just, ‘Hey, I have this diagnosis, I have this disability, I guess I can’t make my own decisions anymore.’ It’s more complex than that.” In other words, just having a disability doesn’t mean your child can’t make their own decisions. There has to be more evidence that they need support. What’s required depends on your state, but starting early and connecting with your care team or other families can help you navigate the process. McGraw explains more about this process.
If your adult child needs support with healthcare decisions, there are steps you can take to stay involved.
Have a conversation with your child and their healthcare provider.
At 18, doctors might ask whether parents should still be involved. For neurotypical children, this might simply mean a private conversation with the doctor, but for those unable to communicate or make decisions, legal documentation such as power of attorney or limited conservatorship might be required.
Cogan emphasizes that medical providers have different policies on what documentation they require, so it’s important to have these conversations early. Some might allow continued parental involvement based on their knowledge of the child’s abilities, while others might require formal paperwork. “Some doctors might be comfortable saying, ‘I agree with you. I’m familiar with your child, and I understand their background and situation, and I’ve made a decision that they can’t make these decisions on their own, so we’re going to let you continue to have this access.’ Some doctors might say, ‘Well, if we don’t have a form, we can’t do anything about it.’” In cases where access is denied, families might need to determine whether their child has the legal capacity to sign a durable power of attorney or whether a court order is necessary.
Check your state’s specific requirements for legal documentation.
McGraw explains, “You’ve actually got to get some sort of authorization from your state to be able to continue to make medical decisions for your child.”
Meet your child at their level.
Dr. Tirabassi-Mathis also shares that for a neurotypical child, “there are forms that we have patients sign when they’re 18 to say, ‘I am giving permission for this person’ — whether it’s a parent, a legal caregiver, an uncle, whatever — ‘to have access to my medical information.’ So in terms of some young people who have definite communication issues or have intellectual and developmental differences that they cannot communicate, we hope and try to help those parents gain some kind of legal assistance, which may give the legal caregiver or parent continued access for helping their youth with medical decisions and be part of their team with supported decision-making, as we refer to it.”
Review other systems.
Lobel advises parents to check policies for medical insurance, state agencies like Regional Center, and similar services to ensure access continues uninterrupted after age 18. It’s also worth keeping in mind that these arrangements can evolve. What works when your child turns 18 might not be right at 30 or beyond. As a child’s needs shift, she says, families might need to adjust who manages their care or what level of involvement is required, especially when considering privacy, confidentiality, and decision-making authority.
Exploring these tools doesn’t mean committing to something overly rigid or permanent. As Lobel points out, “Every system has the possibility for abuse, but it shouldn’t make people fearful to explore the options that may be appropriate.” Ultimately, finding the right balance is about empowering your child while ensuring they have the support they need to thrive.
Seek alternative decision-making tools.
Dr. Tirabassi-Mathis agrees, there are many alternative decision-making tools that offer a “spectrum of considerations” that families can explore to ensure their child’s needs are met, including:
Dr. Tirabassi-Mathis adds, “We want young people to be in the least restrictive environment. Some people go right to guardianship and say, ‘Oh, I’ll take full guardianship,’ but there’s actually partial guardianship. There are young people that have what’s called shared decision-making. They perhaps aren't able to confidently make decisions based on insurance, for example, or serious medical decisions, so they give permission to their parents, and their parents have a legal permission from their youth that they are part of their decision-making team.”
Cogan reinforces that for parents of children who might struggle with medical decision-making, proactive discussions with healthcare providers are essential. “In the lead-up to turning 18, parents should have conversations with their child and with their child’s healthcare provider to find out what will happen and how they can continue to support their child if that’s what their child wants.”
Lobel explains, “There’s no tool that’s at fault or faulty. It’s just a matter of picking the right tool and the right documentation for the specific circumstance that your adult child faces.” For instance, you might consider conservatorship for medical or financial matters without applying it to other areas of life. A little preparation now can go a long way in making this transition smoother, setting you and your child up for success.
In fact, California law requires judges to consider less restrictive options first before granting a conservatorship and requires conservators to utilize SDM practices within the conservatorship. Let’s explore some of these options more in depth.
Let’s explore supported decision-making more. One example can be if a young adult needs to decide on whether to undergo a medical procedure, they can decide that they want their parents to be part of the meeting with the doctor. The parents can assist in explaining the options in a way that the individual understands and ensure that the decision is genuinely one of informed consent, by explaining what the consequences of the decision might be.
Supported decision-making (SDM) can be written into an Individualized Education Program (IEP), an Individualized Program Plan (IPP), an Individualized Plan for Employment (IPE), a HIPAA authorization, a durable power of attorney (DPOA), an advance medical directive, an SSI representative payee form, and more.
Another tool is the HIPAA authorization, which allows a person to give a supporter the right to see their private medical information. For example, if your young adult uses an AAC device and needs support communicating their healthcare needs to their doctor, a HIPAA authorization can grant you access to their medical information and allow their doctor to speak with you.
Note that when it comes to supported decision-making, some medical providers might be willing to work with parents to make care plans and provide other services once their young adult turns 18; however, they will need your young adult’s consent to do so, as HIPAA and privacy concerns come into play. Parents will not have a right to medical information and cannot consent to procedures once their young adult turns 18 without a signed agreement in place. Read more about SDM in our article Supported Decision-Making 101.
A durable power of attorney for healthcare allows a young adult to designate someone, such as a parent, to make decisions on their behalf when they’re not able to, including healthcare, legal matters, and finances. This can grant the DPOA access to confidential information, such as education and medical records.
Cogan notes that in California, there’s a specific form for this that’s easy to find online, and it lets individuals outline exactly what types of decisions they want help with. To be valid, the DPOA must be either notarized or signed by two adult witnesses who are not named in the form. These witnesses must observe either the signing of the form or the signer’s acknowledgment of it. This witnessing requirement adds a layer of protection by ensuring the person understands what they’re signing.
However, a tricky situation arises if it’s unclear whether your child has the capacity to sign a power of attorney in the first place. “Most medical providers will say, ‘Oh, here’s a durable power of attorney for healthcare.’ It’s not legally effective if someone doesn’t have capacity to understand what rights they have and what rights they’re giving to someone else.”
If an adult with a disability is not conserved, the law presumes they have the capacity to make their own decisions — even if a parent believes otherwise. McGraw explains that under general legal principles, all adults are presumed competent, and a diagnosis alone is not enough to declare someone incapacitated; only a judge can make that determination. Cogan, speaking specifically about California, notes that unless legal authority is established — such as through a DPOA or a conservatorship — providers must assume the individual has the right to make decisions and control access to their own records. This means that if the individual cannot understand or authorize a power of attorney, a parent seeking to act on their behalf may need to go to court for a conservatorship. While some providers may accommodate parents informally, McGraw advises that this varies by practice and is not legally guaranteed.
You can find forms to create a DPOA at this website or in this PDF handbook (pages 33-34) by Disability Voices United.
Parents might be wondering: when my child turns 18 and they are conserved, do I still have this same problem with access to their medical information? Let’s explore this. A limited or full conservatorship gives someone else the legal right to make certain decisions on behalf of an adult who cannot care for themself, such as giving or withholding consent for most medical treatments for the conservatee in a limited conservatorship. Cogan clarifies that in California, conservatorship applies only to adults; when a guardian is appointed by the court for a minor, due to the absence of a parent, it's called guardianship. She notes that California has a limited conservatorship designed for individuals with intellectual and developmental disabilities.
When it comes to medical rights, Cogan explains, “If someone were conserved with a limited conservatorship in California, the judge would decide, based on the evidence, which of those seven powers the conservator has and which remain with the person with the disability. If you’re a conservator and you have a court order that gives you consent for medical treatment and access to confidential records, then you can continue to be involved in that person’s healthcare decision-making.”
But here’s the thing: getting this authority isn’t always as simple as filling out a form. For example, obtaining conservatorship requires going to court and presenting medical evidence that the young adult is unable to make certain decisions independently. It’s a formal legal process that varies by state and may not be necessary in all cases. Other options, like a durable power of attorney, can often be set up without court involvement. The key takeaway is this: if an 18-year-old is unable to make medical decisions, families need to have the appropriate legal documentation in place to maintain access to healthcare information and provide support when needed.
Another thing to consider here is having a discussion with your child and asking their thoughts and opinions on the subject, if possible, and having them express these to the lawyer. As part of the conservatorship process, your child will have their own court-appointed attorney to represent their interests. Speak to your child about your intent to obtain conservatorship and what that will entail. Your child should play an active role in the process, voicing their opinions on what they are and are not capable of doing and what areas of life they may need your help with. It’s also important to have a support team of trusted people and resources as you move through this process. Read more about this in our article Conservatorships (Limited and Full) in California.
Will someone tell me if something bad happens? What parents need to know
What happens if a conserved adult child goes through something terrible — like abuse or an emergency — in a setting such as a group home or an 18–22 program? Are parents entitled to that information as the conservator, or do the exceptions to minors apply? McGraw explains that a conservator retains the right to medical information unless they have relinquished that authority as part of the placement process. “Because the group home status is just the status of where they are living, if the parent still has the legal authority under conservator rights to make all legal and medical decisions for that child, then they have that right, even if the child is in the group home.” The same principle applies in school-based transition programs for students ages 18–22: if the parent retains conservatorship powers, including access to records and the right to make medical decisions, they continue to hold that authority regardless of the educational setting. If, however, the parent has given up that legal authority — for example, as a condition for securing placement — then the group home or program assumes those responsibilities.
If the group home holds legal authority through conservatorship or power of attorney, in these situations parents might have to fight to remain involved in their child’s care. In some cases, though, parents might be forced to relinquish their legal rights in order to secure placement in a home that provides the best care, creating a heartbreaking dilemma for families. McGraw acknowledges that this can be a difficult battle, depending on the legal structure of the placement. She advises, “If you want to still make decisions for your child, don’t give that up . . . . You need to hold on to that legal authority to make decisions for your child if you want to be able to access those records reliably without needing to get the consent of the person or entity that does hold those legal rights.”
Parents need to take steps to secure medical and legal authority if they want to continue participating in their child’s care decisions. This can be done through options such as conservatorship, durable power of attorney, or even verbal consent in medical situations. Without the necessary legal permissions, families might encounter obstacles when trying to be part of important decisions regarding their child’s health. Securing the right legal authority allows parents to advocate for their child’s well-being, particularly in situations such as group home placements or when their adult child is dealing with mental health challenges.
McGraw leaves us with a few words for parents: “My heart really goes out to parents, and we don’t do nearly enough to help them. It’s tough stuff.” She encourages families to understand the legal avenues available to them and to pursue the ones that best match their child’s needs and level of independence. The goal is to ensure support is in place in a way that respects the young adult’s autonomy while allowing parents to step in effectively when needed.
Save your favorite resources and access a custom Roadmap.
Get Started
