HIPAA Compliance Guide for Therapeutic Foster Care Programs

Therapeutic foster care teams often coordinate with clinicians, child welfare agencies, parents, and foster caregivers. Protecting a child’s health information starts with identifying which organizations are subject to HIPAA, who is authorized to receive information, and what other confidentiality rules may apply.

This guide provides general information, not legal advice. Requirements can also depend on state law, court orders, custody arrangements, and agency policy.

When does HIPAA apply to therapeutic foster care programs?

A therapeutic foster care program is not automatically a HIPAA covered entity simply because it handles children’s health information. HIPAA generally applies to health plans, health care clearinghouses, and health care providers that conduct specified electronic transactions, such as electronic billing. A foster care agency may also have obligations as a business associate if it performs services for a covered entity that involve protected health information (PHI). HHS guidance on covered entities and business associates

Determine each organization’s role rather than assuming that HIPAA applies—or does not apply—to everyone in a child’s care network. For example, a clinical provider may be a HIPAA covered entity, while an agency that performs services on that provider’s behalf may be its business associate. A separate foster care agency may not be directly regulated by HIPAA, although state confidentiality laws, contracts, court orders, or other rules may still govern its records and practices.

When HIPAA does apply, the organization should use appropriate protected health information safeguards, including policies and procedures for permitted uses and disclosures, workforce access, and protection against unauthorized disclosures. The HIPAA Security Rule also requires safeguards for electronic PHI. HHS summary of the HIPAA Security Rule

How should teams share children’s health information?

Before sharing a child’s information, identify the recipient, the purpose, and the recipient’s authority to receive it. A care team should not assume that everyone involved in a placement—including a foster caregiver—may access the child’s full medical or behavioral health record.

HIPAA generally requires covered entities to take reasonable steps to limit PHI used or disclosed to the minimum necessary for the purpose, with exceptions including disclosures to, or requests by, health care providers for treatment. Covered entities should also set access permissions based on the information workforce members need for their duties. HHS minimum necessary guidance

In practice, teams can use secure, approved communication channels; verify the recipient and their role; share only relevant information; and document the legal basis or authorization for disclosures when appropriate. If a caregiver needs information to provide day-to-day care, the provider or agency should first confirm the caregiver’s authority and the applicable consent, custody, and state-law requirements. HIPAA may permit certain disclosures to people involved in a patient’s care in specified circumstances, but it does not give every caregiver blanket access. HHS guidance on permitted uses and disclosures

What should a business associate agreement include?

A HIPAA business associate agreement (BAA) is a written contract or other written arrangement between a covered entity and a business associate that handles PHI on its behalf. The agreement should describe permitted and required uses of PHI and prohibit other uses or disclosures except as permitted by the agreement or required by law. HHS business associate guidance

HHS identifies provisions that a BAA must address, including appropriate safeguards, reporting impermissible uses or disclosures and breaches, and requiring subcontractors with access to PHI to accept equivalent restrictions. It must also address assistance with relevant access, amendment, and accounting obligations, return or destruction of PHI when the agreement ends if feasible, and termination when the business associate materially violates the agreement. HHS sample business associate agreement provisions

Review the actual services and information flows when drafting or updating an agreement. HHS’s sample provisions are a resource, not a required form, and may not address every contractual requirement under state law.

Who can act as a child’s personal representative?

Under HIPAA, a minor personal representative is generally a parent, guardian, or another person authorized by law to make health care decisions for the child. The representative’s authority depends on applicable law and may be affected by custody orders or other legal arrangements. Being a foster caregiver, by itself, does not establish personal-representative authority. HHS guidance on personal representatives

There are exceptions. A parent may not be the child’s personal representative for a particular service when state or other law allows the minor to consent to that care without parental consent, when another person or a court is authorized to consent, or when the parent agrees to a confidential provider-minor relationship. State law may also require, permit, or prohibit parental access to particular records.

A covered provider may decline to treat a personal representative as such when the provider reasonably believes that the child has been or may be subjected to abuse or neglect by that person, or that treating the person as the representative could endanger the child, if the provider determines that doing so is in the child’s best interests. Agencies should confirm who has decision-making authority rather than relying only on a family relationship or placement status. 45 CFR § 164.502

How are psychotherapy notes protected?

Psychotherapy notes receive special protection under HIPAA when they are notes made by a mental health professional documenting or analyzing the contents of a counseling conversation and kept separate from the rest of the medical record. Routine clinical documentation—such as diagnoses, treatment plans, medication information, and progress notes—is generally not treated as psychotherapy notes merely because it relates to mental health care.

In most cases, a covered entity must obtain a valid authorization before using or disclosing psychotherapy notes, including for many treatment, payment, or health care operations purposes. HIPAA provides limited exceptions, such as certain uses by the note’s originator for treatment. 45 CFR § 164.508

Keep psychotherapy notes separate from ordinary clinical records and confirm the applicable authorization before sharing them. A caregiver’s role in a child’s daily care does not, on its own, authorize access to these separately maintained notes.

What additional rules apply to substance-use records?

Some records connected with substance use disorder (SUD) treatment programs are protected by the federal confidentiality regulation known as 42 CFR Part 2 confidentiality. Part 2 applies to records maintained in connection with qualifying federally assisted SUD programs; not every record that mentions substance use is automatically a Part 2 record. When Part 2 applies, its requirements may restrict disclosure beyond HIPAA’s general rules. HHS overview of Part 2

Under the updated Part 2 rule, a patient may provide one consent for future uses and disclosures for treatment, payment, and health care operations. Part 2 records remain subject to special protections against use in legal proceedings against the patient without the required consent or court order. The rule also requires separate consent for SUD counseling notes, which are maintained separately from the rest of the SUD treatment and medical record. HHS fact sheet on the 42 CFR Part 2 final rule

Compliance with the updated rule was required by February 16, 2026. Teams should verify whether the records they receive are subject to Part 2 and follow the applicable consent, redisclosure, and documentation requirements before sharing them. HHS Part 2 compliance information

In short, therapeutic foster care teams should determine which HIPAA roles apply, verify a child’s decision-making and disclosure authority, limit access appropriately, and check for additional protections such as Part 2 before sharing health information.

FAQs

Are therapeutic foster care agencies automatically covered by HIPAA?

No. An agency is not automatically a HIPAA covered entity because it handles health information. HIPAA generally applies to covered entities and their business associates; an agency’s status depends on the work it performs and its relationships with covered entities. Other laws, court orders, or contracts may still govern its records. HHS guidance on covered entities and business associates

Can foster caregivers receive a child’s health information?

Sometimes, but a foster caregiver does not automatically have access to a child’s complete health record. The provider or agency should confirm the caregiver’s legal authority, applicable consent or other basis for disclosure, and state-law requirements, then share information appropriate to the caregiver’s role. HHS guidance on personal representatives

When can a parent access a minor’s medical records?

Generally, a parent who is the child’s personal representative may exercise the child’s HIPAA rights, subject to applicable law. Exceptions can apply when a minor can consent to particular care, another person or a court has authority to consent, the parent agrees to confidentiality, or access could endanger the child. State law may also affect parental access. HHS guidance on personal representatives

Do substance-use records have additional confidentiality protections?

Yes, when records fall under 42 CFR Part 2. Part 2 can limit disclosures beyond HIPAA’s general rules, including restrictions on using records in legal proceedings against a patient without the required consent or court order. The updated rule also provides for a single consent for future treatment, payment, and health care operations disclosures, while requiring separate consent for SUD counseling notes. HHS overview of Part 2