HIPAA Compliance Guide for Transition-Age Youth Mental Health Programs

When a young person moves from minor to adult status, your program may need to reassess who can consent to care, access records, and receive updates. HIPAA provides a federal privacy framework, but state law and additional protections for certain records can affect what your program may share.

Use this guide to identify common privacy questions for transition-age youth programs. It is general information, not legal advice; apply the laws of the relevant state and your organization’s policies to each case.

What changes when a young adult turns 18 under HIPAA?

In most states, a person becomes an adult at 18, but the state age of majority and rules about emancipation can vary. Once a patient is an adult under applicable law, a parent does not automatically remain their HIPAA personal representative just because the parent previously consented to treatment or holds the insurance policy. HIPAA generally treats an adult’s personal representative as the individual only when that representative has legal authority to make health care decisions, such as authority established by applicable law or a health care power of attorney. See 45 CFR § 164.502.

The young adult generally controls access to their protected health information (PHI), including whether a parent may receive information. A patient can authorize a program to share specified information with a parent or another support person. A parent may also qualify as a personal representative if they have applicable legal authority, but that authority and its scope should be verified rather than assumed. HIPAA’s rules for personal representatives are described in HHS guidance on personal representatives and minors.

Make the transition an operational checkpoint: verify the patient’s date of birth and legal status, update contact and portal permissions, review any prior parental access, and ask the young adult whom—if anyone—they want involved. Explain that a parent may still receive communications through separate arrangements, such as an insurance plan, even when the program itself does not share clinical information.

When can parents access a minor’s mental health records?

For many routine health care matters, a parent or guardian is a minor’s HIPAA personal representative and may access relevant PHI. But that is not an absolute rule. A parent may not be the personal representative for a specific service if, for example, state law allows a minor to consent to that service and the minor consents, or if the parent has agreed to a confidential relationship between the minor and provider. HIPAA also defers to state or other applicable law that permits, requires, or prohibits parental access to the minor’s information. See 45 CFR § 164.502(g) and HHS guidance on parents and minors’ mental health information.

That means a minor’s consent to mental health treatment does not, by itself, answer every record-access question. Check whether the state’s minor consent to mental health treatment law applies to the particular service, what it says about parental access, and whether another rule applies. If state law is silent and the parent is not the minor’s personal representative for that service, HIPAA may allow a licensed health care professional to decide whether to grant access, consistent with state law and professional judgment.

Safety concerns also matter. HIPAA permits a covered entity, in specified circumstances, not to treat a parent as the minor’s personal representative when the provider reasonably believes that doing so could expose the minor to abuse, neglect, or endangerment and a licensed professional determines that it is not in the minor’s best interest. Follow applicable mandatory-reporting and safety requirements separately; privacy rules do not eliminate those duties.

How do state consent laws affect confidentiality?

State law helps determine who may consent to a minor’s care and whether parents can access information about that care. The rules can differ by service, age, circumstances, and the minor’s legal status. A state may, for example, allow a minor to consent to certain mental health services, set conditions on that consent, or specify whether parents may receive related records. HIPAA incorporates these state-law rules in determining when parents may access a minor’s PHI; it does not create one nationwide parental-access rule for every minor’s mental health record. See 45 CFR § 164.502(g)(3).

Build a state-specific review into intake, consent, and transition workflows. Confirm the law that applies to the service being provided, document who consented and under what authority, and record any confidentiality agreement or access limits. When a patient moves, changes providers, or receives care across state lines, do not assume the previous consent or access decision automatically settles the requirements for the new situation.

Train staff to route uncertain requests to your privacy officer or legal counsel rather than deciding from a parent’s relationship to the patient or insurance status alone. Clear escalation procedures help protect confidentiality while allowing legally permitted and clinically appropriate communication.

What protections apply to psychotherapy notes and substance use treatment records?

HIPAA gives psychotherapy notes special protection when they meet the rule’s definition: notes made by a mental health professional that document or analyze the contents of a counseling conversation and are kept separate from the rest of the medical record. Routine progress notes, diagnoses, treatment plans, medication information, and other information maintained in the medical record generally are not psychotherapy notes under that definition. A patient’s HIPAA right of access generally does not extend to psychotherapy notes, and a covered entity generally needs a valid authorization to use or disclose them, subject to limited exceptions. See HHS guidance on mental health information and psychotherapy notes and 45 CFR § 164.508.

Some substance use disorder (SUD) treatment records are also protected by 42 CFR Part 2. Part 2 applies to records identifying a person as having or having had an SUD when maintained in connection with a qualifying federally assisted program or activity. It does not apply to every record mentioning substance use, so programs should assess whether they or the records they receive are subject to the rule.

As of February 16, 2026, entities subject to the updated Part 2 requirements must comply with the 2024 final rule. Among other changes, the rule permits a single consent for future uses and disclosures for treatment, payment, and health care operations, while requiring separate consent for SUD counseling notes. It also continues to restrict the use of Part 2 records in legal proceedings against a patient absent the required consent or court order. See the HHS fact sheet on the Part 2 final rule and 42 CFR § 2.31.

When records contain both ordinary clinical information and specially protected psychotherapy or Part 2 material, identify what rules apply before responding to a disclosure or access request. Do not assume that one general release covers every category of information.

How should programs obtain and document authorization to share information?

First, distinguish an authorization from consent to treatment. HIPAA permits many uses and disclosures of PHI for treatment, payment, and health care operations without a separate authorization, subject to the Privacy Rule and other applicable law. A disclosure to a parent or support person outside those permissions may require the patient’s authorization or another valid legal basis. Psychotherapy notes generally require a separate authorization, and Part 2 records may require a Part 2 consent. See HHS guidance on treatment, payment, and health care operations.

A HIPAA authorization must be in plain language and include the required core elements: a specific description of the information, who may disclose it, who may receive it, the purpose, an expiration date or event, and the individual’s signature and date. If a personal representative signs, the authorization must describe their authority. It also must explain the individual’s right to revoke in writing, whether signing can be required in the circumstances, and that information disclosed may be redisclosed and no longer protected by HIPAA. Provide the individual with a copy and retain the signed authorization as required. See 45 CFR § 164.508.

For a practical written consent for disclosure, identify the intended recipient and the categories of information to be shared, such as appointment details, treatment summaries, or care coordination information. Avoid vague blanket language when a more specific scope will serve the patient’s purpose. Explain how long the authorization lasts, how the patient can revoke it, and any limits on what the program can control after disclosure.

Before sharing, confirm the patient’s identity and decision-making authority, verify that the authorization is current and complete, and check for additional state or Part 2 requirements. Record what was disclosed, to whom, when, for what purpose, and under which authorization or other legal basis. Keep authorization forms separate from treatment consent when required, and ensure staff can promptly locate any revocation or restriction.

How can programs manage privacy during insurance and care transitions?

Insurance and care transitions can create privacy risks even when a program follows its own disclosure rules. A young adult may remain covered under a parent’s plan, and plan communications or claims processes may reveal information about care to the policyholder. Explain that program confidentiality and insurance privacy are related but not identical, and discuss available options before submitting a claim when possible.

HIPAA gives individuals a right to request confidential communications from a provider through an alternative method or at an alternative location; providers must accommodate reasonable requests. A health plan must accommodate a reasonable request when the individual clearly states that disclosure of the information could endanger them. HIPAA also requires a provider to agree to a request to restrict certain disclosures to a health plan when the information concerns a service paid for in full by the individual or someone other than the plan, subject to the rule’s conditions. See 45 CFR § 164.522.

At intake and before a transition, ask the patient how to contact them safely, which phone number or address to use, whether voicemail or text is acceptable, and whether another person may receive messages. For transitions to adult care, help the patient identify what information the receiving provider needs and obtain a valid authorization when one is required. Share only information permitted by applicable law and the authorization, and explain that special protections for psychotherapy notes or Part 2 records may require additional steps.

Review contact preferences, portal access, billing arrangements, and authorizations when the patient turns 18, changes coverage, moves, or transfers care. These checks make privacy part of continuity planning rather than a last-minute records-release task.

In summary: Reassess access when a patient reaches adulthood, apply state-specific minor consent and confidentiality rules, distinguish ordinary clinical records from psychotherapy notes and Part 2 records, and document the authority and scope for every disclosure. Use transition and insurance workflows to ask patients how to protect their privacy while maintaining appropriate care coordination.

FAQs.

Can parents access a young adult’s mental health information after age 18?

Not automatically. Once the patient is an adult under applicable law, a parent generally needs the patient’s valid authorization or legal authority to act as the patient’s HIPAA personal representative. A parent may still receive information through an applicable legal arrangement or another disclosure permission, but being a parent or insurance policyholder alone does not grant access to the program’s clinical records. See 45 CFR § 164.502.

Can a parent access a minor’s mental health records under HIPAA?

Often, a parent is the minor’s personal representative, but access depends on the service and applicable state law. A minor may be able to consent to particular mental health care without parental consent, and state law may permit, require, or prohibit parental access to related information. HIPAA also recognizes limited exceptions involving confidentiality agreements and safety concerns. See HHS guidance on parents and minors’ mental health information.

Do HIPAA rules override state laws on minor consent?

No. HIPAA’s personal-representative rules defer to applicable state or other law on whether a parent may access a minor’s information. Programs should determine which consent and confidentiality rules apply to the specific service and state rather than assuming HIPAA alone decides the issue. See 45 CFR § 164.502(g)(3).

Are substance use disorder treatment records protected by additional federal confidentiality rules?

Yes, qualifying SUD program records may be protected by 42 CFR Part 2 in addition to HIPAA or other applicable privacy rules. Whether Part 2 applies depends on the program and records. The updated Part 2 requirements, including the consent changes, were required to be implemented by February 16, 2026. See the HHS Part 2 final rule fact sheet.