Moore/May 2013 (revised) Page 1
Responding to Requests for Minors’ Protected Health Information:
Guidelines for N.C. Local Health Departments
Jill Moore
UNC School of Government
Part 1. Introduction
Requests for release of a minor’s protected health information (PHI) are similar in some
respects to requests for an adult’s PHI. As with adults, the general rule is that PHI may be
released with written authorization, and there are some circumstances in which PHI may be
released without authorization. However, minors often must rely on an adult—usually a
parent—to make their health care decisions, or to exercise their rights to access PHI or
authorize disclosure of PHI. As a result, two frequently asked questions about disclosing minors’
PHI are:
• If a disclosure of a minor’s PHI requires authorization, who signs the authorization form?
• Are parents allowed to have access to a minor’s PHI?
This document focuses on those two questions, which have answers that can be quite
complicated. As a starting point, it is useful to know who gave consent for the minor’s medical
treatment, because the person who consented to the treatment is often the person who may
have access to the minor’s PHI or sign an authorization to disclose the minor’s PHI. However,
that is not always the correct answer, so it is wise to discuss complex situations with the
department’s HIPAA privacy officer or an attorney.
Consent is different for emancipated minors and unemancipated minors, so it is important to
know which minors are emancipated. Most of the minors seen by North Carolina local health
departments are unemancipated.
Emancipated and Unemancipated Minors
A minor is a person under the age of 18. By law, minors are subject to the supervision and
control of their parents, unless they are emancipated. This generally means that parents make
minors’ medical treatment decisions, but there are some cases in which consent to treatment
may be given by another person or even the minor him or herself.
An emancipated minor is a minor who may be treated as an adult for most legal purposes,
including giving consent to medical treatment. Under North Carolina law, the only emancipated
minors are those who:
• are married,
• have been granted an order of emancipation by a court, or
• are serving in the armed forces.
Moore/May 2013 (revised) Page 2
Legal emancipation of a minor is relatively rare. A minor who claims to be emancipated should
be able to prove it with documents—a marriage certificate, a court order of emancipation, or
military identification.
Any person under 18 who is not emancipated by one of the means described above is an
unemancipated minor.
Part 2. Emancipated Minors
Summary
Emancipated minors are treated the same as adults for purposes of consent to treatment, and
for purposes of allowing access to PHI or authorizing disclosure of PHI.
Consent to treatment
Emancipated minors usually give consent for their own health care services. However, like
adults, emancipated minors may become incapacitated or incompetent to make their own
health care decisions. If that happens, the minor needs a substitute decision-maker. As with
adults, if there is a substitute decision-maker that person likely also serves as the personal
representative who may access PHI or authorize its release.
Authorizing disclosure or obtaining access to PHI
General rules
For emancipated minors, the general rules are:
• The minor must sign authorizations for disclosure.
• The minor’s parents are not allowed access to the minor’s PHI.
Exception
If the emancipated minor is incapacitated or incompetent to make health care decisions, the
minor’s personal representative may access PHI or authorize its disclosure in accordance with
the usual rules for personal representatives.
Part 3. Unemancipated Minors
Summary
When a minor is unemancipated, the laws regarding who may consent to health care are more
complex. This in turn leads to more complexity in the rules for accessing or disclosing PHI.
The general rule under HIPAA is that a parent, guardian, or person acting in loco parentis (PILP)
1
should be treated as a personal representative when the parent/guardian/PILP has the legal
1
In loco parentis means “in the place of the parent.” A PILP is a person who has informally taken on the
rights and duties of a parent with respect to a child, without going through formal legal processes such as
adoption or guardianship.
Moore/May 2013 (revised) Page 3
authority to make health care decisions on behalf of an unemancipated minor.
2
A person who is
a personal representative for HIPAA purposes may sign authorization forms or obtain access to
PHI, but only within the scope of his or her personal representation.
However, HIPAA defers to state law on the question of when and to what extent a parent may
make health care decisions on behalf of an unemancipated minor. In North Carolina, the
general rule is that a parent, guardian, or PILP is the person with the legal authority to make a
minor’s health care decisions, but there are some significant exceptions to this rule. As a result,
the general rule that parents/guardians/PILP are the personal representatives for
unemancipated minor children does not always apply.
When HIPAA and state law are considered together to answer our basic questions about who
may sign an authorization for disclosure of an unemancipated minor’s PHI, and who may have
access to the PHI, the general conclusions are:
• Sometimes the person who must sign an authorization is the minor’s personal
representative (usually the parent, guardian, or PILP), but sometimes it is the minor.
Sometimes it is both.
• Sometimes a parent/guardian/PILP is allowed access to an unemancipated minor’s PHI,
but sometimes they are not.
As the word “sometimes” suggests, the answer to an access or disclosure question varies
depending on the particular facts and circumstances, which makes it difficult to articulate a
general rule for unemancipated minors. Instead consider this “rule of thumb”:
Often, the person who consented to the minor’s treatment is the person who
may authorize disclosure of PHI about the treatment, and/or obtain access to
PHI about the treatment.
This is a rule of thumb, not a rule of law. In other words, it is a guideline that often provides
the correct answer to disclosure questions. However, there are times when this guideline will
not lead to the correct answer.
The remainder of this document reviews the law of consent to treatment for unemancipated
minors in North Carolina, and then addresses who may authorize disclosure of PHI and who
may access PHI in several common scenarios. The conclusions in each scenario reflect an
analysis that considers both HIPAA and current North Carolina law. They may not reflect the
2
HIPAA creates an exception to this general rule: If the parent/guardian/PILP consents to the treatment but then
also assents to confidential care of the minor, the parent/guardian/PILP may not be treated as the personal
representative. This exception is discussed in greater detail on page 7.
Moore/May 2013 (revised) Page 4
conclusions that would be reached under other states’ laws, or if North Carolina law were
changed.
3
Consent to treatment
General rule
In most circumstances, an unemancipated minor may not receive medical treatment without
the consent of the minor’s parent, legal guardian, or a person acting in loco parentis (PILP). The
remainder of this document uses the shorthand term “parental consent” to mean the consent
of a parent, legal guardian, or PILP.
Exceptions
North Carolina law sets out several circumstances in which health care providers may treat
unemancipated minors without obtaining parental consent:
1. Parent authorizes another adult to give consent (GS 32A-28 through 32A-34). A custodial
parent or legal guardian may authorize another adult to consent to the minor’s care
during a period in which the parent or guardian is unavailable. This is a type of health
care power of attorney that applies only to minors.
2. Emergencies and other urgent circumstances (GS 90-21.1). Physicians may treat
4
a minor
without the consent of the parent, legal guardian, or PILP under any of the following
emergency or urgent circumstances:
• The parent or other authorized person cannot be located or contacted with
reasonable diligence during the time within which the minor needs the
treatment.
• The minor’s identity is unknown.
• The need for immediate treatment is so apparent that any effort to secure
approval would delay the treatment so long as to endanger the minor’s life.
• An effort to contact the parent or other authorized person would result in a
delay that would seriously worsen the minor’s physical condition.
• The parent refuses to consent, and the need for immediate treatment is so
apparent that the delay required to obtain a court order would endanger the
minor’s life or seriously worsen the minor’s physical condition, and two licensed
3
In the recent past, the North Carolina legislature has considered changes to North Carolina’s minor’s consent law.
To date, no changes have been adopted, but if that law were to change, the conclusions about minor’s consent
scenarios in this document would likely change as well.
4
If the treatment that is needed is surgery, ordinarily two surgeons must agree that the surgery is necessary
before it is performed. However, there is an exception for rural communities or other areas in which it is
impossible to get the opinion of a second surgeon in a timely manner. G.S. 90-21.3. If the emergency treatment is
an abortion, the circumstances are more limited. See G.S. 90-21.9.
Moore/May 2013 (revised) Page 5
physicians agree that the treatment is necessary to prevent immediate harm to
the minor.
3. Immunizations (GS 130A-153(d)). A physician or local health department may immunize
a minor who is presented for immunization by an adult who signs a statement that he or
she has been authorized by the parent, guardian, or PILP to obtain the immunization for
the minor.
5
4. Minors’ consent law (GS 90-21.5(a). This law allows physicians to accept an
unemancipated minors’ own consent for medical health services for the prevention,
diagnosis, or treatment of any of the following conditions:
• venereal diseases and other reportable communicable diseases,
• pregnancy,
• abuse of controlled substances or alcohol, or
• emotional disturbance.
However, a physician may not provide any of the following services to an
unemancipated minor solely upon the minor’s consent: sterilization, abortion,
6
or
nonemergency admission to a 24-hour mental health or substance abuse facility.
More on minors’ consent law (G.S. 90-21.5(a))
How old must a minor be to give effective consent under the minors’ consent law? This is
probably the most frequently asked question about this law, but the statute does not answer it
– it states that “any” minor may consent to medical health services for the conditions listed. Of
course, “any” must not be taken literally. Clearly, an infant may not give consent. On the other
hand, many adolescents may. To determine whether a minor may give effective consent, a
health care provider needs to understand two concepts: legal capacity to consent, and
decisional capacity (or competence) to consent.
A health care provider must not accept a person’s consent to treatment unless the person has
both legal capacity to consent to the treatment, and decisional capacity—that is, the ability to
understand health care treatment options and make informed decisions. Ordinarily, minors lack
5
Strictly speaking, an adult who presents a child for immunization on behalf of the parent, guardian, or PILP has
not “consented” to the immunization. Rather, the parent, guardian, or PILP has consented to the immunization
and has simply authorized the other adult to act on behalf of the parent, guardian, or PILP. Thus, this special rule
for immunizations is not an exception to the general rule that parental consent is required; it is an exception to
usual practice, since health care providers ordinarily do not accept another adult’s word that the parent has
consented to the treatment. This semantic point is important when it comes to determining whether the adult
may act as the child’s personal representative for purposes of accessing PHI or authorizing its release.
6
The state laws addressing abortions for unemancipated minors are G.S. 90-21.6 through 90-21.10.
Moore/May 2013 (revised) Page 6
the legal capacity to consent to their own treatment. The principle effect of the minors’ consent
law is to give unemancipated minors the legal capacity to consent to treatment for certain
conditions. However, the health care provider may not accept the minor’s consent unless the
minor also has decisional capacity. Like other developmental issues, children acquire capacity at
different times—some sooner and some later. Whether a minor has decisional capacity is
something that must be determined on a case-by-case basis.
Authorizing disclosure or obtaining access to PHI
Rule of thumb
Often, the person who consented to an unemancipated minor’s treatment is the person who
may authorize disclosure of PHI about the treatment, and obtain access to PHI about the
treatment. Many disclosure or access questions involve one of the following circumstances, in
which the rule of thumb will usually lead to the correct result:
1. Parent (or parent equivalent) consented to treatment. In most circumstances, an
unemancipated minor may not receive medical treatment without the consent of the
minor’s parent, legal guardian, or a person acting in loco parentis (PILP). In these cases,
the parent, guardian, or PILP is the child’s personal representative under HIPAA. As
personal representative:
• The parent, guardian, or PILP is the person who must sign authorizations for
disclosure of PHI.
• The parent, guardian, or PILP may have access to the minor’s PHI.
2. Minor consented to treatment under the minors’ consent law. If the unemancipated
minor was treated upon his or her own consent pursuant to North Carolina’s minors’
consent law:
• The minor must sign authorizations for disclosure of PHI.
• The parent, guardian, or PILP ordinarily may not have access to the minor’s PHI
without the minor’s permission. There is an important exception to this general
rule: if the health care provider determines that notifying the parent is essential
to the life or health of the minor, then information about the minor’s health
condition or treatment may be provided to the parent without the minor’s
permission.
7
7
G.S. 90-21.4(b). This law also permits (but does not require) a health care provider to disclose information if the
parent contacts the health care provider and inquires about care provided under the minor’s consent law.
However, this provision is often overridden by other laws. For example, if the minor received care through a Title
X-funded family planning clinic, a federal confidentiality regulation prohibits this particular disclosure. 42 CFR
59.11. Also, if the minor asked the health care provider not to discuss the treatment with his or her parent and the
health care provider agreed, the provider must not disclose information to the parent under this provision. This
amounts to a request for restriction on disclosures under HIPAA, and while a health care provider is not required
to agree to a restriction, if the provider does agree the provider must abide by the restriction. 45 CFR 164.522.
Moore/May 2013 (revised) Page 7
Circumstances that are too complicated for the rule of thumb
Unfortunately, some circumstances are not easily resolved by applying the rule of thumb. Some
of the most common circumstances in which the rule of thumb does not lead to a clear answer
are described below. In each case, the ultimate question is who should be treated as the
minor’s personal representative for HIPAA purposes. Keep in mind that:
• A person who is a personal representative for HIPAA purposes may sign authorization
forms or obtain access to PHI, but only within the scope of his or her personal
representation.
• The general rule under HIPAA is that a parent, guardian, or PILP should be treated as a
personal representative when the parent/guardian/PILP has the legal authority to make
health care decisions on behalf of an unemancipated minor.
This is not an exhaustive list. Consult with your HIPAA privacy officer or an attorney if you have
questions about how to manage a particular situation.
1. Health care provided with parental consent, but parent agreed to confidential
relationship between minor and provider. If an unemancipated minor’s parent, guardian,
or PILP consents to the minor’s treatment, but then also assents to an agreement of
confidentiality between the health care provider and the minor, the
parent/guardian/PILP may not be treated as the minor’s personal representative with
respect to PHI pertaining to any service covered by the agreement of confidentiality.
8
2. Health care provided without parental consent in urgent or emergency circumstances as
defined in G.S. 90-21.1. The child’s parent, guardian, or PILP should be treated as the
child’s personal representative in these circumstances. In the urgent or emergency
circumstances covered by this statute, the parent, guardian, or PILP is the person with
the legal authority to make health care decisions on behalf of the minor, and the statute
does not change that by permitting treatment without first obtaining parental consent.
Rather, the statute allows a physician to imply or assume parental consent in
circumstances where a delay caused by trying to obtain consent would endanger the
minor or worsen his or her condition.
3. Health care provided with consent of a person authorized to consent during parent’s
temporary absence. In this circumstance, an unemancipated minor receives health care
that the parent presumably would consent to, but the parent has delegated the
authority to consent to another adult during the parent’s temporary absence. There are
thus two people who may be treated as the minor’s personal representatives under
HIPAA: both the parent, and the adult the parent has authorized to consent to the
minor’s treatment. However, the non-parent should be treated as the personal
representative only with respect to the care to which the non-parent has consented.
8
45 CFR 164.502(g). This is the HIPAA provision mentioned in footnote 2. It is an exception to HIPAA’s general rule
that a parent/guardian/PILP who has legal authority to make health care decisions for an unemancipated minor is
that minor’s personal representative.
Moore/May 2013 (revised) Page 8
Also, if the parent has limited the non-parent’s authority to consent to a specified
period of time, the non-parent should be treated as a personal representative only
during that period of time.
4. Immunizations provided to child presented by an adult who signed statement that he or
she was authorized by the parent to obtain the immunizations. When a parent, guardian,
or PILP authorizes another adult to obtain an immunization for a child under GS 130A-
153(d), the child’s parent, guardian, or PILP is the child’s personal representative with
respect to information about the immunization. The adult who obtains the
immunization for the child does not qualify as the child’s personal representative for
purposes of the Privacy Rule, because the adult does not have legal authority to consent
to the child’s care in this case.
9
The adult therefore may not authorize disclosure of the
child’s PHI. However, the adult does have legal access to a limited amount of PHI: the
immunization certificate. This is because a North Carolina law (GS 130A-154) requires a
local health department to give a certificate of immunization to the person who
presented the child for immunization.
9
See footnote 5.
