- Center for Ethical Practice - https://centerforethicalpractice.org -

Rights of Virginia Minors Under HIPAA – (Legal Opinion re: Consent and Disclosure)

1. Under the Health Insurance Portability and Accountability Act (HIPAA), the adult patient has certain rights, including the following :

– a. Right to receive “Notice of Privacy Practices” before receiving services
– b. Right to give or refuse consent for disclosures not included in that notice
– c. Right to review the record and request amendments
– d. Right to request and receive an accounting of all disclosures.

2. Under Virginia law, a minor is “deemed an adult for the purpose of consenting to . . . medical or health services needed in the case of outpatient care, treatment or rehabilitation for mental illness or emotional disturbance;” and the minor is “also deemed an adult for the purposes of accessing or authorizing disclosure” of those records. (See Virginia §54.1-2969 [1], E) . [See footnote #1.] Therefore, under HIPAA, a Virginia minor who enters mental health treatment under his/her own authority and by giving his/her own consent is considered to be “the patient,” retaining all the rights afforded to adult patients. [See footnote #2.]

3. Minors who consent to their own treatment (as authorized under §54.1-2969 [1]) have the legal right to give, or refuse to give, consent for disclosures to others, both under that statute and under the Virginia Health Records Privacy Statute ( § 32.1-127.1:03 [2] ) and under HIPAA.

4. However, according to paragraph K of that Virginia statute ( §54.1-2969 [1] ), as well as a separate Virginia statute (see §20-124.6 [3]), the parents, regardless of custody, may not be denied access to the health records of their minor child. Thus, under HIPAA at §502(g)(3)(ii), Virginia at §54.1-2969, K, and Virginia at §20-124.6, the minor does not have the legal right to refuse parents access to treatment information, unless (a) the provider determines that disclosure would cause “substantial harm to the minor or another person” or (b) a court finds “good cause” to disallow disclosure.

5. Given this confusing combination of legal implications, the informed consent interview  becomes ethically crucial. At intake, the therapist’s own privacy and disclosure policies must be clearly explained to the minor and to parents (if involved); and as a condition of receiving services, the minor should be required to sign a consent form, formally accepting the therapist’s own disclosure policies , (i.e., foreseeable limits of confidentiality) including policies about the provider’s voluntary disclosure to parents without the minor’s consent, and any policies about other “required disclosures” (e.g., contact with prescribing physician).

NOTE: This summary does not include discussion of the interface of HIPAA with federal laws regarding protection of substance abuse records (42 C.F.R. Part 2). Virginia treatment centers seem to be interpreting the combined implications as giving minors’ substance abuse records the same high level of protection as for adults, and thus denying access even to parents.

*Mary Alice Fisher acknowledges the assistance provided by Carol Schrier Polak, Esq;
and by the conversations with Alan Nessman and Angela Bowman of the
Office of Legal Affairs of the American Psychological Association.


1. This statute is located in a section of the Virginia Code that applies to licensees of the Board of Medicine, a fact which has created dispute over whether or not it also applies to mental health services provided by licensees of other Boards. However, the Virginia Board of Psychology does seem to deem it applicable to its licensees. (per Consultation in 2003 with Board of Psychology staff by M. A. Fisher, Ph.D., and by Alan Nessman and Angela Bowman of the Virginia Psychological Association Office of Legal Affairs).

2. Prior to HIPAA and the resulting changes in this and other Virginia statutes, parents were deemed to hold the minor’s confidentiality rights and to have the legal authority to make all decisions about disclosures. For further discussion, see APA legal and regulatory affairs staff article, [4] “A Matter of Law: Privacy Rights of Minor Patients” (June 21, 2005)

3. If you engage in practices that trigger HIPAA (i.e., electronic transmission of confidential patient information), ” . . . you need to be aware of how the HIPAA Privacy Rule interacts with state law regarding minors. Unlike with other parts of the HIPAA Privacy Rule, this is not simply a matter of determining whether the Privacy Rule or state law is more stringent – that is, more protective of privacy — and therefore takes precedence”
( quoted from the APA article cited in footnote #2).

4. Note that under HIPAA ( at §B164.524(a)(3) ), as well as under t hese Virginia statutes, parental access can be denied if the physician or clinical psychologist “has made a part of the minor’s record a written statement that, in the exercise of his professional judgment, the furnishing to or review by the requesting parent of such health records would be reasonably likely to cause substantial harm to the minor or other person.” The minor and/or parents have the right to have denial of their access reviewed (see HIPAA at §§B164.524(a)(4) and Virginia §32.1-127.1:03 (F). Further, under Virginia statute §20-124.6, a court can deny parental access if it finds “good cause.”

5. See sample adolescent informed consent document on this website .