Why Kennedy’s Message on Parental Rights, HIPAA, and Kids’ Medical Records Misses the Point

Parents have rights under the Health Insurance Portability and Accountability Act (HIPAA), but so do kids. HIPAA was written to protect both parental involvement and children’s safety, recognizing that these goals sometimes collide. Here’s what the new HHS messaging gets wrong about children’s medical care and privacy – and why it matters.

First, on December 3, the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) issued a letter restating a long-standing provision of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule: when parents have legal authority to make medical decisions for their children, they generally have the right to access their children’s medical records. That statement alone is not controversial, as HIPAA has been federal since 1996.

Second, HHS Secretary Robert F. Kennedy, Jr., related an accompanying video on the “right of parents” to access children’s medical records.

The way both the letter and video were framed should alarm anyone who cares about children’s health, well-being, safety, and rights.

What is missing is that children also have rights, including the right to confidential care in certain circumstances, the right to safety when a parent is the source of harm, and, in many states, the right to consent to certain medical treatments on their own.

None of this appears in Kennedy’s video, despite his long public record as a human rights attorney who repeatedly emphasized the need to safeguard children’s rights – rights that his video message now conspicuously ignores.

Children’s lives and futures depend on clarity at a moment when “parental rights” rhetoric is being politicized across education, health care, child welfare, and other public policy issues.

When it comes to medical decisions involving adolescents and their medical records, everyone involved should be clear about what the law actually says, what the OCR letter does and does not do, where Secretary Kennedy’s video is misleading, and what medical providers, parents, and young people need to understand now.

What HIPAA Actually Says About Parental Access

HIPAA’s Privacy Rule creates the concept of a “personal representative.” Under this rule, a parent is generally presumed to be the personal representative of an unemancipated minor, and therefore, typically has the legal right to access the child’s Protected Health Information (PHI), unless one of several key exceptions applies.

These exceptions are essential protections, crafted precisely because Congress, regulators, and child-health experts recognized that parental authority and children’s safety can come into conflict. When state law gives minors more privacy than HIPAA, that state protection typically controls. When state law is silent, HIPAA’s default rules and provider judgment fill the gap.

Three Core Exceptions Under HIPAA

Under the privacy rule, a parent is not treated as the child’s personal representative with respect to certain PHI when:

1. The child has the legal right to consent to certain health services.

State law determines this, and all 50 states allow minors to consent to at least some health services, such as emergency care, care for sexually transmitted diseases (STIs), certain infectious diseases, contraception, pregnancy-related services, mental health counseling, substance use treatment, and HIV testing.

For these protected services, the related medical records remain confidential from the parent unless the minor authorizes disclosure.

Allowing confidential care for teens encourages them to seek help for sensitive issues, like depression, substance use, or abuse – improving access to and the quality of care.

And remember, this is an allowance of confidentiality. In many cases, teens ask for their parents to be involved, or providers ask permission or even encourage teens to engage their parents in their mental and reproductive health care – because they believe it is in the best interest of the child.

2. The child receives care pursuant to a court order or by direction of a court-appointed individual.

When a court or a legally authorized decision-maker directs the care, that person – not the parent – may hold the legal authority to access or control the records related to that care.

3. The parent has agreed to a confidential provider–minor relationship.

HIPAA allows a parent to authorize confidential treatment by a provider, which gives the adolescent HIPAA privacy rights for that episode of care. This scenario comes up, for example, when a parent encourages an adolescent to seek counseling but agrees that the details will stay between the teenager and the clinician.

Allows Providers to Withhold Information from a Parent to Protect a Child

Under the HIPAA rule, a provider may refuse parental access if the provider reasonably believes the child:

• Has been or may be the victim of abuse, neglect, or domestic violence, or

• Would be endangered by treating the parent as the personal representative.

This regulation explicitly states that this discretion applies “notwithstanding” contrary state law, underscoring that child safety can override general parental-access rules.

This exception exists because the law recognizes a simple but profound reality: sometimes the parent is the source of harm. It is not a loophole – it is an explicit recognition in federal regulation that protecting a child from abuse or serious endangerment can require limiting a dangerous parent’s access to health information. None of this is new, and none of it has changed with the OCR letter or Kennedy video.

When Minors Are Treated as Adults Under the Law

Furthermore, it is important to understand that HIPAA does not always treat minors as children for purposes of medical decision-making and privacy. Federal and state law recognize several situations in which an adolescent becomes the legally authorized decision-maker for their own health care and medical information. These categories exist because lawmakers long ago acknowledged that real life is complicated and that some young people must have full autonomy long before age 18.

Common examples include:

• Emancipated minors: A minor whom a court has formally declared emancipated is treated as an adult for nearly all medical purposes. They can consent to care and control access to their medical records. Parents have no special HIPAA access rights in these cases.

• Married minors: In most states, entering into marriage automatically confers adult status. A married minor has full medical decision-making authority and controls their own health information.

• Minor parents: A minor who has a child is the legal parent to their baby, and often, states extend this adult authority to the minor’s own care as well. At a minimum, a minor parent always has medical decision-making authority for their child and typically exclusive HIPAA access to the baby’s records.

• High school graduates (in some states): A number of states classify minors who have completed high school, even if only 16 or 17 years old, as adults for purposes of consenting to their own care. In these jurisdictions, graduation functions as a trigger for autonomy.

• Self-sufficient minors: Many states recognize a form of “constructive emancipation,” allowing minors who live apart from their parents and support themselves financially to consent to medical care and control their medical information.

These categories arise in clinical practice every day. Providers regularly encounter 16- or 17-year-olds who fall into one of these classifications: youth who legally control their own medical decisions and records. Yet none of these realities are acknowledged in Kennedy’s message, which instead presents parental authority as universal and unqualified. The law is far more nuanced, and it is designed that way for a reason: protecting children in diverse and sometimes precarious circumstances.

What the OCR Letter Gets Right and What It Misses

The December 3 OCR letter correctly states that some providers, clinics, and electronic health record systems have been improperly blocking parental access in situations where the parent is entitled to it.

OCR is right to push health systems to fix faulty electronic health records (HER) configurations, remove unauthorized barriers for non-confidential components of pediatric care, provide timely access, and prevent overreliance on minor authorization when the law does not require it.

But the letter’s treatment of the minor confidentiality exceptions is exceedingly brief, and its introduction and conclusion may leave busy clinicians or administrators with the incorrect impression that parental access is absolute rather than qualified. The letter notes that long-standing protections for minors remain in place but offers little practical guidance about when they apply in real clinical situations.

This creates a risk of overcorrection or providers breaking confidentiality protections, especially when layered on top of a political climate primed to treat children’s confidentiality as suspicion, secrecy, or defiance of parental authority. Violating an adolescent’s privacy could be dangerous and have predictable chilling effects on care-seeking and disclosure.

What Secretary Kennedy’s Video Gets Wrong

Secretary Kennedy’s video is crisp and designed for virality.

But Kennedy’s statement is also deeply misleading. Here is where the rhetoric sharply diverges from the law.

1. He frames parental rights as absolute when HIPAA explicitly limits them in certain situations.

HHS Secretary Kennedy characterized parents’ access rights as non-negotiable and unconditional in the video. That framing ignores the text of HIPAA, which clearly negotiates parental access based on safety concerns, state minor-consent laws, and clinical judgment about potential harm to the child or others.

2. He erases every child-protective exception.

The video does not mention minor consent statutes, confidential mental health or reproductive health services, abuse or endangerment exceptions, or federal requirements to protect children in violent or neglectful homes and promote better health outcomes for teens by encouraging them to seek help and communicate openly about sensitive issues.

Leaving these safeguards and protections out of a message from the nation’s health leadership is not neutral; it reinforces a narrative that sees confidentiality itself as a problem rather than a protection.

3. He threatens providers for doing what HIPAA requires.

Kennedy threatens:

If a provider stands between you and your child, HHS is going to step in.

Under HIPAA, however, providers must stand between a parent and the child in certain circumstances, including when disclosure would endanger the child or when state law gives the adolescent control over specific services. Kennedy’s rhetoric risks deterring clinicians from exercising lawful, professional discretion to protect children.

4. He excludes children as rights-bearing individuals.

The video ends with a final statement about parental love and intuition, but the law is not based on feelings. It is based on hard-won protections for children whose parents do not always act in their best interest because of conflict, stress, fear, cultural barriers, violent dynamics, or simple human imperfection.

HIPAA respects parents, but it also respects children as individuals who may need access to confidential care.

Videos, speeches, and press releases cannot rewrite the law or regulations. When public messaging conflicts with the rule, providers must follow the law, not the rhetoric.

What Providers Need to Know

Your core obligations under HIPAA have not changed. The longstanding exceptions for minor consent, confidential treatment, and endangerment remain in full force, and state minor-consent laws continue to control major parts of this analysis.

In practice, that means:

• Know your state’s laws on minor consent and adolescent confidentiality; if state law is more protective than the federal HIPAA law, state law typically governs.

• Build workflows to flag high-risk scenarios, such as documented family violence, sensitive mental health or reproductive health notes, or medications that reveal confidential services before pushing data to shared portals.

• Use the “endangerment” exception when a reasonable professional judgment concludes that treating a parent as the personal representative would put a child at risk.

What Parents Need to Know

Parents do have important rights under HIPAA, and the OCR restates many of them. You are often entitled to see your child’s records, ask questions, and participate meaningfully in medical decisions.

At the same time, adolescents have rights rooted in federal and state law, medical ethics, and child-protection principles. Developmentally appropriate confidential types of care are provided to adolescents because evidence shows they are more likely to seek care, disclose sensitive information, and follow treatment plans when they can count on privacy.

Confidentiality is not the enemy of family trust. It is a lifeline for children navigating trauma, sexuality, mental health challenges, or safety concerns they may not yet know how to discuss at home.

What Young People Need to Know

Young people rarely hear this clearly: you have rights. Real ones. Legal ones.

Depending on where you live, you may be able to consent to certain types of medical care, such as mental health or reproductive health issues. In such circumstances, HIPAA often treats you – not your parent – as the “individual” who controls access to that part of your medical record. In many cases, that information can stay confidential unless you choose to share it or a law specifically requires disclosure, such as mandatory reporting for abuse or imminent harm.

If a provider believes a parent’s access would endanger you, federal rules allow them to limit what a parent sees and to take steps to keep you safe, including contacting protective services when necessary.

You are not powerless in your own health care. The law does not make you invisible, and you deserve to know that.

The Path Forward

There is a better way to talk about parental involvement: one that respects families without erasing children; one that supports parents without stripping protections from vulnerable youth; and, one that recognizes that the health system serves two rights-bearing parties, not one.

The OCR letter could have reinforced that balance. Instead, Secretary Kennedy’s video embraces a political narrative that treats children as extensions of parental authority rather than full human beings with needs, autonomy, and dignity.

When It Comes to Child Health, Center Kids and Not Politics

At First Focus on Children and Seen & Heard, we believe that every child deserves safety, health, privacy, access to care, and a voice in decisions that shape their lives and bodily autonomy.

Here’s what you can do:

1. Share this piece with providers, parents, and teens: Most Americans have never heard of the HIPAA minor exceptions, but they profoundly matter.

2. Urge HHS to issue follow-up guidance clarifying children’s rights and offer concrete examples of when confidential care is not only allowed but required: Incomplete guidance is dangerous guidance.

3. Support organizations that defend confidential youth health care – from school-based clinics to adolescent medicine to child welfare programs.

4. If you work in health care, review your policies now: Ensure your systems correctly reflect both parental access and minor protections, including thoughtful portal configuration and staff training.

5. Most importantly: listen to young people: Adolescents know what they need and when they feel unsafe. Their voices and concerns must be part of the conversation and decision-making.

Children cannot wait for adults to get this right, and they shouldn’t have to.