Do parents have access to an adult child&#39;s childhood medical records After my child turns 18, I know I am blocked from seeing any new medical records, unless they give explicit permission. However, does that mean I am blocked from their pediatric medical records? Their pediatric provider sent me their complete vaccination record for our records, but they are now over 18. Is this a violation of HIPAA? I tried reading the rules and regulations, but I couldn't parse out this situation. If it is a violation, can you point at the regulation? If it is a violation, I'd like to inform the provider, so they don't continue this mistake. (To be clear, I have a release, and permission from our adult child, but the provider wouldn't know that.)
Late to the party, but I'll answer anyways. In general, providers have a lot of wiggle room when sharing information with parents, on condition that the patient hasn't explicitly objected despite having opportunity to do so. HIPAA allows the provider to make a judgment call on whether such information can be shared without explicit consent: Quoting Title 45 § 164.510 : (i) Obtains the individual's agreement; (ii) Provides the individual with the opportunity to object to the disclosure, and the individual does not express an objection; or (iii) Reasonably infers from the circumstances, based the exercise of professional judgment, that the individual does not object to the disclosure. HHS does discuss disclosure to family members in their FAQ : A covered entity is permitted to share information with a family member or other person involved in an individual’s care or payment for care as long as the individual does not object. A parent of a child who has just turned 18 is likely still somewhat involved in the child's care, so, absent either an objection or a reason to believe the child would object if asked, sharing is probably not a violation.
Certainly. A phone number is personal information (and on top of that, WhatsApp may provide some &quot;profile info&quot; from the people you contact). It is not difficult to identify a person by its phone number. So, sharing the phone number of the people affected should take into account the restrictions of GDPR. For instance, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) established in its Resolution R/03041/2017 that the Town Hall of Boecillo had violated the GDPR because it had created a WhatsApp group of citizens. Those citizens had provided their phone numbers to be informed about town hall activities, but they had not agreed to share their numbers with the other members of the group. And that was a very generic group. Doing a &quot;patients recovering from cancer&quot; or &quot;drug abusers under treatment&quot; or &quot;people who need food assistence&quot; group would involve sharing personal information that gets the maximum protection (in some specific instancies it could be that your information sharing that information is illegal even if the users gave you full consents). So yes, creating a WhatsApp group could very easily lead to a GDPR violation, and in fact it has been ruled at least once that it has. The fact that people cannot send messages is irrelevant. It would not make the issue any better or worse. After all, if I send a message through WhatsApp I am implicitly giving permission to everyone in the group to read it.
No. HIPAA places no limits on who you may share your medical records with - only on those with who your doctors (et al) can share. The HIV laws you refer to, place a positive obligation on you to share the information.
You can read about the obligation to access public records under Kentucky law here. This page is the Louisville PD' statement about what is available. They state that &quot;Some items have been redacted, blurred or withheld for privacy or legal reasons&quot;, noting for example that the statute &quot;exempts from disclosure under the Open Records Act information that, if disclosed, would create an unwarranted invasion of personal privacy. Any further reference to redactions for personal privacy /concerns is also made pursuant to this law and/or HIPAA&quot;. The plaintiff's filing is not available and the police department has not commented, so we don't know exactly what is being demanded. However, the PD has not claimed that they are withholding the requested records for legal reasons, and the media alleges that the suit alleges that the PD lied about the existence of said records (note the double allegation). Body-worn cameras are specifically included here, and this part says that you can sue in county court. FOIA does not apply, because the Lousiville PD is not an agency of the US government.
The relevant legal requirement to have accurate records is 45 CFR 156.526, where An individual has the right to have a covered entity amend protected health information or a record about the individual in a designated record set for as long as the protected health information is maintained in the designated record set. The request can be denied if the record is accurate and complete. A simple and pointed solution is to print that page and circle the section, in a letter requesting an amendment. A somewhat more costly and much more effective solution would be to get a lawyer to write a letter in legalese. It is hard to imagine that the provider would not comply. You will notice that they have 60 days to comply (+30 days extension if requested). If for some reason they insist on leaving the record as is, you have the right to insert rebuttal statements into the record (basically, prove that the record is false). There is no realistic hope of compensation for annoyance, but you can hope for a correction.
This means that you have the right to make arrangements to do things like arrange for the child to travel to your home (possibly as an unaccompanied minor on a plane or train or bus), to enroll the child in a school of your choice near your home and to sign permission slips on behalf of the child as necessary for school activities, to arrange to have the child's possessions moved to your home, to locate a local pediatrician and dentist for the child and consent to the child's medical treatment by those health professionals, etc. Basically you have whatever parental authority you need to have that is incident to being able to do what is necessary to have the child live with you. You might not have parental authority in matters that are not related to something necessary to having the child live with you, for example, consenting to the child's marriage under the age of majority, or to the child enrolling in military service where parental permission is required, or to representing the child as guardian in connection with an inheritance case.
The rule applies to &quot;A covered entity or business associate&quot;, who may not &quot;use or disclose protected health information&quot; except as permitted. The set of covered entities and business associates is pretty large, and certainly covers nurses, also secretaries working for the hospital or insurance company. It is not restricted to the doctor-patient relationship. However, the restriction is not absolute: a patient can consent to the disclosure of such information: but, the consent must be written. This raises an interpretive challenge, in case patient A reveals a medical fact to a friend B who happens to be a medical professional. Person B probably is a &quot;covered entity&quot;, since they are undoubtedly A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. The information also is &quot;protected&quot;: Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years. Para 5 on prohibited uses and disclosures explicitly lists the prohibited disclosures (genetic information for insurance underwriting, sale of PHI), so idle gossip is not explicitly prohibited. It is also not explicitly allowed. But again, the regulation says: may not use or disclose protected health information, except as permitted or required by this subpart Nothing in the rules limits the obligation of a &quot;covered entity&quot;, in terms of how they came to be in possession of PHI. Given the definition of &quot;covered entity&quot;, the fact of being a covered entity is a property does not depend on obtaining information electronically. So without written consent, B who is a covered entity cannot gossip about A's medical status.
The child does not have a legal right to determine how Iowa's compulsory education law is obeyed. The first section of the law says that the custodian of a child who is of compulsory attendance age shall cause the child to attend some public school or an accredited nonpublic school, or place the child under competent private instruction or independent private instruction and no other provision gives the child veto power. However, on the upper end, a child &quot;under sixteen years of age by September 15 is of compulsory attendance age&quot;, with thus turning 16 during the school year being subject to compulsory education until the end of the school year&quot;. Let's say that the child turned 16 on Labor Day, then the compulsory education law does not apply. Still, until the age of majority, parents have the custodial right to make decisions in the best interests of the child. That right can be terminated, see Chapter 600a. Under certain circumstances, a child can petition the court for emancipation, which means that they will be treated as an adult under the law, and can therefore exercise their own judgment and live with the consequences. You would look at 600A.8 to see the grounds for termination – an objection &quot;I don't like their choice of school&quot; will not qualify.