You've been seeing a teenager for two years. The mom books the appointments, the mom pays the bills, the mom sits in your waiting room reading on her phone every Tuesday at 4pm. Then one day your client turns 18 — and the mom emails you asking for a summary of the last few sessions, exactly like she always has.

Your stomach does a small flip. Can you actually send that?

It's one of those moments that almost never comes up in grad school, yet lands on nearly every therapist's desk eventually. The honest truth is that a lot of clinicians have never formally thought through what changes the day a minor client becomes a legal adult. So let's walk through it together — calmly, precisely, and in a way that won't blow up a relationship you've spent years building.

The short version: control shifts to the client

Here's the core principle, and it's worth saying plainly. Under HIPAA, the personal representative of an unemancipated minor is usually a parent or guardian. While your client is a minor, that parent generally has the right to access the child's protected health information (PHI), authorize disclosures, and act on the child's behalf — because they're standing in for the patient.

The moment your client turns 18, that arrangement ends. The now-adult client becomes the holder of their own privacy rights. The parent is no longer a personal representative. They're just another third party, and like any third party, they need the client's written authorization to receive PHI.

That shift happens on a single birthday, automatically, without anyone signing anything. The records don't change. The relationship doesn't change. But who controls the records changes completely.

So in the scenario above, the answer is: no, you can't send that summary to the mom — not without your now-adult client's signed authorization. Even though she's been the one coordinating everything for years.

Why the parent's "right" essentially evaporates

It feels abrupt because it is. There's no transition period built into the federal rule. HIPAA's personal representative provision (45 CFR 164.502(g)) ties representative status to the legal authority to make healthcare decisions for the individual. When that authority ends — and for most 18-year-olds, parental authority over healthcare decisions ends at the age of majority — the representative status ends with it.

A few things that surprise people:

Paying the bills doesn't grant access. A parent can be footing the entire cost of therapy and still have no HIPAA right to the records once the client is an adult. Financial responsibility and privacy rights are simply two different things.
Being on the insurance policy doesn't grant access. If the client is a dependent on a parent's plan, the parent may see some billing or claims information through the plan itself — but that's the health plan's disclosure, not yours. It does not give the parent a right to your treatment records.
Having attended sessions doesn't grant access. Even if a parent sat in on family sessions, that history doesn't entitle them to the adult client's chart afterward.

The only thing that grants a parent access to an adult child's records is the adult child saying so, in writing.

State law sits on top of all this

Here's where it gets genuinely more complicated, and where you have to know your own state.

HIPAA sets the federal floor. But the age of consent for mental health treatment — the age at which a minor can consent to their own therapy without a parent — varies by state, and it's frequently lower than 18. Plenty of states let minors consent to a limited number of outpatient mental health sessions on their own at 12, 13, 14, or 16, depending on the state and the type of service.

This matters because of a quiet rule inside HIPAA: when a minor lawfully consents to their own care under state law, the parent is generally not treated as the personal representative for that care, even before the child turns 18. In those situations, the minor may already control the relevant records.

So depending on where you practice, the "control shifts to the client" event you're worried about at 18 may have partially happened years earlier for certain services. And in other states, the parent retains broad access right up until the birthday.

The practical takeaway: look up your own state's minor consent statute for mental health treatment, and know how it interacts with parental access to records. This is the single biggest variable, and it's the part most therapists have never actually checked. When state law gives the minor consent rights, state law — not your assumption — usually governs who can see those records.

What to actually do before the birthday

The good news is that this transition is almost entirely manageable if you see it coming. The clients where it goes badly are the ones where everyone got surprised. So get ahead of it.

Have the conversation early

A month or two before your client turns 18, bring it up in session — with the client, and ideally in a way that loops the parent in too. Frame it as a normal milestone, not a confrontation. Something like: "When you turn 18, you'll legally be in charge of your own records and your own privacy here. I want us to talk about what you'd like that to look like."

This does three things. It respects the client's emerging autonomy. It prevents the parent from feeling blindsided. And it gives you a documented moment where everyone understood the change was coming.

Update consent and authorization forms

Before the birthday, have the client sign updated paperwork as an adult:

A fresh consent for treatment in their own name.
An updated acknowledgment of your Notice of Privacy Practices.
Most importantly, a clear authorization to release information that spells out exactly who, if anyone, the client wants you to share information with — including whether the parent stays in the loop, and to what degree.

Many young adults want a parent to remain involved, and that's completely fine. The point isn't to cut parents out. It's that the choice now belongs to the client, and you need it documented. A signed HIPAA-compliant authorization (the kind described in 45 CFR 164.508) is what lets you keep talking to mom without violating anything.

Document the transition

Write a brief note in the chart: the date you discussed the change, who was present, what the client decided about parental involvement, and which new forms were signed. If a parent later demands records, this note is the difference between a clean answer and an awkward scramble.

When a parent demands records after the birthday

Sometimes you don't get the smooth version. The client turns 18, something tense is happening at home, and a parent contacts you insisting on the records — sometimes politely, sometimes not.

Here's your footing:

Stay warm but firm. You're not refusing out of stubbornness; you're protecting the client, which is your job. A simple line works: "Now that they're 18, I'm not able to share information without their written permission. I'd be glad to talk with them about whether they'd like to authorize that."
Don't confirm or deny details. Be careful that even acknowledging specifics about treatment isn't itself a disclosure. Keep it general.
Route it back to the client. Ask the client directly whether they want to sign an authorization. If yes, get it in writing. If no, that's the end of it.
Document the request and your response. Note who asked, what you said, and what the client decided.

If a parent escalates — threatens, or claims some legal entitlement — don't get talked out of the rule in the moment. You can always tell them you'll need anything like that in writing and that you'll review it. Then breathe and check the actual facts before responding.

The real exceptions

A few situations genuinely change the picture, and you should recognize them:

Court-appointed guardianship. If a court has appointed a guardian or conservator for the adult — common when an 18-year-old has a significant intellectual or psychiatric disability — that guardian may become the personal representative under HIPAA. You'll want to see the actual court order defining the scope of the guardianship, not just take someone's word for it.
A valid signed authorization. As covered above, the client can simply choose to let a parent in. This is the most common "exception," and it's not really an exception at all — it's the client exercising control.
State-specific rules. A handful of states have particular provisions about young-adult access or specific record types. When in doubt, the state minor-consent and records statutes win for the matters they govern.
Genuine emergencies. HIPAA permits certain disclosures to prevent a serious and imminent threat to health or safety (45 CFR 164.512(j)). That's a narrow safety-valve for crisis situations, not a routine path for handing records to a worried parent.

One thing that does not create an exception: the parent simply having always been the contact person. Habit isn't authority.

The awkward reality

Most therapists handle this on instinct, and most of the time instinct is fine. But "most of the time" isn't a policy, and the cases that go wrong are exactly the ones where there's family conflict and no documentation to lean on.

You don't need to make this dramatic. You need a small, repeatable habit: flag minor clients approaching 18, have the conversation, refresh the paperwork, document it. Do that, and the birthday becomes a non-event instead of a stomach-flip moment in your inbox.

Not sure if your practice is covered?

Situations like these are exactly why having documented HIPAA policies matters. Yundra's free risk assessment identifies the specific gaps in your compliance — so you're prepared before something unexpected happens.

Check your compliance score →

Your Client Just Turned 18. Can Their Parents Still Access Records?