Your Kid Is 18 Now: What HIPAA and FERPA Mean for Parents

The 18th Birthday Cliff

For most of your child's life, you were the default point of contact. Doctors called you. Schools called you. The system assumed you needed to know.

That changes the moment your child turns 18.

Two federal laws — HIPAA and FERPA — restructure the information channels between your young adult, their healthcare providers, and their school. This is not a glitch in the system. It is the law's acknowledgment that 18-year-olds are legal adults with the right to privacy over their own health and education records. Understanding exactly what those laws do and do not allow is one of the most practical things you can do as the parent of a college student — or a rising high school senior.

The good news is that the walls are not absolute. The right documents, signed in advance, can give you meaningful access when it matters. The bad news is that most families find this out only when they are already in a crisis and it is too late to get paperwork signed.

HIPAA: Health Information and Your Young Adult

The Health Insurance Portability and Accountability Act (HIPAA) governs how healthcare providers handle protected health information — known as PHI. PHI includes virtually everything generated in a clinical encounter: diagnoses, treatment notes, medications, appointment records, lab results, and even whether someone is a patient at a given practice.

What providers can and cannot share with you

Once your child is 18, HIPAA's default rule is clear: providers cannot share PHI with anyone — including parents — without written authorization from the patient. This applies to:

• The campus counseling center
• The student health clinic
• Your child's off-campus therapist, psychiatrist, or prescriber
• Any hospital where they are treated

This means a provider cannot tell you whether your child has been seen, what diagnosis they have been given, what medications they are taking, or how their treatment is going — unless your child has signed a written release authorizing that disclosure.

What you can do: You can share information with providers at any time. HIPAA restricts the outflow of health information, not the inflow. If you are concerned about something — a change in behavior you have noticed, a family history of a condition, something a roommate told you — you can call your child's provider and share it. They cannot confirm anything in response, but that information enters the clinical picture. Many parents do not realize this option exists.

The emergency exception: professional judgment

There is one meaningful carve-out in HIPAA for acute situations. Providers have discretion to disclose PHI to family members — without the patient's authorization — when they believe, in their professional judgment, that the patient presents an imminent danger to themselves or others, or when the patient is incapacitated and unable to make their own decisions.

This is not a broad exception. It does not allow ongoing disclosure of treatment information. It applies to acute, time-limited safety situations. A provider might call you if your child is hospitalized following a suicide attempt or an overdose. They are not obligated to do so, but the law gives them the latitude to exercise that judgment.

If your child is admitted to a psychiatric facility and cannot advocate for themselves, staff will typically involve family — especially parents who are physically present. But "typically" is not "always," and having the right legal documents in place (more on that below) removes ambiguity when things move fast.

Insurance EOBs: what they reveal

If your child is on your health insurance plan — allowed until age 26 under the Affordable Care Act — your insurance company will mail Explanation of Benefits (EOB) documents to the policyholder's address. These EOBs show the date a service was billed, the provider name, and the type of service (often categorized generically as "outpatient mental health" or "office visit"). They do not include session content, diagnoses, or therapy notes.

For families where mental health privacy matters, this is worth addressing directly. Most insurers allow the patient to request that EOBs be sent to a separate address or accessed only through an online portal the patient controls. Your student should be able to request this through the insurance company's member services line. This is a routine accommodation, not an unusual ask.

If your student is studying in another state and needs a therapist licensed there, or is abroad, they may need to use out-of-network benefits or a separate insurance plan — which may trigger a different EOB flow entirely.

FERPA: Academic Records and the School

The Family Educational Rights and Privacy Act (FERPA) is the educational counterpart to HIPAA. It governs how colleges and universities handle student education records — which include grades, transcripts, disciplinary records, course schedules, financial aid information, and records maintained by the dean of students office.

Before college, FERPA allowed you as a parent to access your child's school records. That changes when your child turns 18 or enrolls in a postsecondary institution, whichever comes first. At that point, the rights transfer entirely to the student.

What schools can and cannot share

Without a FERPA waiver signed by your student, the school cannot share with you:

• Grades or GPA
• Attendance records
• Whether your student is enrolled or has withdrawn
• Disciplinary actions or records
• Academic standing, including whether they are on probation

This applies to professors, registrars, academic advisors, and deans. A dean of students who hears that your child is struggling academically cannot call you to discuss it — even if they want to — without your student's written authorization.

One important note: Campus counseling records at most schools are maintained separately from the general student record and are governed by HIPAA, not FERPA. Your student's therapy notes are not an education record — they are a medical record. Even a FERPA waiver would not give you access to them.

The health and safety emergency exception

FERPA has an emergency exception that parallels HIPAA's. Schools may disclose education records — without student consent — to parents or appropriate parties when there is an articulable threat to the health or safety of the student or others. This is intentionally narrow. It is designed for genuine emergencies, not general parental concern.

In practice, this exception gives schools the authority to contact you if your student is hospitalized following a crisis, if campus safety is involved in a dangerous situation, or if the dean of students determines a genuine emergency exists. Schools vary in how broadly or conservatively they apply this standard. Some schools are fairly liberal in how they define an emergency; others hold the line tightly. You cannot count on it as a routine channel.

The Three Documents to Discuss Before Move-In

There is a narrow window — ideally before your student leaves for college — to put the right legal infrastructure in place. These three documents do not require an attorney to obtain. They do require an honest conversation.

1. HIPAA release of information

A HIPAA release authorizes a specific healthcare provider to share designated health information with named individuals. Most campus student health and counseling centers have their own release forms available on their portal or at the front desk. Private providers have their own version.

Key elements to discuss with your student:

• Scope: What can be shared? Options range from "confirm only that I am a patient" to "share safety concerns only" to "discuss my treatment fully." Most students are more comfortable with a limited release than a full one.
• Recipients: Who specifically should be authorized? The release names individuals — you, your spouse, a specific family member.
• Duration: Releases typically expire after a year and need to be renewed.

The framing that tends to work: "I am not asking for full access to your sessions. I am asking that if something serious happens, the people who love you most are not legally locked out." Many students will agree to a narrow release when they understand the distinction between therapeutic privacy and safety communication.

2. FERPA waiver

A FERPA waiver authorizes the school to share education records with designated parties — usually parents. Most schools process this through the registrar's office or the student portal during orientation. It is often a simple checkbox or a short form. It typically covers: grades, enrollment status, academic standing, and may include financial aid information.

This is separate from counseling records, which a FERPA waiver does not touch.

If your student is reluctant, a limited waiver is an option: some schools allow students to authorize specific types of information (enrollment status only, for instance) without opening the full academic record. Ask the registrar what options exist.

3. Healthcare proxy / durable power of attorney for health care

This is the document most families overlook, and it is arguably the most important one.

A healthcare proxy — also called a durable power of attorney for health care or healthcare agent designation — gives you the legal authority to make medical decisions on your student's behalf if they are incapacitated and cannot make decisions themselves.

Without it, if your student is unconscious following an accident, is in a medical coma, or is in a psychiatric hold and is not legally competent to make decisions, the hospital does not automatically defer to you. In some states and some situations, you may have rights as a parent. In others, you may not — or you may end up navigating a legal process at the worst possible time.

A healthcare proxy is a relatively short legal document and can often be obtained for free or low cost through:

• Your state's official health department website (many provide approved forms)
• The pre-law or legal aid clinic at your student's university
• Services like AARP or state bar association referral programs

Both parties must sign it — you cannot do this without your student's willing participation. This is not a document to spring on them at the last minute. Have the conversation early, explain what it covers, and frame it the same way you would a will: "This is not because I expect something to go wrong. It is because if something does go wrong, I want to be able to help."

Having the Conversation Without Making It Adversarial

The moment this conversation sounds like "I want to monitor you," most young adults shut down. The frame matters.

A more effective approach:

• Lead with the scenario, not the paperwork. "Let me tell you a situation I want us to plan for: you are in the hospital and cannot speak. How do I get access to help you?"
• Separate "routine access" from "emergency access." Many students who are not comfortable with you knowing their therapy details are entirely comfortable with you being able to make medical decisions if they are unconscious.
• Use their autonomy as the argument. "This form actually puts you in control. You get to name exactly what I can and can't be told."
• Acknowledge the developmental reality. "I know you are an adult and I am not supposed to manage your health for you anymore. I am not trying to. I just want to be useful if something serious happens."
• Let them set the limits on the HIPAA release. A narrow release — attendance confirmation plus safety disclosures — is better than no release. Do not hold out for full access or you may end up with nothing.

If They Will Not Sign

Not every young adult will agree to sign these documents, and you cannot force them to. What you can still do:

Share information one way. You can call any provider, any time, and share what you observe — behavioral changes, things your student said, family history that is clinically relevant. The provider cannot respond with information, but your observations become part of the clinical picture.

Request a wellness check. If you are genuinely concerned about your student's safety and cannot reach them, you can contact campus public safety, the dean of students, or — in a real emergency — local law enforcement to request a welfare check. Officers or campus staff will go to the student's location. This does not require your student's permission and does not violate any privacy law.

Call the dean of students. Deans of students exist partly to serve as a non-clinical bridge between concerned families and the campus community. They cannot tell you what your student's therapist has said, but they can listen to your concerns, check in on your student, and describe what services are available. Most are skilled at this.

Pay without requiring access. You can pay for therapy, fund a student's health insurance, or cover urgent care costs without any right to be told what the appointment was about. Many families do this. The provider can receive payment without discussing the patient's care with the payer.

What Happens in a Real Medical Emergency

The rules that feel rigid in ordinary circumstances tend to flex in genuine crises.

If your student is unconscious, actively suicidal and in psychiatric hold, or in a situation where they cannot meaningfully participate in their own care, most providers and institutions will involve parents as a practical matter — especially if you are physically present. Emergency rooms involve next of kin. Psychiatric facilities contact emergency contacts. Deans of students can invoke the health and safety exception under FERPA when the situation warrants it.

The legal reality is that providers always retain professional judgment. HIPAA does not prohibit disclosure in emergencies — it permits providers to use judgment about whether disclosure is appropriate. That means a provider who receives a frantic call from a parent about a student who just left the office saying they planned to hurt themselves has legal room to act, even without a signed release.

This does not mean you should count on informal processes to protect you. The documents matter most when things are ambiguous — when someone is not in obvious danger but is clearly unwell, when access to information would help you make better decisions, when the system is not sure what category the situation falls into.

Common Parent Mistakes

Showing up at the counseling center demanding information. Counselors are legally prohibited from confirming or denying that your student is a patient, let alone discussing their treatment. This approach will not get you information, it will likely create distance between your student and their therapist, and in rare cases it can be treated as a violation of the therapeutic relationship. Call, share your observations, and leave it there.

Calling the dean of students repeatedly. Deans of students are generally willing to engage with concerned parents, and they can be an important resource. But frequent calls about the same student who has not signed a FERPA waiver put the dean in an impossible position. One clear call with your specific observations is far more effective than repeated contact that signals surveillance.

Assuming the insurance EOB is a privacy violation. It is not a violation — it is how insurance billing works. The solution is proactive: have your student request EOB suppression through the insurer's member services, or redirect EOBs to an address or portal the student controls. This is easier to set up before there is a problem.

Waiting until there is a crisis to get the paperwork done. The window to have calm, unhurried conversations about HIPAA releases, FERPA waivers, and healthcare proxies is before college starts — or during winter break, or during summer, when no one is panicking. If you are reading this in the middle of a crisis, you can still make progress, but the conversations are harder.

The Bigger Picture

Privacy laws in adulthood exist for good reasons. The 18-year-old in therapy who knows their therapist cannot report back to their parents is more likely to be honest in that therapy. The student who knows their academic records are private is more likely to seek help from a dean of students without fear of family fallout. The legal architecture is not designed to frustrate you — it is designed to make it possible for young adults to get help without the chilling effect of surveillance.

Your goal as a parent is to position yourself as the person they call first, not to build a monitoring system around them. The documents covered in this post are not workarounds to undermine their independence. They are mutual agreements that let both of you move forward with more confidence: them knowing they are still in control, and you knowing you can show up when it actually counts.

For more guidance on supporting a college student's mental health from a distance, see Therapy for College Students and the Parents of College Students resource hub. For the broader transition to independence, A Parent's Guide to Helping Your Adult Child Launch covers the full picture.

---

Learn More About Supporting Your College Student

Understanding the rules is the first step. The Parents of College Students hub covers signs of struggle, how campus counseling works, when to step in, and how to stay connected from a distance.

Visit the Parents of College Students Hub