HIPAA and FERPA Releases for Disabled Adults in Delaware

The Access Wall at 18

The day your child turns 18, federal privacy law redraws the lines around their medical and educational records. HIPAA generally prevents a provider from disclosing the adult's protected health information to you without the adult's authorization or applicable personal-representative authority. FERPA transfers control of their school records from you to them. These aren't optional policies that providers choose to enforce — they're federal mandates with real penalties for violations.

For families of young adults with intellectual or developmental disabilities, this creates an immediate practical crisis. The parent who has managed every medical appointment, every IEP meeting, and every medication adjustment is suddenly locked out unless they hold the right legal documentation.

HIPAA: Medical Record and Treatment Access

Under HIPAA's Privacy Rule (45 CFR § 164.502), an adult generally controls access to their protected health information once they reach 18. Healthcare providers — including Delaware networks like Nemours Children's Health and ChristianaCare — cannot share treatment plans, lab results, appointment notes, or medication lists with a parent without the patient's written authorization or applicable personal-representative authority.

The most direct solution is a HIPAA Authorization Form, signed by the adult child, naming specific individuals who can access their health information. This form should specify:

• Which providers or health systems it covers
• What types of information can be shared (all records, specific conditions, or defined date ranges)
• How long the authorization lasts (an expiration date, or until revoked)
• That the authorization can be revoked at any time

If the young adult has capacity to sign this form, it should be executed before or on their 18th birthday. Many families pair the HIPAA authorization with an Advance Health-Care Directive, which names a healthcare agent who can make medical decisions when the individual cannot communicate.

How Delaware's SDM Act Addresses HIPAA

Delaware's Supported Decision-Making Act (16 Del. C. Ch. 94A) gives supporters the legal authority to help the individual access and understand health information without replacing them as the decision-maker. When the SDM agreement designates "health affairs" as an area of support, the named supporter can:

• Accompany the individual to medical appointments
• Request and receive medical records on the individual's behalf
• Help explain treatment options and consequences

An SDM agreement does not by itself override HIPAA. The supporter should present the agreement together with a signed, specific HIPAA authorization; the provider can then share records consistent with that authorization.

The SDM agreement establishes the ongoing support relationship, while the HIPAA authorization addresses the provider's records-disclosure requirements. Families should ask each provider whether it needs its own authorization and file copies with the relevant medical-records department.

FERPA: School Record Access After 18

FERPA (20 U.S.C. § 1232g) transfers all education record rights to the student at 18, including the right to access records, consent to their release, and request amendments. Parents lose their automatic right to review IEP documents, evaluation reports, progress data, and discipline records.

For students still receiving special education services, this transfer coincides with the broader age-of-majority shift under IDEA. Delaware handles this through two mechanisms:

Voluntary Grant of Authority (VGA): If the adult student has capacity, they can execute a VGA form delegating their educational decision-making rights to a representative. This delegation includes FERPA access — the designated representative can review and receive education records with the same authority the parent previously held.

Educational Representative Appointment: If the IEP team determines the student lacks capacity to provide informed consent, the team appoints an Educational Representative following Delaware's mandatory priority order (parent first, then adult relative, then DOE-appointed Educational Surrogate Parent). The appointed representative inherits full FERPA access as part of the educational authority.

Timing the Documentation

The gap between turning 18 and having proper releases in place is where access crises happen. A parent calls to refill their child's medication and gets told the pharmacy can't discuss the prescription. A provider refuses to share test results before a critical IEP meeting.

The practical solution is to have all releases executed before the 18th birthday takes effect:

• HIPAA Authorization signed and filed with every active healthcare provider
• SDM Agreement (if applicable) signed with two witnesses and distributed to providers
• VGA or educational POA signed and delivered to the school district

File copies with each provider's medical records or front office — don't assume that one central filing covers the entire health system.

When Guardianship May Be Needed for Broad Access

If the young adult lacks the capacity to sign these documents, the family must consider whether guardianship or another applicable surrogate or personal-representative pathway is necessary. A guardian of the person with authority over healthcare is generally treated as the adult's personal representative under HIPAA and can consent to or refuse treatment on the ward's behalf. A court order may then provide authority without requiring separate provider releases.

But guardianship is a heavy tool for solving an access problem. The Delaware Adult Guardianship & Alternatives Guide helps families evaluate whether the access gap alone justifies a guardianship petition or whether a combination of less restrictive mechanisms covers their actual needs.

See more Delaware guides →