HIPAA and FERPA Releases When Your Disabled Child Turns 18 in Massachusetts

The Privacy Wall That Hits on the 18th Birthday

The day your child turns 18, two federal privacy laws flip a switch that cuts you out of the information loop — even if nothing about your child's abilities has changed.

HIPAA (Health Insurance Portability and Accountability Act) governs medical records and healthcare information. Before 18, parents access their child's medical records as a matter of course. After 18, the young adult is the sole authorized recipient of their own health information. Hospitals, clinics, and pharmacies cannot share diagnoses, treatment plans, medication changes, or appointment notes with parents unless the adult patient explicitly authorizes it.

FERPA (Family Educational Rights and Privacy Act) governs educational records. Before 18, parents have the right to access school records, attend meetings, and receive copies of evaluations. After 18, those rights transfer entirely to the student — including the right to access IEP documents, evaluation results, and transition plans.

For parents of disabled young adults who have been managing complex medical regimes and educational placements for years, this sudden information blackout is one of the most disorienting parts of the turning-18 transition.

HIPAA Release: Getting Back Into the Medical Loop

A HIPAA authorization form (technically a release under 45 C.F.R. § 164.508) allows the young adult to designate specific people who can receive their protected health information. Most hospitals and clinics have their own version of this form.

What it does:

• Authorizes named individuals (parents, siblings, advocates) to receive medical information
• Can be scoped broadly ("all medical records") or narrowly ("records related to psychiatric treatment at this clinic")
• Can specify the duration: indefinite, one year, or until revoked
• Can be revoked by the patient at any time

What it doesn't do:

• Does not authorize anyone to make medical decisions — that requires a healthcare proxy
• Does not grant access to psychotherapy notes (these are a separate, more restricted category under HIPAA)
• Does not apply to substance abuse treatment records governed by 42 C.F.R. Part 2 (these require their own specific consent form)

Execution requirements: The young adult must sign the form. There are no witness or notarization requirements for a HIPAA release, making it one of the simplest legal documents in the transition toolkit.

Capacity consideration: If the young adult understands that they are allowing their doctor to talk to their parent about medical matters, they have sufficient capacity to sign a HIPAA release. The comprehension threshold is low. Even many individuals who may lack capacity for more complex legal documents (healthcare proxy, durable power of attorney) can validly execute a HIPAA release.

FERPA Release: Staying in the IEP Process

After 18, the student — not the parent — holds the rights to control educational decision-making and disclosure of educational records. DESE guidance nevertheless says the parent continues to receive required notices and has the right to inspect the student's records; a separate FERPA consent may be needed for broader disclosures.

The Massachusetts shortcut: Under DESE Administrative Advisory SPED 2011-1, the student can choose one of three options at their IEP meeting: full self-determination, shared decision-making with a parent, or complete delegation of educational authority to a parent. The choice is documented through the school district's process, and DESE guidance says the parent continues to receive required notices and has the right to inspect the student's records.

When a standalone FERPA release matters: A student can use the school district's FERPA consent process to authorize disclosure beyond the required notices and record-inspection rights described above, specifying what records can be shared and with whom.

College and post-secondary: FERPA applies to colleges and post-secondary programs too. If the young adult enrolls in a community college program, vocational school, or transition-age program at a college campus, a new FERPA release specific to that institution is needed. The IEP-based SPED 2011-1 options don't carry over.

When Releases Aren't Enough: The Guardianship Threshold

HIPAA and FERPA releases solve the information access problem — parents can see records and talk to providers. But they don't solve the decision-making problem.

A young adult who lacks the capacity to understand what they're signing when they execute a HIPAA release creates a legally vulnerable situation. A hospital that accepts a HIPAA authorization signed by someone without capacity could face liability. In practice, most providers err on the side of accepting signed forms rather than challenging them, but a hostile or cautious institution could refuse.

If the young adult genuinely cannot comprehend the authorization — cannot understand the concept that they are allowing someone to see their medical information — then guardianship may be the only path to legally enforceable information access. A court-appointed guardian with authority over medical decisions automatically gains access to the ward's medical records as part of that authority. Similarly, a guardian with educational decision-making authority has FERPA access.

This is one of the clearest practical scenarios where the difference between "can sign a form" and "cannot sign a form" determines whether a family needs court involvement.

Practical Steps to Set Up Both Releases

Before the 18th birthday — ideally 2-3 months ahead:

1. Contact the young adult's primary care provider and specialists to get their HIPAA release forms. Many practices use their own templates.
2. Contact the school district's special education department about SPED 2011-1 options. The age-of-majority notice letter is sent at 17, which is the natural trigger for this conversation.
3. If the young adult is enrolled in any outside programs (therapy centers, day programs, residential facilities), get their HIPAA release forms too.

On or shortly after the 18th birthday:

4. Have the young adult sign all HIPAA release forms. Keep copies — you'll need them at every new provider.
5. At the next IEP meeting, formalize the SPED 2011-1 choice (shared, delegated, or full self-determination).
6. If the young adult will be accessing any post-secondary program, anticipate the need for a separate FERPA release at that institution.

Keep renewal dates on your calendar. Some HIPAA authorizations expire after one year. If you set a specific duration, you'll need to re-execute the form before it lapses.

Building the Complete Privacy and Decision-Making Framework

HIPAA and FERPA releases are two pieces of a broader turning-18 legal framework that also includes healthcare proxies, durable powers of attorney, representative payee appointments, and educational delegation arrangements. The Massachusetts Adult Guardianship & Alternatives Guide maps each of these tools against the specific decision-making domains where your young adult needs support, so you build exactly the right combination without defaulting to court proceedings that may not be necessary.

See more Massachusetts guides →