HIPAA and Parent Rights After 18 in Hawaii

The Medical Lockout at 18

Your child turns 18. You call their doctor to schedule an appointment or get test results. The front desk tells you they cannot share any information without the patient's consent. You have been managing their medical care for 18 years, and overnight, you have no legal right to access their records, speak with their providers, or make medical decisions.

This is not the doctor being difficult. Under HIPAA (the Health Insurance Portability and Accountability Act), once a person turns 18, they generally control access to their own protected health information unless they authorize someone else or a legal personal representative has authority. Parents, regardless of their child's disability status, lose default access to medical records, treatment plans, prescription information, and provider communications.

For families whose adult child has an intellectual or developmental disability and cannot independently manage their own health care, this creates an immediate practical crisis. The good news: Hawaii law provides several tools to restore access without necessarily going to court for guardianship.

HIPAA Authorization: The Simplest Solution

If your adult child has the capacity to understand and sign a form, a HIPAA authorization is the fastest way to restore your access. This is a straightforward document where the individual names specific people who are authorized to receive their protected health information.

A HIPAA authorization is not a power of attorney. It does not give you the right to make medical decisions or consent to treatment — it only permits providers to share information with you. Think of it as opening a window to see what is happening, not handing you the steering wheel.

Most Hawaii health care providers (Kaiser, Hawaii Pacific Health, Queen's Health Systems) have their own HIPAA release forms. Your child signs one at each provider's office, naming you as an authorized recipient. The authorization can be as broad (all medical information) or narrow (specific conditions only) as the patient chooses.

The limitation: this only works if your child has the legal capacity to sign. If they cannot understand what they are authorizing, the form is not valid, and you need a different legal instrument.

Advance Health Care Directive

An advance health care directive under HRS Chapter 327E does double duty. It designates a health care agent with the authority to make medical decisions if the individual loses capacity, and it implicitly grants that agent access to the medical information needed to make those decisions.

For transition planning, the AHCD is stronger than a standalone HIPAA release because it provides both information access and decision-making authority. The individual must have capacity to execute the document — they need to understand what they are signing and the consequences of designating an agent.

If your child can sign an AHCD before their 18th birthday (or shortly after), it addresses both the HIPAA information gap and the medical decision-making gap in a single document.

When You Need More Than a Signature

If your adult child does not have the capacity to sign a HIPAA authorization or execute an advance health care directive, voluntary instruments cannot solve the problem. You are in the territory of court-ordered authority:

Court-appointed guardianship under HRS Chapter 560 gives the guardian authority over personal and medical decisions within the court order. To request records, provide the court-issued Letters and follow the provider's process. This is the most comprehensive solution but also the most restrictive — it removes your child's right to make their own medical decisions.

Limited guardianship can be tailored to cover medical decisions specifically while leaving other rights (financial, residential, voting) intact. A limited order that includes medical authority gives you HIPAA access in the specific domain the court authorizes.

Supported decision-making under Act 284 allows a supporter to assist the individual in accessing and understanding medical information. The statute specifically permits supporters to "access, collect, and obtain" information relevant to the individual's decisions. While an SDM agreement is not a traditional HIPAA authorization, HRS § 349F-5 provides liability protection for third parties (including health care providers) who act in good faith reliance on a valid SDM agreement. Some providers accept SDM agreements for information sharing; others remain unfamiliar with the new law and may need a copy of the statute.

Practical Steps for Families

Before the 18th birthday: Have your child sign a HIPAA authorization at each provider and execute an advance health care directive if they have capacity. Do both — they serve different functions and reinforce each other.

At each provider: Ask specifically whether they accept Hawaii SDM agreements or POA documents for information sharing. Some have updated their policies since Act 284 passed in 2025; others have not. Bring a copy of the relevant statute if needed.

If providers refuse: Contact the Hawaii Disability Rights Center (HDRC). As the state's federally mandated protection and advocacy agency, HDRC can intervene when providers incorrectly refuse to honor valid legal instruments like SDM agreements or properly executed powers of attorney.

The Hawaii Adult Guardianship & Alternatives Guide includes sample scripts and statutory references you can share with medical offices to facilitate acceptance of these instruments.

See more Hawaii guides →