Utah FERPA and HIPAA Release for a Disabled Adult Turning 18

Why Your Access Disappears Overnight

The day your child turns 18, two federal privacy laws simultaneously shift against you. FERPA (Family Educational Rights and Privacy Act) transfers all school records rights from the parent to the student. HIPAA (Health Insurance Portability and Accountability Act) requires that your adult child — not you — authorize any release of protected health information. These shifts happen automatically, regardless of diagnosis, IQ scores, or daily care needs.

For parents of a young adult with an intellectual or developmental disability, this creates an immediate practical crisis. The IEP coordinator who called you last week about schedule changes now needs your child's written permission to discuss anything. The pediatrician's office that has always cc'd you on lab results will stop. Pharmacies, therapists, and specialists all fall under the same rule.

The fix isn't complicated, but it does require paperwork — and ideally, you should complete it before the birthday.

FERPA: Getting School Records Access Back

Under FERPA, an "eligible student" (anyone 18 or older, or attending a postsecondary institution) controls who can see their education records. In Utah, where students with active IEPs can receive services through age 21 (until they turn 22 after July 1 of the school year under USBE Rule R277-419), this access question remains relevant for years after the 18th birthday.

If your adult child has decision-making capacity, even with support, the simplest path is a signed FERPA consent form. Most Utah school districts use a standard release form available through their records office. The form must specify:

• Your name as the authorized recipient
• Which records are covered (check "all education records" to avoid gaps)
• A signature and date from the student

Under Utah's Supported Decision-Making Act (effective May 2025), a designated supporter can help your adult child understand what the release means and assist them in completing the form. Schools generally must recognize a valid Supported Decision-Making Agreement (SDMA) under Utah Code § 75-5-701 et seq., subject to statutory exceptions.

If your adult child lacks capacity to consent, you need a legal mechanism that grants you authority over educational decisions. Options include:

• Educational Representative under USBE Rule R277-752, which transfers educational consent to a parent or surrogate without requiring court proceedings
• Limited guardianship with authority specifically covering educational decisions

With either in place, you can request records, attend IEP meetings, and make educational decisions as if the student were still a minor.

HIPAA: Restoring Medical Records Access

HIPAA works differently from FERPA. Rather than a single consent form, you need one of several recognized legal bases to access another adult's protected health information:

HIPAA Authorization Form. If your adult child can understand what they're signing, a standard HIPAA authorization naming you as an authorized recipient is the fastest route. Most healthcare providers have their own form, but you can also use a general HIPAA release. The authorization must include the specific information covered, who can receive it, an expiration date, and your child's signature.

Utah Advance Health Care Directive (AHCD). Under Utah Code § 75-2A-101, your adult child can name you as their healthcare agent. Once activated (when a clinician certifies incapacity), this grants you access to medical records needed to make treatment decisions. Before activation, a provider may still require a separate HIPAA authorization for routine records access.

Court-ordered guardianship. If a judge grants you guardianship over healthcare decisions, HIPAA's "personal representative" rule (45 CFR § 164.502(g)) applies — you step into your child's shoes for medical privacy purposes within the scope of the court order. Under Senate Bill 161 (2026), a protected person's HIPAA rights are explicitly preserved, meaning the guardian must still act within the scope of their court order.

Practical Steps Before the 18th Birthday

Three to six months before turning 18:

1. Get a capacity assessment. Work with your child's treating clinician to determine whether they can understand the concept of authorizing someone to see their records. This assessment also informs the broader question of whether voluntary tools (SDMA, AHCD) or court-ordered guardianship is appropriate.

2. Prepare the forms. If your child has capacity, draft both a FERPA consent form and a HIPAA authorization. Have them signed before the birthday so there is no gap in access.

3. Distribute copies proactively. Send the signed forms to every provider, school office, pharmacy, and therapist your child uses — don't wait for them to refuse access and force you to scramble.

4. If capacity is lacking, begin the process for appointing an Educational Representative (for school records) and filing a guardianship petition (for medical records). Parents can file a guardianship petition up to six months before the 18th birthday under Utah Code § 75-5-317.

What If a Provider Refuses Your Authorization?

Providers occasionally push back on FERPA releases or HIPAA authorizations, particularly if staff are unfamiliar with Supported Decision-Making Agreements. Third parties generally must respect a valid SDMA, subject to statutory exceptions.

If you encounter resistance, contact the Utah Disability Law Center at 1-800-662-9080 — they specifically assist families when institutions refuse to recognize valid legal documents.

Keeping Access Organized Long-Term

The Utah Adult Guardianship & Alternatives Guide includes a key contacts directory and document organization system designed for exactly this situation — tracking which providers have current authorizations on file, when those authorizations expire, and what legal basis supports your access. For families juggling multiple providers, school teams, and benefit agencies, having that information in one place prevents the gaps that lead to crisis moments.

See more Utah guides →