Minor Consent and Guardian Verification: Who Can Book a Visit

A grandmother calls to move a 9-year-old's cleaning. A father calls asking why his 16-year-old came in last week. A 17-year-old calls to book her own visit and asks that nobody phone the house. Your front desk decides in the moment what it is allowed to say to each of them, and an automated phone system has to decide faster, with less to go on.

Under the HIPAA Privacy Rule a parent, guardian, or other person acting in loco parentis is usually the minor's personal representative, so the answer is usually yes. But 45 CFR 164.502(g)(3) names 3 exceptions, and the Office for Civil Rights restated them in a letter to providers on 3 December 2025. Those exceptions follow state law, which varies enormously: 23 states and DC let all minors consent to contraceptive services, while 2 states prohibit it without a parent.

This post covers who may book, who may reschedule, who may be told anything at all about a minor's visit, what a phone system has to verify before it speaks, and why the safe default for an automated caller is to confirm nothing and route. It is not legal advice, and your policy has to be set with counsel for the states you practice in.

The default: a parent is the minor's personal representative

Under the HIPAA Privacy Rule, a parent, guardian, or other person acting in loco parentis is the minor's personal representative when applicable law gives them authority to make health care decisions. They stand in the child's shoes: they may access the record, book care, and receive information about it.

Authority comes from applicable law or a court order, not from who brings the child in.

That default runs in both directions, and practices tend to only worry about one of them. Saying too much to the wrong caller is a disclosure problem. Refusing a parent who is genuinely the personal representative is a right-of-access problem, and it is the one federal regulators wrote to providers about most recently.

In its 3 December 2025 letter, the Office for Civil Rights said parents are sometimes denied access to their children's records, or are told the child must authorize access first when no law requires it. Its own example is blunt: a practice cannot demand authorization from a 13-year-old before releasing that child's records to a parent in a state where parental consent is required for all care under 15. OCR also said a covered entity may not place limits on a parent's access beyond what applicable law already imposes.

The 3 exceptions, and why each one is scoped to a single service

The Privacy Rule names 3 situations where a parent is not the personal representative: the minor consented to the care alone, a court or a person the court appointed directed it, or the parent agreed to a confidential relationship with the provider. Each exception covers one service, not the whole chart.

That scoping is the part front desks get wrong. OCR's own worked example is a 16-year-old treated for a sexually transmitted infection in a state that permits it without parental consent. Depending on that state's law, the provider may withhold information about that care from the parent. The provider may not use it as a reason to withhold the rest of the child's record.

Which services fall inside the exceptions is a state question, and the spread is wide. Guttmacher's state-policy tracking, updated 1 August 2026, counts 23 states and DC that explicitly allow all minors to consent to contraceptive services, 16 states that allow it only in specific circumstances such as marriage or an existing pregnancy, and 2 states that prohibit it without parental consent. Sexually transmitted infection services are the outlier: all 50 states and DC allow minors to consent, though 8 states set an age minimum and 16 have provisions letting or requiring a provider to notify a parent.

The callers your front desk actually gets

Real calls about a child rarely come from a tidy list. You get a separated parent, a grandparent doing the school run, a nanny, a step-parent, a foster parent, and the teenager herself. Each one needs a different answer, and none of that is visible from the phone number.

Separated parents are the most common trap because the everyday language is misleading. Physical custody means the child lives with that parent. Legal custody carries the authority to make health care decisions, and the two do not have to sit with the same person. Malpractice-carrier guidance for physicians is direct on the consequence: one parent cannot be denied access to a child's records merely because they are not the physical custodial parent.

The fix practices are told to use is documentary rather than conversational. Capture the custody order at intake, note who holds decision-making authority, and record it where the front desk and the phone system can both see it. A caller asserting authority on a call is not evidence of it, and no script can turn it into evidence.

Conservative by design. An unverified caller gets nothing confirmed and the call goes to your staff.

The table is deliberately conservative in the middle rows. A grandparent who brings a child to every visit may well be the right person to talk to, and your practice can make that true by recording a written parental authorization. What it cannot be is a judgment the system makes on the strength of a familiar voice.

What a phone system can verify, and what it cannot

The Privacy Rule requires you to verify both the identity of a person asking for protected health information and their authority to have it, whenever either is unknown. A voice system can check a caller against a list your staff maintains. It cannot read a custody order or weigh professional judgment.

Start with what the system genuinely knows. It has a calling number, which the FCC describes as trivially falsifiable: spoofing is a caller deliberately falsifying the information sent to your caller ID display to disguise their identity. It has whatever the caller says, which is an assertion. And it has the practice record, which is the only one of the three that anybody verified.

So the honest capability list is short. A phone system can match a caller to authorized contacts already stored on a record, and it can confirm a fact the caller already supplied. It cannot decide who is acting in loco parentis, cannot interpret a custody order, and cannot apply a state confidentiality exception to a specific visit.

The regulator draws that line explicitly. Where state law is silent on parental access and the parent is not the personal representative, HHS says the decision to grant or deny must be made by a licensed health care professional exercising professional judgment. The abuse, neglect and endangerment provision at 164.502(g)(5) is stricter still: OCR calls it an individualized, patient-specific professional determination by the provider.

Design the call so the default is to confirm nothing

Build the flow so an unverified caller learns nothing. The system greets, identifies the patient the caller names, checks that caller against the authorized contacts already in the record, and either confirms a narrow fact or hands the call to staff. Every other path ends in a warm transfer.

Identify the patient first, the caller second, and route every case the flow cannot settle.

Three design rules carry most of the weight. First, confirm rather than reveal: the caller supplies the detail and the system says yes or no, so a caller who does not already know the appointment time never learns it. Second, treat booking authority and information access as 2 separate permissions, because a system that grants them together will eventually hand over the second by accident. Third, flag the service, not the patient: a visit your policy marks confidential is never described on a call, whoever is asking.

The record is where all of this lives. Guardian status, custody authority, authorized contacts, and confidential-service flags are set by your staff during intake or a records request, with the paperwork in front of them. They are never inferred mid-call. If you are still working out where an automated line belongs in a practice at all, what an AI receptionist does and where it stops is the wider version of that boundary, and the parent-as-caller problem in pediatrics covers the clinical half of it.

Field note

Before an automated line handles calls about minors

• Your written policy on who may book and who may be told exists, reviewed by counsel for each state you operate in.
• Authorized contacts and custody authority are recorded per patient by staff, never inferred on a call.
• Confidential-service flags suppress the visit reason on every outbound and inbound interaction.
• Someone reads a week of minor-related transcripts end to end before you widen what the system may confirm.

Set the policy before you configure the phones

Your practice sets this policy with its own counsel, for every state it operates in, and then the phone system follows it. Reverse that order and you have a vendor default deciding a legal question. Write down who may book, who may be told what, and how staff record it.

The vendor is a business associate the moment it touches patient details, so a signed Business Associate Agreement comes before any real call. That contract plus a correct configuration is what people mean by "HIPAA compliant"; there is no such thing as a "HIPAA certified" product, and a vendor page claiming otherwise tells you something about the vendor. The honest version of that compliance question goes through what a BAA does and does not buy you.

OCR's December letter told covered entities to work with business associates so that default electronic-access configurations do not improperly block parents who are personal representatives. Read that instruction in both directions. A default too tight blocks a parent who has a legal right of access. A default too loose discloses a 17-year-old's confidential visit to a caller nobody verified. Only your written policy tells the vendor which way to lean, and only your staff can put the facts in the record that let the system apply it.

Match the call flow to your own state and policy

Start from the patient, not the caller. Identify the minor's record, check whether the caller is on the authorized list, then check whether the visit falls under a service the minor consented to alone. If any answer is unclear, the call goes to a person who can decide.

Route by verified authority and service type, never by how confident the caller sounds.

Walk it once. An unrecognized caller gets a message taken and nothing confirmed. A recognized caller asking about a service the minor consented to alone gets routed to clinical staff without a description of the visit. A recognized caller who only wants to move an appointment gets it moved, with the time and place read back and nothing else. Everything left over goes to a person.

Pilot it narrowly. Let the system book and reschedule for verified callers first, keep every other minor-related request on a transfer, and read the first week of those calls end to end before you widen what it may confirm. If you would rather see where your phones are losing patients before you touch any of this, the free Growth Leak Audit sizes that from your own numbers first.