HIPAA Medical Authorization for College Students: A Parent’s Guide

At 18, your student becomes their own patient, legally. That means the campus health center, urgent care, or any hospital they visit will not confirm to you that your student was even seen, let alone share what happened, unless a HIPAA authorization says otherwise. Insurance status, tuition payments, and the fact that you are on the family plan do not change this.

A HIPAA authorization is the document that changes it, and it is a separate form from a FERPA release. This guide covers what a valid authorization actually includes, what to leave out, and what happens if nothing is on file when you need it.

Jump to:

• What HIPAA covers, and what it does not
• Why this is a separate document from FERPA
• What a valid authorization includes
• Mental health records need a closer look
• If nothing is on file and something goes wrong
• How to actually get it signed
• FAQ

What HIPAA covers, and what it does not

HIPAA (45 CFR Parts 160 and 164) governs protected health information held by covered entities: doctors, hospitals, insurers, and most health centers. It applies to medical records, treatment notes, prescriptions, lab results, and mental health records maintained by a covered provider.

It does not automatically transfer to you as a parent just because you carry your student on your insurance or pay the premiums. The patient controls their own health information at 18, full stop.

Why this is a separate document from FERPA

FERPA and HIPAA are frequently confused because colleges themselves sometimes blur the line. Here is the distinction: FERPA covers education records (grades, enrollment, academic standing). HIPAA covers protected health information at covered entities (off campus doctors, hospitals, insurers, and health centers that operate as independent covered entities).

One wrinkle worth knowing: FERPA has its own carve-out for what it calls treatment records, meaning records made by a health professional in connection with treating a student and shared only with the people involved in that treatment. When a campus health center’s records fit that description, they are governed by FERPA, not HIPAA, even though the school may otherwise be a HIPAA covered entity. The moment those records get used or shared for something beyond the student’s own treatment, they lose that protection and HIPAA can apply instead. HHS addresses this exact scenario in its FAQ on postsecondary health clinic records. Our FERPA release guide covers that side of the process, since it may be the form you actually need for on campus health visits.

What a valid authorization includes

A HIPAA authorization (45 CFR Section 164.508) needs to name the providers it applies to (or state “all current and future treating providers”), name the recipient (you), and specify what information is covered. The categories on a typical authorization form include:

• General medical records and treatment history
• Mental health treatment records (see the note below; many states add protections beyond HIPAA here)
• Substance use or addiction treatment records (governed by the additional federal protections in 42 CFR Part 2, which was substantially amended in February 2024 to align more closely with HIPAA and permit redisclosure in more circumstances; some protections remain, so confirm current requirements with the provider)
• Prescription medications
• Lab results, imaging, and diagnostics
• Emergency and hospitalization records
• Billing and insurance information
• Or, a general blanket authorization covering all of the above

The authorization also needs an effective date and an expiration (either a date, or an event like graduation), and your student retains the right to revoke it at any time by giving written notice to the provider. Revocation does not undo disclosures already made in reliance on the authorization. Importantly, treatment can never be conditioned on your student signing this form. One more detail worth knowing before your student signs: whoever they authorize to receive this information can potentially redisclose it, and once they do, it is no longer protected under HIPAA. That is one reason some families choose to name specific providers rather than defaulting to the broadest possible authorization. HHS lists the full set of required elements in its authorizations FAQ.

Mental health records need a closer look

Mental health records get flagged separately on most authorization forms for a reason. HIPAA itself already treats one narrow category differently: true psychotherapy notes, the private notes a therapist keeps separate from the rest of your student’s chart to record what was discussed in a session, get extra federal protection beyond what applies to routine diagnoses, treatment plans, and progress notes. States frequently add their own layer on top of that. Colorado, for example, adds a consent requirement for psychotherapy notes beyond what HIPAA requires on its own. Check your state’s specific rules, or ask the provider directly, before assuming a general authorization covers counseling records the same way it covers a physical.

The same campus health center distinction from the FERPA guide applies here too: mental health records at a counseling center operating under FERPA, not HIPAA, are not covered by a HIPAA authorization at all. Clarify which law actually governs your student’s specific provider before you submit either form.

If nothing is on file and something goes wrong

Without an authorization, providers still have a narrow path to share information in a genuine emergency. Under the HIPAA emergency exception (45 CFR Section 164.512(j)), a provider may disclose protected health information to prevent or lessen a serious and imminent threat. The key detail: this requires the provider’s own good faith clinical judgment that disclosure is necessary. Your consent is not the gating factor, their judgment is, though specific information you share with them about your student’s behavior can inform that judgment.

If you believe your student may be in danger and no authorization is on file, our FERPA and HIPAA Parent Toolkit has email templates and a campus police welfare check script that cite both the HIPAA and FERPA emergency exceptions by regulation number.

How to actually get it signed

1. Talk about it before move in, not after a crisis. This is a much easier conversation to have calmly over the summer than during an actual emergency.

2. Use the campus health center’s own form, if they have one. Many campus health centers keep their own authorization on file that only applies to their office. A broader authorization covering off campus providers, like the one in our 18th Birthday Legal Kit, is still worth having for urgent care visits, hospitalizations, or off campus specialists.

3. Decide the scope together. Talk through which categories actually matter to your family. A blanket “all health information” authorization is simpler, but some students are more comfortable starting narrower, particularly around mental health records, and widening it later if needed.

4. Keep a signed copy in your family document vault. A signed authorization that no one can find when it is needed is functionally the same as not having one.

HIPAA covers medical decisions; a companion law covers academic records. See our FERPA Educational Records Release guide for how to request access to your student’s transcripts, grades, and financial aid records.

FAQ

Does being on my insurance plan give me access to my student’s medical records?
No. Insurance coverage and record access are unrelated under HIPAA. A signed authorization is what grants access, regardless of who pays the premium.

Is a HIPAA authorization the same as a healthcare proxy or medical power of attorney?
No. A HIPAA authorization lets you receive information. A healthcare proxy lets you make medical decisions on your student’s behalf if they are incapacitated. Most families need both; they are separate documents in our Legal Kit.

Can my student limit the authorization to just one provider?
Yes. The form can name a specific provider or facility, or it can be left broad to cover all current and future treating providers.

What if my student refuses to sign anything?
Respect it, and consider offering the narrower version first (a single provider, or excluding mental health records) rather than pushing for the blanket authorization. Something on file is better than nothing, even if it is limited.

Does this apply to campus counseling center records?
It depends on whether that counseling center operates under FERPA or HIPAA, which varies by school. See the note above and confirm directly with the center. HHS and the Department of Education cover this exact overlap in their joint guidance on FERPA and HIPAA for student health records.

This article is for informational purposes only and does not constitute legal advice. State laws governing health information may be broader than HIPAA, and individual institutional policies vary. Consult a licensed attorney in your state before relying on any document, and confirm your specific school’s and provider’s process directly.

Related reading: The Family Document Vault, FERPA Educational Records Release.