Nebraska Child Medical Records and HIPAA Access for Grandparents

You take your grandchild to the pediatrician and ask for their vaccination history. The receptionist asks whether you are the parent, and when you say no, the conversation stalls. The clinic is not being difficult — they are following federal privacy law. Understanding how HIPAA works for relative caregivers in Nebraska is the difference between a quick records transfer and weeks of frustrating phone calls.

Why Clinics and Hospitals Ask for Proof

The Health Insurance Portability and Accountability Act (HIPAA) restricts who can access a minor's medical records held by healthcare providers, hospitals, and clinics. Unlike school records (which fall under FERPA), clinical records are governed by HIPAA's stricter disclosure rules.

Under HIPAA, a "personal representative" of a minor can access the child's protected health information. Because Nebraska's age of majority is 19, a parent or legal guardian generally acts as the personal representative for a minor under 19, subject to exceptions when state law lets the minor consent to the service, a court or another person has authorized the service, or treating the parent as representative could endanger the child. A grandparent or relative caregiver is not automatically the personal representative — they need legal authority to make healthcare decisions.

What Gives You HIPAA Access in Nebraska

In Nebraska, two primary instruments establish the authority a clinic needs to release medical records to a non-parent caregiver:

A notarized § 30-2604 Power of Attorney that delegates parental powers grants the caregiver medical decision-making authority. When a provider sees a valid, unexpired POA that includes healthcare powers, they can treat you as a personal representative for HIPAA purposes. Present the notarized original or a certified copy, and ask the clinic to scan it into the child's chart so you do not need to re-present it at every visit.

A court-appointed guardianship order under Neb. Rev. Stat. § 30-2608 provides legal authority that generally includes access to medical records, subject to confidentiality rules for services a minor may consent to on their own, such as STI treatment under § 71-504 and mental-health services at age 18 under § 43-2101(2)(b), and any applicable Part 2 protections.

What does not work: the NDE Rule 19 school enrollment form. That form gets a child into school — it does not grant access to records held by outside medical providers. A school enrollment form and a medical records release are two entirely different legal mechanisms.

FERPA Records vs. HIPAA Records

This distinction trips up many caregivers. Here is the dividing line:

• FERPA governs records maintained by the school district — cumulative academic files, IEP documents, Section 504 plans, and school nurse visit logs. If you signed a Rule 19 enrollment form or hold a § 30-2604 POA, you can review FERPA-protected records at the school.
• HIPAA governs records held by external providers — the pediatrician's office, the dentist, the hospital, a mental health counselor in private practice. These records require the POA or guardianship order.

A school nurse's notes about a visit to the school clinic fall under FERPA. The same child's chart at their outside pediatrician falls under HIPAA. Same child, different laws.

Substance Abuse and 42 CFR Part 2

If the child is receiving substance use disorder treatment through a program covered by 42 CFR Part 2, additional federal rules apply. Under 42 CFR § 2.14, when state law lets a minor independently apply for and obtain substance use disorder treatment, only the minor may authorize Part 2 uses and disclosures. When state law requires parental consent for treatment, written consent for uses or disclosures generally requires both the minor and the parent or guardian. A POA or guardianship does not remove those protections.

Getting Access Without Delays

The practical steps that prevent refusals:

1. Execute a § 30-2604 POA that explicitly includes healthcare decision-making authority
2. Make certified copies and deliver one to every provider the child sees — pediatrician, dentist, specialist, mental health counselor
3. Ask each office to note in the child's chart that you are the authorized caregiver with POA on file
4. If a provider requests a separate HIPAA authorization form signed by the parent, have the parent complete it at the same time they sign the POA — while you have their cooperation
5. Track the six-month expiration date and re-execute before the POA lapses, because an expired document gives the clinic grounds to lock you out again

The School and Medical Consent guide for Nebraska includes the complete medical consent matrix, a document readiness checklist for provider visits, and the renewal tracker that keeps your authority current across every six-month cycle.

See more Nebraska guides →