Can a Grandparent Get Medical Records in Oregon? HIPAA and Caregiver Access

The Records Problem

You've taken your grandchild to the doctor. The appointment went fine — but when you ask for the child's previous medical records, or try to log into the patient portal, the front desk says they can't share anything without parental authorization. HIPAA, they tell you.

This is one of the most common friction points for kinship caregivers in Oregon. The Health Insurance Portability and Accountability Act (HIPAA) controls who can access a patient's medical information, including a minor's records. But HIPAA doesn't lock grandparents out — it just requires the right documentation.

How Caregiver Documents Give You Access

Under the HIPAA Privacy Rule, a "Personal Representative" can access a minor's medical records and make healthcare decisions on their behalf. In Oregon, holding a valid Relative Caregiver Affidavit (ORS 109.580) or a Delegation of Parental Powers (ORS 109.056) establishes you as a personal representative for the child's general medical care.

That means you can:

• Inspect and request copies of the child's medical charts
• Access online patient portals
• Pick up prescription refills
• Receive lab results and diagnostic reports
• Communicate with providers about treatment plans

Present your caregiver affidavit or delegation to the provider's records department or front desk. Most healthcare systems will make a copy for the child's file and grant you portal access once the document is on record.

The Exception: Teen Self-Consent Records

Oregon's minor consent laws create a boundary within HIPAA that applies even to caregivers. When a minor independently consents to care under Oregon statute, those specific treatment records may be protected from caregiver access.

The situations where this comes up:

• Age 14 and older: A teen who consents to outpatient mental health or substance abuse treatment under ORS 109.675 controls disclosure of those treatment records. The provider must eventually involve parents or guardians unless doing so would be clinically harmful — but the teen's records for that specific treatment aren't automatically accessible to you.
• Any age: STI testing and treatment, reproductive health care, and birth control records are confidential under ORS 109.640 regardless of the patient's age. Providers cannot share these with caregivers without the minor's written consent.

This doesn't mean you're shut out of the child's general medical care. Routine checkup notes, vaccination records, and treatment for ordinary illnesses remain accessible through your caregiver document. The restriction applies only to care the minor consented to independently.

Insurance and Explanation of Benefits

If the child is on your health insurance or on the parent's plan as a dependent, Explanation of Benefits (EOB) statements can reveal treatment information. Oregon law gives minors the right to request that insurance companies send EOBs directly to them through confidential mail or digital channels — protecting privacy for services they consented to independently.

For children enrolled in the Oregon Health Plan (OHP), ask the plan how notices and claims for confidential services are handled. Do not assume the private-insurance EOB process applies to OHP or that household correspondence will omit treatment details.

Practical Steps for Getting Records Access

1. Present your legal document first. Before asking for records, give the provider a copy of your caregiver affidavit or delegation. Ask them to add it to the child's file and note you as the authorized caregiver.

2. Request portal access. Most Oregon healthcare systems (OHSU, Providence, Legacy, Kaiser Permanente) can set you up with patient portal access once your caregiver document is on file. Ask the registration desk during your first visit.

3. Request previous records in writing. If the child was seen at other clinics before moving in with you, submit a written records request with a copy of your caregiver document. Under HIPAA, a covered entity generally must act on an access request within 30 calendar days; it may take one additional 30-day period if it sends written notice of the delay within the first 30 days.

4. If you're denied, cite HIPAA's personal representative rule. The relevant citation is 45 CFR § 164.502(g). A caregiver with legal authority to make healthcare decisions for a minor is a personal representative under HIPAA.

When Records Access Requires More

A caregiver affidavit or delegation covers general medical records. If you need access to records held by a specialist who provided care the minor consented to independently, or if a provider simply won't cooperate, you may need a court order. The Oregon Kinship Navigator (1-833-201-5557) can help you assess whether that step is necessary.

The Oregon School and Medical Consent guide includes a medical intake preparation worksheet and explains exactly how caregiver authority interacts with HIPAA — so you know what you can access and what falls under the minor's own privacy rights.

See more Oregon guides →