Tennessee HIPAA Authorization for Grandparents: Accessing a Grandchild's Medical Records

You take your grandchild to a new pediatrician and the office asks for the child's medical history. The previous doctor says they cannot release records to anyone except a parent or legal guardian. You are raising this child daily, but HIPAA seems to block you at every turn.

It does not have to. Tennessee law gives relative caregivers a clear path to HIPAA personal representative status.

How a POA Makes You a HIPAA Personal Representative

Under the HIPAA Privacy Rule (45 CFR § 164.502(g)), a person authorized under state law to make healthcare decisions for a minor is generally the child's "personal representative" for HIPAA purposes. That person can exercise a parent's access rights for the care covered by the authorization, subject to HIPAA exceptions and rules for care the minor consents to independently.

A Power of Attorney for Care of a Minor Child under T.C.A. § 34-6-301 is state law authorizing you to make healthcare decisions. When you present a properly executed POA to a medical provider, you generally become the child's HIPAA personal representative for the delegated care, subject to HIPAA exceptions and the minor's independent-consent rights.

What You Can Access

As HIPAA personal representative, you can:

• Request the child's records in a provider's designated record set, subject to HIPAA exceptions
• Review lab results, imaging reports, and specialist notes
• Sign HIPAA authorization forms to transfer records between providers
• Access patient portals and online health records
• Receive prescription information and refill histories
• Communicate with the child's healthcare team about treatment plans

The In Loco Parentis Alternative

If you do not yet have a signed POA, the in loco parentis healthcare affidavit (T.C.A. § 34-6-402) temporarily establishes your authority to make healthcare decisions for up to 60 days. This affidavit also grants HIPAA personal representative status for the duration of its validity.

The affidavit works when a parent is unreachable — in treatment, incarcerated, or simply not responding. You sign it under penalty of perjury, and the healthcare provider who accepts it in good faith is immune from liability under T.C.A. § 34-6-406.

The Exception: Minors Who Self-Consent

Tennessee law gives minors the right to independently consent to certain types of care, including mental health treatment at age 16 and older (T.C.A. § 33-8-202), substance abuse treatment (T.C.A. § 63-6-220), and STD treatment (T.C.A. § 68-10-104(c)).

When a minor independently consents to care under one of these exceptions, the minor controls the records. The provider cannot release details to you — even with a POA — without the minor's express written consent. This is a HIPAA protection for the minor's privacy, not an error by the provider.

When a Provider Refuses

If a medical office refuses to release records despite a valid POA, ask to speak with the office's privacy officer or practice manager. Provide a copy of the POA and reference both the HIPAA Privacy Rule (45 CFR § 164.502(g)) and T.C.A. § 34-6-304, which delegates healthcare authority to the POA holder.

If the refusal continues, file a written request. HIPAA generally requires a provider to act on an access request within 30 days. If it cannot, it may take one extension of up to 30 more days after giving written notice with a completion date. A formal request creates a paper trail and usually triggers internal review by the practice's compliance team.

For persistent refusals, contact Help4TN (1-844-435-7472) for free legal assistance.

Get the Records Checklist

The Tennessee School and Medical Consent Guide includes a medical records request template, HIPAA authorization forms, and provider-by-provider instructions for transferring a child's health history to new doctors, dentists, and specialists.

See more Tennessee guides →