Your standing ends when your child becomes an adult — the four documents that put it back

What changes is not a rule about age. It is that a parent stops being a personal representative. Under 45 CFR 164.502(g)(1) a covered entity must treat a personal representative as if they were the patient; under (g)(2) a person holds that status only where, "under applicable law", they have authority to act for an adult "in making decisions related to health care". Applicable law is state law. When it stops treating the parent as the decision-maker, the hospital stops treating the parent as the patient — same day, no notice, no letter.

Paying for everything buys nothing

The premium, the tuition, the dependency claimed on the return and the card on file are all irrelevant to the health question. There is no financial-interest exception in the Privacy Rule. Education records are slightly different and still disappointing: 34 CFR 99.31(a)(8) does let an institution disclose to the parents of a student who is a dependent under section 152 of the Internal Revenue Code — but the section is a list of disclosures a school may make, and most decline as a matter of policy rather than police a tax test.

The authorisation is the piece that gets skipped

A HIPAA authorisation is the ordinary route by which an adult lets a provider talk to somebody else. Section 164.508(c)(1) fixes what it must contain: a specific and meaningful description of the information, who may disclose it, who may receive it, each purpose, an expiration date or event, and the individual's signature and date. Paragraph (c)(2) adds the statements about revoking it in writing, about whether treatment can be conditioned on signing, and about redisclosure. A one-line note saying "you may speak to my mother" satisfies none of that.

The exceptions everyone relies on are permissions, not rights

Two provisions get quoted back at worried parents, and both are written as discretion. Section 164.510(b) permits disclosure to "a family member, other relative, or a close personal friend" involved in the patient's care: with the patient present it needs their agreement or an opportunity to object, and where they are absent or incapacitated the provider may "exercise professional judgment" about whether disclosure is in the patient's best interests, limited to what is directly relevant. Section 164.512(j) permits disclosure to prevent or lessen "a serious and imminent threat" to health or safety. FERPA has the same shape at 34 CFR 99.31(a)(10) and § 99.36 for a health or safety emergency.

Every one of those is a may. A cautious ward clerk who says nothing has not broken a rule, and there is no appeal from a judgment call made at three in the morning by someone who has never met you.

Two powers of attorney, signed to two different standards

The health care instrument goes by different names — health care power of attorney, health care proxy, the agent half of an advance directive — and the execution formalities are state law and genuinely varied. California is a fair illustration of the pattern: Probate Code § 4673 requires the directive to be dated, signed by the patient or in their name at their direction, and then either acknowledged before a notary or signed by two qualifying witnesses. Other states insist on witnesses only, exclude the named agent from witnessing, or require a specific statutory form. Sign to the home state's rules and read the form your state actually publishes.

For a student living out of state, the reassuring news is that portability is usually legislated. California's § 4676 provides that a directive executed in another jurisdiction "in compliance with the laws of that state or jurisdiction or of this state, is valid and enforceable in this state" — most states carry an equivalent. Belt and braces for a four-year course is to sign a second set to the school state's formalities, because the clinician holding the page will be reading it under their own law.

The financial document is separate and must be durable, meaning it survives the principal losing capacity rather than lapsing at that moment. California Probate Code § 4124 shows the mechanism: the writing must contain words such as "This power of attorney shall not be affected by subsequent incapacity of the principal", or the springing equivalent, or similar words showing that intent. This is the instrument that lets a parent argue an insurance denial, pay a bursar, deal with a landlord or reach a frozen bank account — and it is the one institutions push back on hardest, which is a solved problem rather than a surprise. See what to do when a bank refuses a power of attorney before you need to.

FERPA is a different statute and usually the school's own form

Education records never travelled with the health documents and cannot be bolted onto them. Under 34 CFR 99.5(a)(1), when a student becomes an eligible student "the rights accorded to, and consent required of, parents under this part transfer from the parents to the student". The definition in § 99.3 is the part people get wrong: an eligible student is one who "has reached 18 years of age or is attending an institution of postsecondary education". Dual enrolment at a community college transfers the college's records at sixteen.

Section 99.30 sets what a release must do — signed, dated, and specifying the records, the purpose and the party or class of parties to whom disclosure may be made — and electronic signature is expressly allowed. Because the specificity runs against the institution's own record system, nearly every registrar issues its own release rather than accept a general one, and it is normally a checkbox inside the student portal. Two related provisions are worth knowing: directory information can be disclosed unless the student opts out, and § 99.31(a)(15) separately permits telling a parent about an alcohol or controlled-substance violation where the institution has found a disciplinary breach and the student is under 21. Our fuller treatment is in who can see a student's education records.

When the young adult cannot sign

Every document above depends on a capable adult choosing to sign it. Where a disability means that choice cannot be made, the question is not which form to use but how much authority to take — and the modern default across state law is the least that will work. The same logic runs through special education: 34 CFR 300.520 transfers the IDEA rights to the student at the state age of majority, with a separate procedure where the young adult is not judged competent but cannot give informed consent about their programme.

The reason this is worth doing during a quiet week in August is that all four documents are revocable and none of them takes anything away. A nineteen-year-old who signs them keeps every power they have just acquired; what they give up is the possibility of a stranger having to guess, at speed, whether their parent should be told. That is a small thing to sign away, and it is only ever small before it is needed.