HIPAA Personal Representatives (45 CFR 164.502(g))
A covered entity must treat a personal representative — including parents of minors and court-appointed representatives — as the individual for purposes of the Privacy Rule, subject to defined exceptions.
Primary source
45 CFR 164.502(g) — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502#p-164.502(g)
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 164.502(g)) requires a covered entity to treat a personal representative as the individual for purposes of the Privacy Rule. For adults, this means a person with legal authority to act on behalf of the individual in making health care decisions (typically a court-appointed guardian or health care proxy under state law). For unemancipated minors, the parent is generally the personal representative.
Three exceptions to the parent-as-representative rule apply: when the minor consents to care under state law without parental consent, when state law allows the minor to obtain such care without parental consent, and when a parent agrees to a confidential relationship between the provider and minor. State law often controls the contours of each.
A covered entity may also refuse to treat someone as a personal representative if it has a reasonable belief the individual has been or may be subject to domestic violence, abuse, or neglect by the representative, or that doing so would endanger the individual. The refusal must be documented.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- RegulationHIPAA Privacy Rule Administrative Requirements (45 CFR 164.530)Designated privacy official, workforce training, safeguards, complaint process, sanctions, mitigation, anti-retaliation, anti-waiver, documentation, and policies and procedures.
- RegulationHIPAA Right of Access (45 CFR 164.524)Individuals have a right to inspect and obtain copies of their PHI in a designated record set, in the form and format requested when readily producible, within 30 days.
- RegulationHIPAA Incidental Disclosures (45 CFR 164.502(a)(1)(iii))Incidental disclosures that occur as a by-product of an otherwise permitted use or disclosure are not violations, provided reasonable safeguards and minimum necessary policies are applied.
- ComplianceHIPAA Subpoena Response: Court Order vs Administrative Subpoena (45 CFR § 164.512)Court order, civil subpoena, grand-jury subpoena, DEA administrative demand — each triggers a different HIPAA response path. Identify the type before you produce a single record.
- GlossaryMinor ConsentState-law rules on when a minor may consent to their own healthcare (and PHI disclosure) without parental involvement.
- SRAHIPAA Security Rule vs Privacy Rule: A Plain-English MapWhat the Security Rule at 45 CFR Part 164 Subpart C does, what the Privacy Rule at Subpart E does, where they overlap, and which rule the SRA actually answers to.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.