Can my child's doctor refuse to give me my minor child's medical records in Arkansas?

Subject

Three related questions on parental access to a minor's medical records under Arkansas law and HIPAA: (1) general restrictions on parental access, (2) ability to seek a second opinion, and (3) access rights of foster parents and temporary guardians.

Plain-English summary

The opinion was prompted by reports to the Arkansas General Assembly that some medical institutions have been reluctant to share minor children's medical information with their parents. Representative Brown asked the AG to lay out the legal framework.

The framework is layered. HIPAA sets the federal floor. The HIPAA Privacy Rule generally treats a parent, guardian, or person acting in loco parentis as the minor's "personal representative" for health-care decision-making. As the personal representative, the parent has the right to access the child's medical records, with limited exceptions. State law can add stricter privacy protections but cannot weaken the HIPAA baseline.

HIPAA carves out four situations where the parent is not treated as the personal representative: (1) the minor lawfully consents to treatment under state law without needing parental consent, (2) the minor receives treatment at the direction of a court or court-appointed individual, (3) the parent agrees to a confidential provider-minor relationship, and (4) the provider exercises professional judgment that treating the parent as the personal representative could endanger the minor due to abuse, neglect, or domestic violence. HIPAA also excludes psychotherapy notes maintained separately from the general medical record from the right of access.

For Arkansas, two main limits apply on top of HIPAA.

The first is the minor-consent statutes. Under A.C.A. § 20-9-602, certain minors may consent to medical treatment without parental approval: emancipated minors, married minors, incarcerated minors, unemancipated minors of sufficient intelligence to understand and appreciate the consequences of the proposed treatment, and any female (regardless of age) for medical care in connection with pregnancy or childbirth, excluding abortion. Under A.C.A. § 20-16-508, a minor who believes he or she has a sexually transmitted disease can consent to STI treatment without parental consent. In these situations, the parent is not the minor's personal representative under HIPAA and may not have an automatic right to the records, though the provider can grant access at professional discretion.

The second is the provider's "detrimental to health or well-being" determination. A.C.A. § 16-46-106(e)(1) lets a provider deny access if disclosure would be detrimental to the patient's health or well-being. The provider must give the parent (or attorney) a written determination explaining the denial. The requester can then designate another physician in the same specialty to review the records and decide whether disclosure would be detrimental. The Arkansas standard ("detrimental to health or well-being") is broader than HIPAA's "endangerment" threshold. And in Arkansas, the requester picks the second-opinion physician; under HIPAA alone, the original provider does.

For the second-opinion question, the answer is yes by default. Arkansas law does not prohibit a parent or legal guardian from seeking a second medical opinion, provided the parent retains medical decision-making authority. The practical wrinkle is records access: if the underlying treatment was one the minor consented to without parental involvement, the parent may not be able to access the records needed to support the second opinion.

For foster parents and temporary guardians, the answer differs.

Foster parents do not have legal custody. When a child is in DHS foster care, legal custody and personal-representative status sit with DHS. Foster parents have derivative authority limited to what DHS delegates. Arkansas's Foster Parent Bill of Rights at A.C.A. § 9-28-903(9)(a) requires that foster parents be told about the child's health history before placement, and they are entitled to access the child's "medical passport" (a health-status summary). Foster parents (and pre-adoptive parents, where there is an open dependency-neglect proceeding) can consent to emergency treatment, routine and ongoing medical treatment, and nonsurgical procedures by primary care or specialty providers under A.C.A. § 9-35-328(b)(1). Non-emergency surgery, invasive procedures, and end-of-life decisions require court approval under A.C.A. § 9-35-328(b)(2).

Court-appointed temporary guardians have broader, independent authority. A guardian is the ward's legal representative, and within the scope of the court's order is treated as the minor's HIPAA personal representative. Temporary guardianships under A.C.A. § 28-65-218 can run up to 90 days, with the order defining scope. A temporary guardian generally has the same record-access rights as a parent, subject to (a) any limitations in the guardianship order and (b) HIPAA's limited exceptions.

A footnote in the opinion explains that medical or health information kept by a public K-12 school is generally governed by FERPA, not HIPAA. School nurse, counseling, and school-based clinic records are FERPA "education records," and parents have the right to inspect and review them under 20 U.S.C. § 1232g(a)(1)(A) until the rights transfer to the student at age eighteen or upon postsecondary enrollment.

What this means for you

If you are a parent or legal guardian and your child's provider is refusing to share records

Three checks. First, ask the provider in writing for the records and ask the provider to identify the legal basis for any denial. HIPAA and Arkansas law both require providers to give a written determination explaining a denial. Second, if the denial cites the minor's independent consent (such as STI treatment under A.C.A. § 20-16-508 or pregnancy-related care), that denial likely stands; HIPAA does not give you personal-representative status for treatment your child lawfully consented to without you. Third, if the denial cites "detrimental to health or well-being" under A.C.A. § 16-46-106(e)(1), you have a statutory right to designate a second physician in the same specialty to review the records and decide whether disclosure would be detrimental. If that second physician concludes disclosure would not be detrimental, the original provider must release the records.

If you are a pediatrician, family physician, or hospital records team

Have a written denial process ready that tracks the four HIPAA carve-outs (minor's lawful consent, court direction, parent's agreement to confidentiality, abuse/neglect/violence concern) and the two Arkansas-law carve-outs (independent minor consent under § 20-9-602 or § 20-16-508 and detriment determination under § 16-46-106(e)). The Arkansas detriment standard is broader than HIPAA's endangerment standard, but the Arkansas process also gives the requester the right to pick the second-opinion physician, which differs from HIPAA. Document carefully, because the determination is reviewable.

If you are a foster parent

Your access rights are derivative. DHS holds legal custody and is the minor's HIPAA personal representative. You are entitled to information necessary to provide care: the child's health history before placement (under § 9-28-903(9)(a)), the medical passport (under 9 C.A.R. § 40-720), and the authority to consent to emergency, routine, and ongoing care plus nonsurgical procedures under § 9-35-328(b)(1). For non-emergency surgery, invasive procedures, and end-of-life decisions, you need court approval under § 9-35-328(b)(2). For records access beyond your immediate care needs, work through the DHS caseworker.

If you are a court-appointed temporary guardian

Your guardianship order controls. A typical temporary guardianship under § 28-65-218 (up to 90 days) gives you the same record-access rights as a parent, treating you as the HIPAA personal representative within the scope of the order. Read the order carefully to confirm there are no carve-outs (some orders limit medical decision-making to a specific facility, condition, or category of treatment). The HIPAA exceptions still apply, including the minor's independent consent and the abuse/neglect carve-out.

If you are seeking a second medical opinion for your child

Section 1: nothing in Arkansas law prohibits you from doing so, provided you still have decision-making authority for the child. Section 2: getting the records you need for the second-opinion physician depends on whether the underlying treatment was one your child lawfully consented to alone. If it was, the records may be inaccessible to you, and the new physician would need to start from a fresh exam.

If you are a school nurse or school health staff member

The student's health information you keep is generally a FERPA education record, not HIPAA-protected health information. Parents have access rights under 20 U.S.C. § 1232g(a)(1)(A) until the rights transfer to the student at eighteen or postsecondary enrollment, unless limited by court order or custody document.

Background and statutory framework

The federal floor: HIPAA

The HIPAA Privacy Rule at 45 C.F.R. § 164.502(g) requires covered entities to treat a parent, guardian, or person standing in loco parentis as the minor's personal representative when state law gives that person authority to act on the minor's behalf for health-care decisions. The personal representative has the right to access the minor's protected health information at 45 C.F.R. § 164.524.

The four HIPAA carve-outs are at 45 C.F.R. § 164.502(g)(3)(i)(A)–(C) and § 164.502(g)(5):

1. The minor lawfully consents to treatment under state law and parental consent is not required.
2. The minor receives treatment at the direction of a court or court-appointed individual.
3. The parent agrees to a confidential provider-minor relationship.
4. The provider, in professional judgment, determines that treating the parent as personal representative could endanger the minor due to abuse, neglect, or domestic violence.

Psychotherapy notes maintained separately from the medical record are excluded from the right of access at 45 C.F.R. § 164.524(a)(1)(i).

HIPAA preempts conflicting state law unless state law is more privacy-protective (42 U.S.C. § 1320d-7(a)(1)–(2); 45 C.F.R. §§ 160.202, 160.203(a)–(b)).

The Arkansas overlay

Arkansas law does not separately limit parental access based on personal-representative status. Where state law is silent, HIPAA gives the provider professional discretion to grant or deny access (45 C.F.R. § 164.502(g)(3)(ii)).

Two exceptions modify this default in Arkansas.

A.C.A. § 20-9-602 lets specific categories of minors consent to medical treatment without parental approval: (1) emancipated minors, (2) married minors, (3) incarcerated minors, (4) unemancipated minors of sufficient intelligence to understand and appreciate the proposed treatment, and (5) any female of any age for medical care in connection with pregnancy or childbirth (excluding abortion).

A.C.A. § 20-16-508 lets a minor who believes he or she has a sexually transmitted disease consent to STI treatment without parental consent. The provider may, but is not required to, inform the parent or legal guardian, and may withhold information if the provider determines that withholding is in the minor's best interests.

A.C.A. § 16-46-106(e)(1) lets a provider deny access to medical records when disclosure would be detrimental to the patient's health or well-being. This is broader than HIPAA's "endangerment" threshold at 45 C.F.R. § 164.524(a)(3)(i). The provider must give a written determination. The requester can then designate another physician in the same specialty to review the records under § 16-46-106(e)(2)(A). If that physician finds disclosure would not be detrimental, the original provider must release the records under § 16-46-106(e)(3); if it would be detrimental, the original provider may withhold or redact. Notably, in Arkansas the requester picks the second-opinion physician; under HIPAA alone, the original provider does (45 C.F.R. § 164.524(a)(4)).

A valid court order can independently override these general rules under 45 C.F.R. § 164.512(e)(1)(i).

Foster parents and DHS custody

When a child is in foster care, A.C.A. § 9-35-320(a)(2)(A) places legal custody with DHS, not with the foster parents. DHS is the personal representative for health-care decision-making under § 9-35-328(b)(1) and 45 C.F.R. § 164.502(g)(1). Foster parents have only the authority DHS delegates. Internal DHS policy assigns agency staff the responsibility to obtain the child's medical history using the agency's custody order.

The Foster Parent Bill of Rights at § 9-28-903(9)(a) requires that foster parents receive health-history information before placement. The medical passport at 9 C.A.R. § 40-720 is a health-status summary that foster parents can access.

For consent decisions in an open dependency-neglect proceeding, § 9-35-328(b)(1) lets foster parents and pre-adoptive parents consent to emergency treatment, routine and ongoing medical treatment, and nonsurgical procedures by primary care or specialty providers. Section 9-35-328(b)(2) requires court approval for non-emergency surgery, invasive procedures, and end-of-life decisions.

Court-appointed guardians

A.C.A. § 28-65-301(a) imposes the duty to care for and maintain the ward; § 28-65-302 grants authority to make decisions on the ward's behalf except as limited by court order or statute. Temporary guardianships under § 28-65-218 can be granted in emergency situations for up to 90 days, with the order defining scope.

Within that scope, a guardian is treated as the minor's personal representative under HIPAA at 45 C.F.R. § 164.502(g)(1). The guardian generally has the same access rights as a parent, subject to (a) limits in the guardianship order and (b) HIPAA's exceptions at § 164.502(g)(3).

School health records and FERPA

Medical or health information maintained by a public K-12 school is generally governed by FERPA at 20 U.S.C. § 1232g, not HIPAA. School nurse, counseling, and school-based clinic records are typically FERPA "education records" under 20 U.S.C. § 1232g(a)(4)(A) and 34 C.F.R. § 99.3, and HIPAA expressly excludes FERPA education records from "protected health information" at 45 C.F.R. § 160.103. Under FERPA at 20 U.S.C. § 1232g(a)(1)(A) and (d), parents of a minor student have the right to inspect and review school records, and the rights transfer to the student at eighteen or upon postsecondary enrollment unless limited by court order or legally binding custody document.

Common questions

My doctor said HIPAA prevents her from sharing my child's records. Is that right?

In most cases, no. HIPAA's default rule is that the parent is the minor's personal representative and has the right to access the records. There are four narrow HIPAA exceptions (minor's lawful consent, court direction, agreed confidentiality, abuse/neglect/violence concern), plus two Arkansas-law exceptions (independent minor consent under § 20-9-602 or § 20-16-508 and detriment determination under § 16-46-106(e)). If the doctor is denying access, ask for the legal basis in writing.

My daughter is 17 and is pregnant. Can I see her prenatal records?

Possibly not, automatically. A.C.A. § 20-9-602 lets any female of any age consent to medical care in connection with pregnancy or childbirth without parental approval (it excludes abortion from this exception, but not other prenatal care). When a minor consents to treatment alone, the parent is not the personal representative for those records under HIPAA. The provider can grant access at professional discretion, but is not required to.

What about STI testing or treatment for my teenage son?

A.C.A. § 20-16-508 lets a minor who believes he has an STI consent to treatment alone. The provider may inform the parent but is not obligated to and can withhold information if the provider determines withholding is in the minor's best interests. Records are likely not directly accessible to you for that treatment.

My child's doctor said disclosure would be "detrimental" to my child. What can I do?

You have a statutory right under § 16-46-106(e)(2)(A) to designate another physician in the same specialty to review the records and decide whether disclosure would be detrimental. If that second physician concludes disclosure would not be detrimental, the original provider must release the records under § 16-46-106(e)(2)(B). If disclosure would be detrimental, the provider can withhold or redact under § 16-46-106(e)(3).

Can I get a second medical opinion if my child's doctor is being difficult?

Yes, as long as you still have medical decision-making authority. Nothing in Arkansas law prohibits seeking a second opinion. The practical question is whether you can get the records you need; if the underlying care was something your child consented to alone, those records may be unavailable, and the new physician may need to start fresh.

I'm a foster parent. The hospital won't give me my foster child's records. Why?

Because legal custody is with DHS, not you. DHS is the HIPAA personal representative under § 9-35-328(b)(1). Your access is whatever DHS has delegated, plus the medical passport and pre-placement health history. For broader records access, work through the DHS caseworker.

I'm a temporary guardian under a court order. Do I have the same rights as a parent?

Generally yes, within the scope of the order. A court-appointed guardian is the ward's HIPAA personal representative under § 164.502(g)(1) for the matters the order covers. Read the order to confirm there are no carve-outs (some orders limit decision-making to specific facilities or treatments). HIPAA's exceptions still apply.

My child is hospitalized and the hospital says it has "psychotherapy notes" it won't share. Is that legal?

Yes. HIPAA at 45 C.F.R. § 164.524(a)(1)(i) excludes psychotherapy notes maintained separately from the general medical record from the right of access. Personal representatives, including parents and guardians, do not have an automatic right to those notes. The provider can release them voluntarily but is not required to.

What about my child's school health records? Can the school refuse?

Generally no, while your child is a minor enrolled in K-12. Those records are typically governed by FERPA, not HIPAA, and FERPA at 20 U.S.C. § 1232g(a)(1)(A) gives parents the right to inspect and review education records. Once your child turns eighteen or enrolls in postsecondary education, the rights transfer to the student.

Citations

• Federal HIPAA framework: 42 U.S.C. § 1320d-7(a)(1)–(2) (preemption); 45 C.F.R. §§ 160.202, 160.203(a)–(b) ("more stringent" definition); 45 C.F.R. § 164.502(g) (personal representative); § 164.502(g)(1) (general personal representative rule); § 164.502(g)(3)(i) (minors); § 164.502(g)(3)(i)(A)–(C) (carve-outs); § 164.502(g)(3)(ii) (state-law-silent professional discretion); § 164.502(g)(5) (abuse/neglect/violence carve-out); § 164.512(e)(1)(i) (court orders); § 164.524 (right of access); § 164.524(a)(1)(i) (psychotherapy notes excluded); § 164.524(a)(3)(i) (HIPAA endangerment threshold); § 164.524(a)(4) (HIPAA reviewer selection); 45 C.F.R. § 160.103 (PHI excludes FERPA education records).
• Federal school records framework: 20 U.S.C. § 1232g (FERPA); § 1232g(a)(1)(A), (d) (parent inspection right and rights transfer); § 1232g(a)(4)(A) (education record); 34 C.F.R. §§ 99.3, 99.4.
• Arkansas medical records statutes: A.C.A. § 16-46-106(e)(1) (detriment-to-health-or-well-being denial); § 16-46-106(e)(2)(A) (requester-designated reviewer); § 16-46-106(e)(2)(B) (release if not detrimental); § 16-46-106(e)(3) (redaction).
• Arkansas minor-consent statutes: A.C.A. § 20-9-602 (categories of minors who can consent); § 20-16-508 and § 20-16-508(a)–(b) (STI treatment).
• Arkansas foster-care statutes: A.C.A. § 9-35-320(a)(2)(A) (DHS legal custody); § 9-35-328(b)(1) (foster/pre-adoptive parent consent authority); § 9-35-328(b)(2) (court approval required for non-emergency surgery, invasive procedures, end-of-life); § 9-28-903(9)(a) (Foster Parent Bill of Rights health information); 9 C.A.R. § 40-720 (medical passport).
• Arkansas guardianship statutes: A.C.A. § 28-65-218 (temporary guardianship); § 28-65-301(a) (duty to care for and maintain); § 28-65-302 (decisional authority).

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

BOB R. BROOKS JR. JUSTICE BUILDING
101 WEST CAPITOL AVENUE
LITTLE ROCK, ARKANSAS 72201
Opinion No. 2025-131
March 23, 2026
The Honorable Karilyn B. Brown
State Representative
Post Office Box 6677
Sherwood, Arkansas 72124
Dear Representative Brown:
I am writing in response to your request for an opinion on parental access to their children's medical records. You state that members of the General Assembly have learned that certain medical institutions are sometimes reluctant to share medical information about children with their parents or legal guardians.

Against this background, you ask the following questions:

1. Under current Arkansas law, are parents or legal guardians restricted in any way from obtaining their minor child or children's medical records?

Brief response: In most situations, a parent or legal guardian may access a minor child's medical records. But access may be restricted if the minor has legal authority to consent to the treatment without parental involvement or if a provider determines that disclosure would be detrimental to the child's health or well-being under Arkansas law.

2. Are parents or legal guardians prevented in any way from requesting a second opinion regarding medical treatment for their minor child or children?

Brief response: No, provided that the parent or legal guardian retains legal authority to make medical decisions. But if the minor lawfully consented to the treatment without parental involvement, the parent or legal guardian may be unable to access the medical records necessary to support that second opinion.

3. In Arkansas, are foster parents or temporary guardians allowed to access the medical records of their minor child, children, or wards?

Brief response: Foster parents may access medical information necessary to provide care, subject to the authority delegated by the Department of Human Services. By contrast, a court-appointed temporary guardian generally has broader authority to access the ward's medical records, unless the guardianship order provides otherwise.

DISCUSSION

Access to a minor's medical records is governed primarily by federal law, specifically the Health Insurance Portability and Accountability Act ("HIPAA"). HIPAA establishes a baseline for privacy. It preempts any conflicting state law unless the state law provides more stringent privacy protections. Thus, a brief overview of HIPAA is necessary before addressing your specific questions about Arkansas law.

The HIPAA Privacy Rule requires covered entities (such as health plans, health care clearinghouses, and most health care providers and their business associates) to provide an individual, or a personal representative acting on the individual's behalf, access to the individual's medical records, unless an exception applies. As it relates to minor children, the Privacy Rule states:

If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor making decisions related to health care, a covered entity must treat such person as a personal representative under [the HIPAA Rules], with respect to protected health information relevant to such personal representation ….

The U.S. Department of Health & Human Services' Office for Civil Rights has recently reiterated that, in most circumstances, parents are the personal representatives of their unemancipated minor children and thus have the right to access their children's medical records, subject to limited exceptions.

Under HIPAA, a parent is not treated as a minor's personal representative in the following limited circumstances: (1) when the minor lawfully consents to treatment under applicable state or other law and parental consent is not required; (2) when the minor receives treatment at the direction of a court or a court-appointed individual; (3) when the parent agrees to a confidential provider-minor relationship; and (4) when a provider determines, in the exercise of professional judgment, that treating the parent as the personal representative could endanger the minor due to abuse, neglect, or domestic violence. In addition, HIPAA does not grant a right of access to psychotherapy notes maintained separately from the general medical record.

Absent one of these limited circumstances, a covered entity under HIPAA may not impose additional restrictions on a parent's access to his or her child's medical records. But other federal or state laws may impose additional or different restrictions. With this in mind, I turn to your questions as they relate to Arkansas law.

Question 1: Under current Arkansas law, are parents or legal guardians restricted in any way from obtaining their minor child or children's medical records?

Under Arkansas law, parents or legal guardians are generally entitled to obtain their minor child's medical records because they usually serve as the child's personal representative under HIPAA. Arkansas law does not limit access based on whether a parent or legal guardian is considered a minor's personal representative under HIPAA. When state law does not expressly grant or deny access to medical records based on personal-representative status, HIPAA allows a covered entity to use professional judgment to grant or deny access to the minor's records. So, even in situations in which a parent or legal guardian is not a minor child's personal representative, a covered entity in Arkansas may still grant access to a minor's medical records, at the covered entity's discretion.

But there are two primary exceptions that may limit a parent or legal guardian's access to a minor's medical records. The first exception arises in situations where Arkansas law allows a minor to consent to medical treatment. The second exception arises in situations where the provider determines that releasing the records would be detrimental to the minor's health or well-being.

1.1. Minor's independent consent. Arkansas law allows minors to consent to certain types of medical treatment without the involvement or approval of a parent or guardian. In these situations, the parent or guardian is not considered the minor's personal representative under HIPAA and therefore does not have an automatic right to access the related medical records. Unless another legal basis for disclosure applies, access to those records may be denied. But HIPAA allows a provider to grant access at the provider's professional discretion. As a result, a parent's or legal guardian's ability to obtain a minor's medical records often turns on whether Arkansas law authorizes a minor to consent to treatment without parental approval.

Under A.C.A. § 20-9-602, certain minors may consent to medical treatment without parental approval. These include: (1) an emancipated minor; (2) a married minor; (3) an incarcerated minor; (4) an unemancipated minor of sufficient intelligence to understand and appreciate the consequences of the proposed treatment; and (5) any female, regardless of age, for medical care in connection with pregnancy or childbirth, excluding abortion.

In addition, A.C.A. § 20-16-508 authorizes a minor who believes he or she has a sexually transmitted disease to consent to medical treatment related to that condition without parental consent. While a provider may choose to inform the parent or legal guardian, the provider is not obligated to do so and may withhold such information if the provider determines it is in the best interests of the minor.

1.2. Provider's determination. Arkansas law also allows access to be denied when a health care provider believes that release would be detrimental to the individual's health or well-being. This standard is broader in scope than the equivalent HIPAA provision. Providers who deny access must give the parent, guardian, or attorney a written determination stating that disclosure "would be detrimental to the individual's health or well-being." The requester may then designate another physician in the same specialty to review the records and determine whether disclosure would be detrimental. If the reviewing physician concludes that disclosure would not be detrimental, the provider must release the records. If disclosure would be detrimental, the provider may withhold the records or redact the objectionable portions before release.

In summary, while Arkansas law generally supports parental access to a minor's medical records, that access is not absolute. It may be limited in two key ways: (1) when a minor is legally authorized to consent to treatment without parental involvement, and (2) when a provider determines that disclosure would be detrimental to the minor's health or well-being. Finally, a valid court order may override these general rules and independently restrict access.

Question 2: Are parents or legal guardians prevented in any way from requesting a second opinion regarding medical treatment for their minor child or children?

No. Arkansas law does not prohibit a parent or legal guardian from seeking a second medical opinion regarding a minor child's treatment, provided the parent or guardian retains legal authority to make medical decisions on the child's behalf. The ability to obtain a second opinion is a natural extension of that decision-making authority, and Arkansas law imposes no additional procedural barriers to consulting another provider.

However, if the medical treatment at issue falls within a category for which the minor is legally authorized to consent without parental involvement, the parent or guardian may be unable to access the relevant medical records necessary to facilitate a second opinion. In such cases, the limitation arises not from any restriction on seeking a second opinion, but from privacy protections under Arkansas law or HIPAA, which may prevent parental access to records related to care the minor consented to independently.

Question 3: In Arkansas, are foster parents or temporary guardians allowed to access the medical records of their minor children, or wards?

Foster parents may access medical information necessary to care for a child in Department of Human Services ("DHS") custody, but their authority is delegated and limited by DHS. By contrast, a court-appointed temporary guardian (unless restricted by court order) generally has broader, independent authority to access the ward's medical records as the child's legal representative.

3.1. Foster parents. When a child is placed in foster care, legal custody is vested in DHS, not the foster parents. As legal custodian, DHS acts as the child's personal representative for purposes of health care decision-making under Arkansas law and HIPAA. Because custody remains with DHS, a foster parent's authority to access medical records is derivative and limited to the scope of authority delegated by DHS. DHS policy assigns responsibility to agency personnel to obtain the child's health care history and medical records using the agency's custody order.

Arkansas's Foster Parent Bill of Rights requires that foster parents be informed, before placement, of information regarding the child's health history and other matters affecting care or safety. Foster parents are also entitled to access the child's "medical passport," which is a summary of the child's health status.

Arkansas law further authorizes foster or pre-adoptive parents to consent to certain categories of care for a child in DHS custody (stemming from an open dependency-neglect proceeding), including emergency treatment, routine and ongoing medical treatment, and nonsurgical procedures by primary care or specialty providers. Foster or pre-adoptive parents must obtain express court approval for non-emergency surgery, invasive procedures, and end-of-life decisions.

3.2. Guardians. A court-appointed guardian has the duty to care for and maintain the ward and is empowered to make decisions on the ward's behalf except as limited by the court order or statute. Temporary guardianships may be granted in emergency situations for up to 90 days, and the order defines the scope of authority.

Within the authority granted by the court, a guardian is treated as the minor's personal representative under HIPAA. Accordingly, a temporary guardian generally may access the ward's medical records to the same extent as a parent, subject to (1) any limitations in the guardianship order and (2) HIPAA's limited exceptions.

Assistant Attorney General Justin Hughes prepared this opinion, which I hereby approve.

Sincerely,
TIM GRIFFIN
Attorney General