Minor consent and medical records in Oregon: who authorizes a teen's record, and what HIPAA does with that

Oregon lets minors consent to some care on their own — which changes who can authorize a teen's record under HIPAA. The age rules, parent access, and provider discretion.

By CoreFolio

Published July 18, 2026Verified July 18, 20269-minute read

In Oregon, a teenager can sometimes consent to their own care — and that single fact reshapes who may authorize the release of, or gain access to, the teenager's medical record under HIPAA. Under ORS 109.640, a minor 15 or older may consent to ordinary medical and dental care, and a minor of any age may consent to reproductive health care, including contraception and testing and treatment for sexually transmitted infections. Under ORS 109.675, a minor 14 or older may obtain outpatient mental health or chemical-dependency treatment on their own. Where a minor lawfully consents, HIPAA no longer treats the parent as the automatic personal representative for that information — but Oregon then gives the provider discretion over whether to loop the parent in.

That interplay is where practices get tripped up. Oregon does not hand minors a blanket confidentiality right or parents a blanket access right; it grants specific consent rights and leaves much of the disclosure decision to the provider's judgment. HIPAA, in turn, defers to that state-law scheme. This article maps the age rules, the parent-access rules, and how HIPAA's personal-representative framework sits on top.

Key takeaways

A minor 15 or older may consent to hospital, medical, surgical, dental, and optometric care in Oregon; a minor of any age may consent to reproductive health care information and services (ORS 109.640).¹
A minor 14 or older may obtain outpatient mental or emotional disorder or chemical-dependency treatment (excluding methadone maintenance) without parental consent (ORS 109.675).²
Oregon grants provider discretion, not a minor confidentiality right: a provider may advise a parent of care the minor consented to (ORS 109.650), and a mental health provider may disclose in defined situations (ORS 109.680).³⁴
Under HIPAA, a parent is generally an unemancipated minor's personal representative — but not for care the minor lawfully consented to; there, HIPAA defers to Oregon's provider-discretion rules (45 CFR 164.502(g)).⁵
These rules change who authorizes an adolescent's record, so they belong in your authorization forms, intake workflow, and access policy — not just in a clinician's head.

Oregon's minor-consent rules are organized by the kind of care, not a single age of majority. Three provisions do most of the work for a medical or dental practice.

Reproductive health care — any age (ORS 109.640(3))

A minor of any age may give consent, without a parent or guardian, "to receive reproductive health care information and services" from a range of licensed providers acting within their scope.¹ Reproductive health care here carries the meaning set in Oregon's reproductive-health statutes and includes contraception and testing and treatment for sexually transmitted infections, including HIV. (Oregon's older stand-alone minor consent statute for sexually transmitted disease, former ORS 109.610, was repealed in 2023; the reproductive health care provision now carries this ground.)

General medical and dental care — 15 or older (ORS 109.640(4))

"A minor 15 years of age or older may give consent, without the consent of a parent or guardian of the minor," to hospital care and medical, surgical, dental, and (with a narrow first-time-contact-lens exception) optometric diagnosis or treatment.¹ This is the workhorse rule for a general practice: a 15-year-old can consent to a sports physical, an X-ray, or a filling on their own.

Mental health and chemical dependency — 14 or older (ORS 109.675)

"A minor 14 years of age or older may obtain, without parental knowledge or consent," outpatient diagnosis or treatment of a mental or emotional disorder or a chemical dependency, excluding methadone maintenance, through an enumerated set of licensed providers.² This provision comes with an important parental-involvement default, discussed next.

The parent side: discretion, not a right either way

The common misconception is that a minor's consent right creates a matching confidentiality right. In Oregon it generally does not. The statutes give the provider room to decide.

ORS 109.650 — for care under ORS 109.640, a hospital or listed provider "may advise a parent or legal guardian of a minor of the care, diagnosis or treatment of the minor ... without the consent of the minor, and is not liable for advising the parent or legal guardian without the consent of the minor."³ The provider may inform the parent; it is not required to, and it is protected if it does.
ORS 109.675(2) — for mental health and chemical-dependency care, the provider "shall have the parents of the minor involved before the end of treatment unless the parents refuse or unless there are clear clinical indications to the contrary, which shall be documented in the treatment record."² That default flips toward involving the parent, but it carves out exceptions, including where the minor has been sexually abused by a parent or is emancipated.
ORS 109.680 — a mental health care provider serving a minor under ORS 109.675 may disclose relevant health information about the minor without the minor's consent in defined circumstances, with civil immunity for good-faith disclosures.⁴

The through-line: Oregon leaves the disclosure decision largely to documented professional judgment. A provider should be able to explain, in the record, why it did or did not involve a parent.

How HIPAA's personal-representative rule sits on top

HIPAA's default is that a parent is the personal representative of an unemancipated minor and may act on the minor's behalf, including for access to the record. But 45 CFR § 164.502(g) contains a specific exception: when the minor may lawfully consent to a health care service and has consented — or when the minor may obtain the care without parental consent and a court or another person has authorized it — the parent is generally not the minor's personal representative for that information.⁵

Critically, HIPAA then defers to state law on what the provider may do. Where state law is silent or does not address disclosure to a parent, a licensed provider may exercise professional judgment to grant or deny the parent access. Because Oregon's ORS 109.650 and 109.680 expressly give the provider that discretion, HIPAA permits the Oregon provider to act on it. The result:

For care the minor lawfully consented to, the parent is not the automatic HIPAA personal representative, and Oregon's provider-discretion rules govern whether the parent is informed.
For care requiring parental consent (for example, most non-reproductive care for a child under 15), the parent generally is the personal representative and may access the record under 45 CFR § 164.524.⁶
A provider may still deny a parent access where it reasonably believes the disclosure could endanger the minor — a judgment HIPAA and Oregon law both accommodate.

This is also why HIPAA's "more stringent state law" preemption at 45 CFR § 160.203 matters here: Oregon's scheme controls the personal-representative question for the care types it addresses.⁷

Where this bites in practice

Adolescent reproductive and behavioral health visits are the highest-risk spots for an accidental disclosure to a parent who is not the personal representative for that visit. Intake and release workflows should flag these visit types.
Patient-portal design is a frequent failure point: a portal that auto-shares a 15-year-old's full chart with a parent account can disclose reproductive or mental health information the minor consented to independently. The portal's proxy-access rules must track the consent rules.
Records requests from a parent for an adolescent's chart require checking which care the request covers before releasing — not a blanket yes or no.

What this means for your HIPAA compliance file

None of this changes the method of a HIPAA risk analysis under 45 CFR § 164.308(a)(1)(ii)(A). It changes the inputs and your policies. A practice that treats adolescents should reflect:

who can authorize disclosure of an adolescent's record for each care type (any-age reproductive, 15+ general medical/dental, 14+ behavioral health);
how provider discretion is exercised and documented under ORS 109.650, 109.675(2), and 109.680;
proxy/portal access rules that match the consent scheme; and
staff training so front-desk and records staff apply the rules consistently.

A risk analysis and access policy that assume a parent always controls a minor's record are simply wrong for an Oregon practice that sees teenagers.

What Oregon practices that treat adolescents should do this month

Write down your consent map. Document which care types a minor can consent to at which age, using ORS 109.640 and 109.675, so staff apply one consistent standard.
Fix portal proxy access. Confirm your patient portal does not auto-disclose to a parent the visit types a minor consented to independently.
Standardize the parent-involvement judgment. Give clinicians a documented framework for the ORS 109.675(2) "involve the parents before the end of treatment" default and its exceptions.
Update records-request handling. Train records staff to scope a parent's request by care type before release.
Reflect it in the risk analysis. Record the minor-consent and personal-representative facts as part of your documented environment.

These steps prepare the ground. Turning them into a dated risk analysis, access policy, and authorization forms a regulator would find defensible is the work itself — specific, citation-heavy, and easy to get wrong from a blank page. CoreFolio HIPAA walks through each step and produces that documentation with the structure already in place.

Sources

ORS 109.640 (Right to reproductive health care, medical treatment or dental treatment without parental consent — any-age reproductive health care information and services; medical/dental/surgical/optometric care at 15 or older). Oregon Revised Statutes, Chapter 109: https://www.oregonlegislature.gov/bills_laws/ors/ors109.html ↩ ↩² ↩³
ORS 109.675 (Right to diagnosis or treatment for mental or emotional disorder or chemical dependency without parental consent for minors 14 and older; parental-involvement default and exceptions). Oregon Revised Statutes, Chapter 109: https://www.oregonlegislature.gov/bills_laws/ors/ors109.html ↩ ↩² ↩³
ORS 109.650 (Disclosure without minor's consent and without liability — a listed provider may advise a parent or guardian of the minor's care without the minor's consent and is not liable for doing so). Oregon Revised Statutes, Chapter 109: https://www.oregonlegislature.gov/bills_laws/ors/ors109.html ↩ ↩²
ORS 109.680 (Disclosure by mental health care provider without minor's consent; civil immunity). Oregon Revised Statutes, Chapter 109: https://www.oregonlegislature.gov/bills_laws/ors/ors109.html ↩ ↩²
45 CFR § 164.502(g) (personal representatives, including the treatment of unemancipated minors and deference to State law on disclosure to a parent). Electronic Code of Federal Regulations: https://www.ecfr.gov/current/title-45/section-164.502 — full text also at https://www.law.cornell.edu/cfr/text/45/164.502 ↩ ↩²
45 CFR § 164.524 (HIPAA right of access to protected health information). Electronic Code of Federal Regulations: https://www.ecfr.gov/current/title-45/section-164.524 ↩
45 CFR § 160.203 (preemption of contrary State law; "more stringent" exception for state privacy provisions). Electronic Code of Federal Regulations: https://www.ecfr.gov/current/title-45/section-160.203 ↩

FAQ

Common questions

At what age can a minor consent to their own medical care in Oregon?

It depends on the type of care. Under ORS 109.640, a minor 15 years of age or older may consent, without a parent or guardian, to hospital, medical, surgical, dental, and optometric diagnosis or treatment. A minor of any age may consent to reproductive health care information and services — which includes contraception and testing and treatment for sexually transmitted infections, including HIV. Under ORS 109.675, a minor 14 years of age or older may obtain outpatient treatment for a mental or emotional disorder or a chemical dependency (excluding methadone maintenance) on their own.

If a teen consents to care on their own, can the parent still see the record?

Often, yes — Oregon gives the provider discretion rather than granting the minor a confidentiality right or the parent an access right. ORS 109.650 lets a provider advise a parent or guardian of care the minor consented to, without the minor's consent and without liability. For mental health and chemical dependency care, ORS 109.675 generally requires the provider to involve the parents before the end of treatment, with exceptions, and ORS 109.680 permits certain disclosures. HIPAA then defers to that state-law provider discretion.

Does HIPAA make the parent the minor's personal representative?

Usually, but not always. Under 45 CFR 164.502(g), a parent is generally the personal representative of an unemancipated minor. But when the minor may lawfully consent to the care and has done so — as Oregon allows for reproductive, mental health, and certain other care — the parent is not automatically the personal representative for that information. HIPAA then looks to state law: where Oregon law gives the provider discretion to share with or withhold from a parent, HIPAA permits the provider to act on that discretion.

Can a parent be denied access to a teen's record in Oregon?

Yes, in defined circumstances. For care a minor consented to under ORS 109.675, a provider may decline to involve or disclose to a parent where the parents refuse, where there are clear clinical indications to the contrary documented in the record, where the minor has been sexually abused by a parent, or where the minor is emancipated. A provider may also decline access where it reasonably believes disclosure could endanger the minor. These are professional judgments the provider documents.

How should a minor's consent rules show up in my HIPAA compliance file?

As inputs to your policies and forms, not as a change to the method. Your authorization forms, intake process, and access procedures should reflect who can authorize disclosure of an adolescent's record for each care type, and how you exercise the provider discretion Oregon law allows. A risk analysis and access policy that assume a parent always controls a minor's record are incorrect for an Oregon practice that treats adolescents.

Keep learning

Oregon
Oregon privacy and security laws that layer with HIPAA: what medical and dental practices need to know
How Oregon's breach-notification, data-security, and health-records laws layer on top of HIPAA for medical, dental, and behavioral health practices.
July 9, 202613-minute read
Oregon
Oregon behavioral health and substance use records: how ORS 179.505 and 42 CFR Part 2 layer on HIPAA
Behavioral health and substance use records in Oregon carry two layers stricter than HIPAA — ORS 179.505 and 42 CFR Part 2. How they interact and which controls.
July 18, 202612-minute read
Oregon
HIV and genetic testing consent in Oregon: the sensitive-category rules that layer on HIPAA
Oregon adds pre-test notice for HIV and informed-consent rules for genetic information that go beyond HIPAA. What the rules require and how they interact with the federal floor.
July 18, 20268-minute read