You drove them to every practice, sat through every parent-teacher conference, and held their hand at the pediatrician's office for eighteen years. Then, on their birthday, the law quietly revoked every bit of that authority. No letter arrived. No one called. But legally, you became a stranger to your own child's medical records, college grades, and bank accounts.

This catches nearly every parent off guard. And the fix isn't complicated -- it just needs to happen fast.

What Changes at 18 (and Why No One Tells You)

The moment your child turns 18, two federal laws redraw the line between you and them.

HIPAA -- the Health Insurance Portability and Accountability Act -- governs who can access a person's medical information. Before 18, you're your child's "personal representative," meaning doctors, hospitals, and insurers share information with you freely. After 18, that designation vanishes. Even if you're still paying the insurance premiums, even if your child is on your plan until age 26, healthcare providers are legally prohibited from disclosing your adult child's medical information to you without their written consent.[1]

FERPA -- the Family Educational Rights and Privacy Act -- does the same thing for education records. Once a student turns 18 or enrolls in a postsecondary institution at any age, all rights over educational records transfer from the parent to the student.[2] That means your child's college can't tell you their grades, their class schedule, or whether they're even still enrolled -- unless your child signs a release or you qualify under a narrow tax-dependent exception.

These aren't edge cases. They're the default. And they apply whether your child lives at home, moves across the country, or is sitting in the next room.

The Scenario That Makes This Real

Picture this: your 19-year-old is away at college. They're in an accident and taken to the emergency room. You get the call, drive three hours, and arrive at the hospital. You walk up to the desk and ask how your child is doing.

The answer? The hospital cannot tell you. Under HIPAA, your adult child's medical information is protected. If they're unconscious or otherwise unable to give consent, the hospital may use its professional judgment to share limited information -- but it is not required to, and many institutions err on the side of caution.[1]

Without a Healthcare Proxy or a HIPAA authorization form on file, you could be standing in the hallway while decisions are made about your child's care -- and no one is legally obligated to consult you.

This is the scenario that motivates everything below.

The Three Documents Every 18-Year-Old Needs

The solution is three documents. They're straightforward, most can be completed in an afternoon, and together they restore the access you just lost.

1. Healthcare Proxy (Medical Power of Attorney)

A Healthcare Proxy -- also called a Medical Power of Attorney or healthcare agent designation -- allows your child to name someone (typically you) to make medical decisions on their behalf if they become incapacitated. This covers situations where your child can't communicate: unconsciousness, surgery requiring general anesthesia, or a mental health crisis that impairs decision-making.[3]

This is the single most urgent document. Without it, medical providers must follow their own protocols for incapacitated patients, which may or may not include consulting family members.

Every state has its own form and its own rules. Some require notarization, others only require witnesses. Many colleges offer state-specific forms through their student health centers.[4] The National Hospice and Palliative Care Organization provides free advance directive forms for every state, which typically include the healthcare proxy designation.

2. HIPAA Authorization (Release Form)

A Healthcare Proxy only activates when your child can't make their own decisions. But what about the routine situations -- a call to the doctor's office to ask about test results, a question about a prescription, a conversation with a therapist about how things are going?

That's where a HIPAA authorization comes in. This form gives your child's healthcare providers permission to share medical information with the people your child designates -- even when your child is fully capable of making their own decisions.[1] Think of it as a standing permission slip.

Your child can customize this form to limit what's shared. For example, they might authorize general medical information but exclude mental health records or substance use treatment. This kind of granularity can make the conversation easier -- your young adult keeps their privacy where it matters to them, and you get the access you need for peace of mind.

3. Financial Power of Attorney

A Financial Power of Attorney (sometimes called a Durable Power of Attorney) lets your child designate someone to handle financial and legal matters on their behalf.[5] This includes things like:

  • Managing a bank account if they're studying abroad or incapacitated
  • Signing a lease or dealing with a landlord
  • Filing an insurance claim
  • Handling financial aid paperwork
  • Managing bills during an extended illness

Without this document, you can't access their bank account, even if you opened it with them when they were 16. You can't call their credit card company to dispute a charge. You can't step in if they're being scammed. The bank will (correctly) tell you that you have no legal authority.

A "durable" power of attorney remains in effect even if your child becomes incapacitated -- which is exactly when you're most likely to need it. A "springing" power of attorney only takes effect upon incapacitation, which some families prefer if the young adult wants full financial autonomy day-to-day.

What About FERPA and College Records?

FERPA is a different animal. Unlike HIPAA, there's no single federal "release form" -- each college handles it differently. But the principle is the same: your child needs to sign a consent form at their institution authorizing the school to share records with you.[2]

There is one notable exception. If you claim your child as a dependent on your federal tax return, FERPA permits (but does not require) the school to disclose education records to you.[2] In practice, most schools still want a signed release on file before they'll share anything, even if you can prove dependent status.

The simplest approach: during freshman orientation or move-in, have your child sign the school's FERPA release. Most registrar's offices have the form ready to go. Some schools include it in the enrollment paperwork. Ask -- don't assume it's been handled automatically, because it hasn't.

“"When a student turns 18 or enters a postsecondary institution at any age, all rights afforded to parents under FERPA transfer to the student." -- U.S. Department of Education[2]”

How to Get These Documents Done

You have two paths, and both work.

The DIY route: Many states offer free healthcare proxy and advance directive forms through their health department websites or through organizations like CaringInfo.org. Financial POA forms are available through legal form providers, though requirements vary by state -- some must be notarized, some need witnesses, and some need both.[5]

The attorney route: If your family's situation involves any complexity -- blended families, significant assets held jointly with the child, or a child with a disability -- it's worth the few hundred dollars to have an estate attorney draft all three documents together. Many attorneys offer a "young adult package" specifically for this purpose.[3]

Either way, make sure you:

  • Get the right forms for your child's state of residence. If your child goes to college in a different state from your home, you may want documents valid in both states. Healthcare proxy laws vary significantly -- a form valid in Massachusetts may not be recognized in Texas without additional steps.
  • Keep copies accessible. A document locked in a safe deposit box is useless in an emergency. Store digital copies somewhere you can access them at 2 a.m. from a hospital waiting room. This is exactly the kind of critical family paperwork that tools like Heirloom are built to organize -- so the documents you need are never out of reach when it matters most.
  • Review and update regularly. These documents should be revisited whenever your child's circumstances change: new state, new relationship, new health condition. At minimum, review them annually.

The Conversation That Makes It Work

These documents are only as strong as the conversation behind them. If your child feels like you're trying to maintain control over their adult life, they'll resist. If they understand that you're trying to protect them in a genuine emergency, they'll cooperate.

Here's a framework that works for most families:

Start with the scenario. Explain the hospital situation above. Don't lecture -- just describe what would happen and ask, "What would you want me to be able to do?"

Make it mutual. Consider signing your own healthcare proxy and financial POA at the same time. When your child sees that you're also giving someone authority over your decisions in an emergency, it normalizes the whole process. It stops being "my parents are trying to control me" and becomes "our family takes care of each other."

Respect their autonomy. Let your child choose the scope of each document. If they want to limit the HIPAA release, that's their right. If they'd prefer a springing POA over a durable one, discuss it. The goal is protection, not surveillance.

This same conversational approach applies to the financial side of your relationship with your adult child. If you're navigating questions about whether family financial support is a gift or a loan, we cover that in depth in The Gift vs. Loan Conversation -- getting the framing right early prevents years of misunderstanding.

What You Can Do This Week

You don't need to hire a lawyer or clear your calendar. You just need to start.

  1. Download your state's healthcare proxy form. Visit CaringInfo.org and download the free advance directive packet for your state (and your child's college state, if different). Print two copies.

  2. Have the conversation with your child. Use the emergency scenario framework above. Keep it to fifteen minutes. You're not asking for permission -- you're offering protection. Most kids will say yes once they understand what's at stake.

  3. Complete and sign the Healthcare Proxy and HIPAA authorization. Follow the witnessing and notarization requirements for your state. If notarization is required, most banks and UPS stores offer notary services for a few dollars.

  4. Set up a Financial Power of Attorney. If your child has a bank account, a lease, or student loans, a financial POA is worth the effort. Use a state-specific form or consult an attorney if your situation is complex.

  5. Store copies where they're actually accessible. Keep physical originals in a safe place. Store digital copies in a secure location you can access from anywhere -- a password-protected cloud folder, a family document vault, or a dedicated platform like Heirloom that's built for exactly this kind of critical family paperwork.

None of this is difficult. But it is urgent. The gap between your child's 18th birthday and the day these documents are signed is a gap where you have no legal standing -- and emergencies don't wait for paperwork.

Start this week. Your future self will thank you.

Sources

  1. U.S. Department of Health & Human Services. Does the HIPAA Privacy Rule allow parents the right to see their children's medical records? HHS.gov.
  2. U.S. Department of Education. FERPA -- Family Educational Rights and Privacy Act. Protecting Student Privacy.
  3. Guendelsberger Law Offices. Power of Attorney, Health Care Proxy & HIPAA: A College Student's Must-Haves.
  4. CollegiateParent. Important Health Forms for College Students.
  5. AARP. What Is a Power of Attorney (POA)?
  6. Kiplinger. Three Legal Documents Your Child Should Sign When They Turn 18.