Maintenance
Part of Four questions that sort ordinary mental wellbeing weather from something more
6 points worth checking on mental wellbeing rules
Six points worth checking on mental wellbeing rules include who a clinician may tell, what a school records, and the family history line you write yourself.
What to take away
Six points worth checking on mental wellbeing rules decide who may be told what about a child's mental health. Ask who is allowed to know that your child is struggling and you will get confident answers that contradict each other.
Four different sets of rules are answering, written by different bodies for different purposes. Here are the six points worth checking: what each one is, who sets it, and what to ask.
- Confidentiality is not one rule but several. HIPAA, the UK GDPR, FERPA and state minor consent laws are set by different bodies and can point opposite ways in the same week.
- A young person's say over their own health information grows with age. Where that line sits is decided locally, not universally.
- A school's pastoral policy and its safeguarding policy are separate documents doing separate jobs. Ask for both by name.
- Rules about information never outrank immediate danger. Where a child may be at risk now, contact emergency services first.
The six points and the bodies that set them
- Clinical confidentiality.Check the privacy notice and the regulator's confidentiality guidance. In the US, the HIPAA Privacy Rule (45 CFR Parts 160 and 164) is enforced by the HHS Office for Civil Rights. In the UK, the General Medical Council publishes confidentiality guidance for doctors. In Canada, the Medical Council of Canada and provincial colleges; in Australia, the Medical Board of Australia and AHPRA. Ask what the practice may share, with whom, and how it handles a minor's request. It is on the list because most parents assume they already know it.
- Consent line for a minor's own health information.Check your state or country minor consent law. In many US states, the age sits between 12 and 16 for some outpatient mental health services, and some states set no fixed age. In California, a minor of 12 or over may consent to outpatient mental health treatment if the clinician judges them mature enough to take part (Health and Safety Code section 124260).
In England, 16 and 17 year olds consent to their own treatment under section 8 of the Family Law Reform Act 1969, and under 16 the Gillick test and Fraser guidelines apply. In Quebec, the Civil Code lets a minor of 14 consent alone to care their state of health requires.
In South Australia, 16 year olds consent alone under the Consent to Medical Treatment and Palliative Care Act 1995, and 14 and 15 year olds need a second doctor's agreement. Ask when a young person can speak alone and when their consent governs sharing. This point decides whether a parent is told by default.
- A school's pastoral policy.Check the school's pastoral care policy and student records rules. In the US, FERPA (20 U.S.C. 1232g; 34 CFR Part 99) gives parents rights to inspect education records, with limited exceptions. In England, Keeping Children Safe in Education (KCSIE) sets the framework, and a designated safeguarding lead (DSL) coordinates. Ask who inside the building is told, what gets written down, where it is stored, and when a family is contacted.
- A school's safeguarding policy.Check the school's child protection or safeguarding policy, separate from pastoral care. In England, KCSIE and local authority designated officer (LADO) routes apply. In the US, state mandatory reporting laws and the Child Abuse Prevention and Treatment Act (CAPTA) require reports of suspected abuse or neglect. In Australia, state and territory child protection acts apply. Ask when staff must pass something on regardless of who asked them not to.
- Data protection law.Check the national or regional privacy regulator. In the UK, the Information Commissioner's Office (ICO) enforces the UK GDPR and the Data Protection Act 2018, which sets 13 as the age for consent to information society services. In the EU, national data protection authorities enforce the GDPR, and Article 8 sets 16 as the default age for children's consent, which member states may lower to 13. In Canada, the Office of the Privacy Commissioner and provincial health privacy offices apply. In Australia, the Office of the Australian Information Commissioner (OAIC) enforces the Privacy Act 1988. Ask how information is stored, shared, corrected, and how to complain.
- Duties to act where a child is at risk.Check mandatory reporting laws and child protection duties. In the US, CAPTA requires states to have reporting systems, and state laws name who must report and the timeline. In the UK, the Children Act 1989 and Working Together to Safeguard Children 2023 set duties. In Australia, state and territory child protection legislation sets duties. Ask whether your clinician, teacher, or counselor is a mandated reporter.
The six points in one table
| The point | Who sets it | What it is really about |
|---|---|---|
| Clinical confidentiality | Health regulators and professional bodies, differently in each country; in the US, HIPAA and HHS OCR | What a clinician may share, with whom, and when a young person's own consent governs |
| Consent line for a minor's own health information | National or regional legislators, plus health regulators; in England, Gillick competence and Fraser guidelines | The stage at which a young person can speak to a clinician alone, and when their consent governs sharing |
| School pastoral policy | The school, inside a framework set by a district, authority or ministry; in the US, FERPA | Who inside the school is told, what is recorded, and when a family is contacted |
| School safeguarding policy | The school, inside KCSIE in England, state mandatory reporting laws in the US, and child protection acts in Australia | When staff must pass something on regardless of who asked them not to |
| Data protection law | National or regional legislators and regulators; ICO in the UK, GDPR authorities in the EU, OAIC in Australia | How information about a person is stored, shared and corrected, whoever holds it |
| Duties to act where a child is at risk | Legislators, and the agencies that implement them; CAPTA in the US, Children Act 1989 in the UK | Who must report suspected abuse or neglect, and to whom |
Most household arguments are about the first two.
Six rules and who sets them
The point
- Clinical confidentiality
- Health regulators; HIPAA
- Minor consent line
- Legislators; Gillick
- School pastoral policy
- The school; FERPA
- School safeguarding
- KCSIE; state laws
- Data protection law
- ICO; GDPR; OAIC
- Duty to act at risk
- CAPTA; Children Act 1989
Who sets it
- Clinical confidentiality
- What a clinician may share
- Minor consent line
- When consent governs sharing
- School pastoral policy
- Who is told, what is recorded
- School safeguarding
- When staff must pass it on
- Data protection law
- How data is stored and shared
- Duty to act at risk
- When passing on is mandatory
What it decides
- Clinical confidentiality
- Minor consent line
- School pastoral policy
- School safeguarding
- Data protection law
- Duty to act at risk
The consent line moves, and it moves locally
This surprises parents at the worst moment, often in a waiting room. In the US, state minor consent statutes decide; in England, Gillick competence does. Ask at booking, not in the appointment. Ask who will be told what, what your child can ask to keep private, and what would have to be passed on anyway.
Asking in front of your child is better than asking privately. It shows them the boundaries are real, which is usually why they agreed to come. Age-by-age guidance covers the same handover in the rest of their life.
What a school's rules cover, and what they do not
Two questions get you most of what you need. Who inside the building will know, and what is written down where. In the US, FERPA gives parents inspection rights over education records, with exceptions for sole possession notes and some health records.
Schools differ enormously on both. You cannot infer either from another school's practice or from a summary written elsewhere. School guidance covers how to raise it with the right person rather than the most senior one.
Where to look each one up
Go to the body that publishes the rule, not to a summary of it.
- Clinical confidentiality. In the US, the HHS Office for Civil Rights publishes its summary of the HIPAA Privacy Rule, and your provider publishes a Notice of Privacy Practices. In the UK, the General Medical Council's confidentiality guidance for doctors. In Canada, your provincial college's practice standards.
- Minor consent. In the US, the statute pages of your state legislature, with California Health and Safety Code section 124260 as the worked example. In England, GOV.UK guidance on consent to treatment for people under 16. In Canada, the Civil Code of Quebec. In Australia, the Consent to Medical Treatment and Palliative Care Act 1995 in South Australia.
- School pastoral policy. The school's own pastoral care policy, and the US Department of Education pages for FERPA at 34 CFR Part 99.
- School safeguarding policy. GOV.UK for Keeping Children Safe in Education, and your local authority for the LADO route. In the US, your state statute on mandatory reporting. In Australia, the child protection act of your state or territory.
- Data protection. The ICO children's data pages in the UK. The OAIC Privacy Act 1988 pages in Australia. The Office of the Privacy Commissioner of Canada's health privacy pages. In the EU, your national data protection authority.
- Duties to act. The Children's Bureau at the US Department of Health and Human Services for CAPTA. Working Together to Safeguard Children 2023 on GOV.UK. Your state or territory child protection act in Australia.
Where to look each one up
- Clinical confidentialityyour professional regulator or practice
- Consent linestate or national minor consent law
- School practicethat school's pastoral and safeguarding policies
- Information rightsyour data protection authority
- Anything with a consequencea qualified local adviser
- Note the date you checked
Note the date you checked. This area has been actively legislated in several countries for years running.
The rule your household writes itself
Most of what governs this in practice is not law. It is what your family has said out loud about who gets told what.
Settle it before you need it. Decide what happens if one of you learns something the other has not. Decide what your child can ask you to keep between you, and what you will plainly say you cannot.
You can ask me not to tell people, and I will keep that, except where you are in danger. If that happens I will tell you before I tell anyone else.
You will break a blanket secrecy promise, and breaking it in a crisis costs more than never making it. Family agreements covers writing that down in a form that survives a bad week.
What no rule decides
No regulator publishes a threshold for parental worry, and no rule tells you whether what you are looking at is a rough month or something more.
If you want general reading before an appointment, the National Institute of Mental Health keeps publications written for families, and the World Health Organization has an overview of adolescent mental health with an international rather than a national frame.
Where a young person says anything about not wanting to be here or about hurting themselves, get medical help the same day, stay with them, and where there is immediate danger contact emergency services. Mental wellbeing covers what that conversation looks like.
Common questions
Can my child stop a doctor telling me things?
At some stage, in most places, to some extent, and the detail is set locally. In the US, state minor consent laws and HIPAA exceptions decide much of it; in England, Gillick competence and Fraser guidelines. Ask the service what would have to be passed on regardless, rather than assuming either answer.
The school told me something my child asked them not to. Were they allowed?
Possibly, and the answer lies in their safeguarding policy rather than in fairness. Ask to see the policy and ask which part they were acting under.
In England, that may be KCSIE; in the US, a state mandatory reporting law. If you disagree with how it was applied, that is a complaint with a defined route, which the same policy will name.
Is any of this different in 2027 from last year?
Nothing on this page changed for 2027. No rule cited here has a confirmed 2027 start date; where a change has been proposed, it stays a proposal until the body that publishes the rule says otherwise. In the US, state minor consent laws and FERPA guidance change by state and year. In the UK, KCSIE is updated regularly.
Do I have to tell the school anything at all?
Usually not, as a rule about you. Whether to is a separate judgment about whether the school can make your child's week better, which is often the strongest reason to.
This page is general information for parents, not legal or medical advice. Nothing here states what any law, regulator, school or service currently requires. Rules differ by country, region and institution, and change; check the current wording with the body that publishes it, or take advice where you live.
