GDPR & Data Protection

Paediatric physiotherapy - parental consent and documentation

Author:

A mother brings her 8-year-old son to Mr Marcin's practice after a sprained ankle. She fills in the consent form, everything seems fine.

A mother brings her 8-year-old son to Mr Marcin's practice after a sprained ankle. She fills in the consent form, everything seems fine. Two weeks later the boy's father - divorced from the mother - calls, upset, asking why his son underwent treatment without his knowledge or consent. Mr Marcin suddenly realises he doesn't know who actually had the right to decide on the therapy.

This is a scenario many physiotherapists working with children encounter. Parental consent for minor patients is an area where it's easy to make a mistake with serious legal consequences. In this article we'll explain who can give consent, when you need both parents' signatures, how to treat a teenager, and how to protect a child's data under GDPR.

Consent for a health service on behalf of a minor is so-called substitute consent - given by the legal representative. Under the Family and Guardianship Code, a child's legal representatives are usually both parents holding parental authority.

The legal basis for consent to health services stems from the Patient Rights and Patient Ombudsman Act and the Act on the Professions of Physician and Dentist (applied by analogy). A physiotherapist, as a healthcare professional, must respect these rules.

This is the most common source of problems. The practical rule works like this:

Situation Who signs the consent
Routine, standard therapyOne parent is sufficient (the other is presumed to agree)
Higher-risk / long-term therapyConsent from both parents is recommended
Divorced parents, conflictConsent from both, or confirmation of the scope of parental authority
One parent has limited parental authorityConsent from the parent with full authority
Legal guardian (not a parent)Guardian's consent + a document confirming guardianship

For routine procedures carrying little risk, one parent's consent is generally accepted as sufficient, since the other parent is presumed to agree. For decisions significant to the child's health, it's safer to obtain consent from both parents.

[Solo] Example - solo practice: A child arrives with a postural defect requiring 20 rehabilitation visits. This is long-term therapy. You ask for both parents' signatures on the consent form, and if only one shows up, you add a statement that they are acting with the other parent's agreement.

[Group] Example - group practice: The practice has a registration procedure: reception asks about the family situation when registering a child and informs parents that the first visit requires a signature from the parent holding parental authority. For divorced parents, reception notes who holds custody.

This is an important and often overlooked rule. A patient who has turned 16 has the right to co-decide about their own treatment. Cumulative (dual) consent then applies:

  • Consent is given by the legal representative (parent)
  • and by the minor patient themselves, once over 16

If a 16-year-old objects to therapy but the parent insists on it, a conflict arises that, in extreme cases, is resolved by a family court. In physiotherapy practice such situations are rare, but both parties should still sign the consent.

Medical records for a minor patient

A child's patient record follows the same rules as an adult's, with a few additions:

  • The child's details (name, PESEL, date of birth)
  • The legal representative's details (parent/guardian) giving consent
  • Information on the scope of parental authority, if relevant (e.g. divorce)
  • The interview, diagnosis, therapy plan and progress notes
  • Signed consent to treatment and to data processing

Records are, as a rule, kept for 20 years, but for children's records the deadlines are modified - records of a patient who died before turning 2 are retained for 22 years.

GDPR and a child's data

A child's health data is a special category of personal data (GDPR Article 9) - protected just as strongly as an adult's, and in practice requiring even greater caution.

Key rules:

  • The party consenting to processing the child's data is the legal representative
  • The GDPR privacy notice should be addressed to the parent/guardian
  • Marketing consents (SMS, newsletter) are signed by the parent, not the child
  • Photos of the child's therapy progress require a separate, explicit parental consent - never publish a child's image without it

[Solo] Example - solo practice: You want to showcase the results of correcting a postural defect on your website. Even with the face blurred - you need a separate, explicit parental consent to use the child's image. Without it you risk a UODO complaint and civil claims.

[Group] Example - group practice: The practice runs a social media profile. The rule is firm: no photo of a child without a signed parental consent kept in the documentation. Reception makes sure the image-use consent is a separate document, not a hidden clause buried in the general notice.

Common mistakes in paediatric physiotherapy

  • Accepting consent from only one parent for long-term therapy despite a parental conflict
  • Skipping the consent of the patient themselves when they're over 16
  • Failing to verify who holds parental authority after a divorce
  • Publishing a child's image without a separate consent
  • Treating a grandparent or aunt as entitled to give consent (they are not legal representatives without formal guardianship)

Frequently asked questions

For routine, low-risk therapy, usually yes - the other parent is presumed to agree. For long-term or higher-risk therapy, or when the parents are in conflict, it's safer to get consent from both. If only one parent comes in, it's worth adding a statement that they're acting with the other parent's agreement.

Not alone, but they co-decide. From age 16, dual consent applies: it's signed both by the parent (legal representative) and by the minor themselves. A teenager's objection to a parent's wishes can, in extreme cases, be resolved by a family court.

What if the parents are divorced?

Establish who holds parental authority. The parent with full authority can consent to standard therapy. For significant decisions or conflict, it's worth obtaining consent from both and noting the scope of each parent's parental authority in the documentation.

Can I publish a photo of a child's therapy?

Only on the basis of a separate, explicit parental consent to use the image - even with the face blurred. Consent to therapy or a general GDPR notice is not sufficient. Publishing without consent risks a UODO complaint and civil claims.

CTA: Want ready-made consent templates for minor patients - substitute consent, dual consent for 16+, a GDPR notice for parents, and an image-use consent for children? The STANDARD package includes a full set of documents adapted to paediatric physiotherapy. See FizjoReady packages →

Related articles:
- Patient consent to a physiotherapy procedure - template
- GDPR in a physiotherapy practice - a practical guide
- How to correctly keep a patient record in physiotherapy

Newsletter

Regulatory changes and practical tips for physiotherapy practices. No spam.