You're told you have healthcare rights. Then someone denies coverage, a provider refuses treatment, or a school says they can't help with medical needs. When you ask which law protects you, no one gives a straight answer.

The reason it's confusing is that healthcare rights for people with disabilities aren't covered by one law. They're covered by five major federal statutes, each applying to different situations. The Affordable Care Act governs insurance coverage decisions. The ADA and Section 504 address discrimination by healthcare providers. IDEA covers school-based health services for children. HIPAA protects medical privacy but doesn't grant decision-making authority.

Having five separate laws sounds like overkill until you realize each one has a gap the others don't cover. IDEA protects school health services but stops at age 21. The ADA covers providers but not insurance coverage decisions. HIPAA gives you privacy rights but not the right to make medical decisions for someone else.

This guide shows which protection applies when, how these laws interact, and where the gaps are.

The Affordable Care Act: Insurance Coverage Protections

The ACA created the strongest insurance protections people with disabilities have ever had. Pre-existing condition coverage is the one most people know about. Insurers can't deny coverage, charge higher premiums, or impose waiting periods based on disability or chronic health conditions.

The protection applies whether you're buying coverage through the marketplace, getting employer-sponsored insurance, or enrolling in Medicaid expansion. It covers adults and children.

What the ACA doesn't do is require insurers to cover every treatment you want. Plans must cover essential health benefits: ten categories including mental health, prescription drugs, and rehabilitative services. The specifics vary by plan. If your child needs a specialized therapy that falls outside the plan's covered services, the ACA won't force the insurer to add it.

What This Means for Medical Necessity Denials

When an insurer denies a treatment as "not medically necessary," they're not violating the ACA's pre-existing condition rule. They're making a coverage determination based on their plan's medical policies. You can appeal that decision, but the ACA doesn't guarantee approval. It guarantees you can't be denied a plan in the first place.

The appeal process has two stages: an internal review by the insurance company, which can take up to 180 days for ERISA plans, and an external review by an independent organization if the internal appeal fails. Forty-six states offer external review through Independent Review Organizations.

Winning an appeal usually requires a letter of medical necessity from your provider that directly addresses the insurer's specific denial reason. Generic letters rarely work. The letter needs to explain why this treatment meets the plan's medical criteria, cite clinical evidence, and counter the reasoning in the denial.

2026 ACA Changes to Watch

Enhanced ACA subsidies expired at the end of 2025, causing premium increases for many families buying marketplace coverage. A proposed rule would eliminate the low-income Special Enrollment Period, limiting when people can sign up outside of open enrollment. Public comment on that rule closed March 13, 2026. The pre-existing condition protections remain in place regardless of subsidy changes.

ADA Title II and Title III: Provider Discrimination Protections

The Americans with Disabilities Act prohibits disability discrimination in public services (Title II) and places of public accommodation (Title III). That includes hospitals, clinics, doctor's offices, pharmacies, and other healthcare providers.

Full and equal access means healthcare providers must offer the same services to people with disabilities that they offer to everyone else. Reasonable modifications are required unless they would fundamentally alter the service or create an undue burden. These modifications can include changes to policies, practices, or procedures.

What this looks like in practice:

• A clinic must allow a service animal even if it has a no-pets policy
• A hospital must provide an ASL interpreter for a deaf patient at no charge
• An imaging center must accommodate longer appointment times for a patient who needs physical assistance
• A provider can't refuse to treat someone based on assumptions about quality of life or ability to benefit from care

The May 1, 2024 Section 504 Final Rule

Section 504 of the Rehabilitation Act applies to any program or activity receiving federal financial assistance. That includes most hospitals, clinics, and health systems that accept Medicare or Medicaid. The Department of Health and Human Services issued a final rule on May 1, 2024, that significantly strengthened these protections.

The rule explicitly prohibits treatment decisions based on stereotypes, biases, or assumptions about disability and quality of life. It addresses a documented pattern of providers denying life-saving treatment or withholding organ transplants based on subjective judgments about whether a person's life is worth saving.

This is the most powerful update to Section 504 implementation in decades. It's enforceable through HHS Office for Civil Rights complaints.

When Providers Say They Can't Help

If a provider refuses to treat your child or recommends against a treatment because of their disability, not because of a legitimate medical contraindication but because of an assumption about outcomes or quality of life, that's a Section 504 violation. Document the refusal, get it in writing if possible, and file a complaint with the HHS Office for Civil Rights.

Providers are allowed to decline a treatment if there's a genuine clinical reason it won't work or would cause harm. They're not allowed to decline based on disability alone.

IDEA: School-Based Health Services

The Individuals with Disabilities Education Act requires schools to provide a free appropriate public education (FAPE) to children with disabilities. That includes related services: supportive services necessary for the child to benefit from special education.

Related services explicitly include school health services, school nurse services, and medical services for diagnostic or evaluation purposes. If your child needs a medical procedure or health monitoring during the school day to access education, the school is required to provide it or arrange for it.

Common examples include administering medications, catheterization, tube feeding, diabetes monitoring and insulin administration, seizure monitoring and emergency protocols, and nebulizer treatments for asthma.

The school isn't required to provide services that must be performed by a licensed physician. But services that can be performed by a school nurse or trained aide are covered.

Other Health Impairment (OHI) Category

Many medical conditions qualify a child for an IEP under the Other Health Impairment category. OHI covers conditions that limit strength, vitality, or alertness due to chronic or acute health problems: ADHD, epilepsy, diabetes, asthma, heart conditions, and more.

If your child's medical condition affects their ability to learn, they may qualify for an IEP even if they don't have a cognitive or developmental disability. The health services they need become part of the IEP as related services.

Your rights as a parent include requesting a formal IEP review, suggesting changes to services or goals, and agreeing or disagreeing with the school's proposed plan. If the school refuses to provide a health service you believe is necessary, you can request mediation, file a state complaint, or request a due process hearing.

IDEA protections end at age 21 or when the student graduates with a regular diploma, whichever comes first. After that, adult disability rights shift to the ADA and Section 504.

HIPAA: Privacy Rights and Medical Records Access

The Health Insurance Portability and Accountability Act protects the privacy of medical information. It gives you the right to access your own health records, request corrections, and control who else can see them.

For adults with disabilities, HIPAA can be both a protection and a complication. The law recognizes a "personal representative," someone legally authorized to make healthcare decisions on another person's behalf, as having the same access rights as the patient.

Who qualifies as a personal representative: a legal guardian appointed by a court, someone holding healthcare power of attorney, or a parent of a minor child under 18 in most states.

Who doesn't automatically qualify: family members without legal authority, people involved in the person's daily care who haven't been formally designated, or representative payees for Social Security benefits. Representative payee authority covers financial matters, not medical decisions.

The Gap Between Privacy and Decision-Making Authority

HIPAA gives providers the right to refuse to share information with family members if the patient hasn't authorized it or if there's no legal representative. Even if a person needs support making medical decisions, providers may decline to involve family without a guardianship order or signed healthcare power of attorney.

This creates a catch-22: You can't help someone make healthcare decisions if you're not allowed to see their medical information, but getting legal authority often requires proving they can't make decisions independently.

The disability rights position is that having a disability doesn't automatically remove decision-making capacity. Presumption of competence means providers should seek consent from the person themselves, offer supported decision-making options, and avoid jumping to guardianship as a first resort.

Supported Decision-Making as an Alternative

Eighteen states plus the District of Columbia now recognize supported decision-making (SDM) as a formal legal alternative to guardianship. SDM allows an adult with a disability to appoint supporters who help them understand information and make choices, without transferring legal authority.

Some healthcare systems accept SDM agreements as evidence of the person's chosen support network, giving supporters access to information and involvement in care planning. Others still default to requiring guardianship. HIPAA doesn't mandate recognition of SDM. It's up to individual providers and state law.

If your adult child has capacity to sign a healthcare power of attorney, that's usually the clearest path to ensuring you can access their medical information and participate in decisions. If they don't have capacity to sign legal documents, guardianship may be necessary. It's worth exploring whether a limited guardianship, which preserves some decision-making rights, is sufficient rather than a full guardianship.

Medicaid: HCBS Waivers and Person-Centered Care

Medicaid is a health insurance program for low-income individuals and families. For people with disabilities, it's often the only insurance that covers long-term services and supports that commercial plans don't: personal care assistance, respite, habilitation services, home modifications, and adaptive equipment.

Home and Community-Based Services (HCBS) waivers allow states to cover these services as an alternative to institutional care. There are 257 active HCBS waiver programs nationwide. Each state designs its own waivers, sets eligibility criteria, and determines what services are covered.

The ADA's integration mandate requires services to be provided in the most integrated setting appropriate to the person's needs. Medicaid HCBS waivers are a direct result of that mandate. They offer services in home and community settings rather than requiring institutional placement to access them.

Person-Centered Care Requirements

HCBS waivers must follow person-centered planning requirements. That means the individual receiving services, or their representative, directs the planning process, identifies their own goals, and has a say in who provides services and how they're delivered.

The plan must reflect what's important to the person, not just what's important for the person from a clinical perspective. If your child wants to participate in a community activity and needs support to do it, person-centered planning should address that goal instead of only focusing on therapy targets.

Waiver Wait Lists and Denials

Many states have wait lists for HCBS waivers because funding is limited. Wait times can run years. Some states use "need-based" prioritization, moving people with higher support needs or crisis situations to the front of the list.

If Medicaid denies a waiver application or specific service, you have appeal rights. The process varies by state but typically includes a fair hearing where you can present evidence of medical necessity and challenge the denial.

Mental Health Parity: Behavioral Health Coverage Requirements

The Mental Health Parity and Addiction Equity Act requires health plans to cover mental health and substance use disorder treatment on equal terms with medical and surgical care. You can't have higher copays, stricter visit limits, or more restrictive prior authorization for behavioral health than for other conditions.

New rules effective in 2026 require plans to provide meaningful benefits for any covered mental health or substance use disorder condition. Plans must also conduct comparative analyses to ensure their provider networks for behavioral health are adequate and comparable to their medical networks.

What Mental Health Parity Doesn't Cover

Disability income insurance is not subject to mental health parity. Those policies replace lost wages, not medical costs, so the parity law doesn't apply.

Autism therapy coverage isn't automatically a mental health parity issue unless the plan treats autism as a mental health condition. Most states have separate autism insurance mandates that require coverage of applied behavior analysis (ABA) and related therapies. Those mandates vary widely. Some cover up to a certain dollar amount per year, others cover specific ages, and some have no caps.

If your plan denies autism therapy as "not medically necessary" or imposes limits that don't apply to physical therapy, check whether your state has an autism coverage mandate and whether the denial violates that law. Mental health parity may also apply, depending on how the plan categorizes the treatment.

How These Laws Interact Across the Lifespan

The legal protections shift as your child grows up.

Birth to age 3: IDEA Part C early intervention provides services in natural environments like home and childcare. Medicaid may cover therapies and equipment. HIPAA doesn't apply yet. Parents have full access to medical records as legal guardians of a minor.

Ages 3 to 21: IDEA Part B covers special education and related services including school-based health services. Parents remain legal guardians with full HIPAA access. ACA protections ensure insurance coverage regardless of pre-existing conditions. Medicaid HCBS waivers may provide additional home and community-based supports.

Age 18: The child becomes a legal adult. HIPAA access transfers to them unless you have healthcare power of attorney or guardianship. IDEA services continue until age 21 or graduation. If the young adult can't consent to a power of attorney and you need ongoing access to medical information and decision-making authority, you'll need to pursue guardianship through the courts.

Age 21+: IDEA ends. Rights shift entirely to the ADA and Section 504 for non-discrimination protections. Medicaid HCBS waivers may continue if the person remains eligible. If you don't have legal authority through guardianship or power of attorney, you can't access their medical records or make healthcare decisions for them, even if they need support.

Where the Gaps Are

These laws don't cover everything.

Treatment denials based on cost: Insurers can deny expensive treatments if there's a less costly alternative that's medically appropriate, even if your provider recommends the more expensive option. The ACA doesn't require coverage of every possible treatment, just nondiscriminatory access to the plan's covered benefits.

Out-of-network providers: Plans aren't required to cover out-of-network care except in emergencies or when there's no in-network provider for a necessary service. If your child sees a specialist who doesn't take your insurance, you'll likely pay the full cost unless you can prove the in-network options are inadequate.

Experimental treatments: Most plans exclude experimental or investigational treatments. If a therapy hasn't been proven effective through clinical trials, insurers can deny it as experimental even if your provider believes it might help.

Transition-age services: The gap between age 21, when IDEA ends, and adult services is well-documented. Adult disability services are often poorly funded, have long wait lists, and don't replicate the educational supports young adults received in school.

What to Do When Your Rights Are Violated

If an insurance company denies coverage you believe should be covered, file an internal appeal. If that fails, request an external review. If the denial appears to violate the ACA, such as discrimination based on a pre-existing condition, or mental health parity requirements, file a complaint with your state insurance commissioner or the Department of Labor.

If a healthcare provider refuses treatment or discriminates based on disability, document it in writing and file a complaint with the HHS Office for Civil Rights. Complaints must be filed within 180 days of the discrimination.

If a school refuses to provide health services your child needs to access education, request an IEP meeting, document the refusal, and file a state complaint with your state education agency or request mediation through your district's special education office.

If a provider won't give you access to medical records for an adult family member and you believe you should have access as their healthcare power of attorney or guardian, provide documentation of your legal authority in writing. If they still refuse, file a HIPAA complaint with HHS.

Why You Need to Know All of This

No single law protects every healthcare situation a person with a disability will encounter. The ACA covers insurance access. The ADA and Section 504 address provider discrimination. IDEA covers school-based health services for children. HIPAA protects privacy. Medicaid funds services commercial insurance won't cover. Mental health parity ensures equal treatment of behavioral health conditions.

You need to know which law applies to the problem you're facing. When a school says they can't provide a health service, the answer is IDEA. When a provider refuses to treat your child because of their disability, the answer is the ADA or Section 504. When an insurer denies coverage, the answer depends on why. Pre-existing condition violations are an ACA issue, medical necessity denials are a plan coverage issue, and behavioral health limits might violate mental health parity.

The system is designed to be navigated by people who know which question to ask. This is the map.