HIPAA Authorization for a Parent: How to Get Their Medical Info

To get access to a parent's medical information, have your parent sign a HIPAA authorization (often called a HIPAA release form) naming you, and give a copy to every doctor, hospital and insurer they use. Pair it with a health care power of attorney, which makes you their personal representative once it takes effect, and ask each health system for patient portal proxy access. Medicare needs its own form on top of that.

The good news first: HIPAA lets doctors say more to family than many front desks think. The form mostly fixes the days when "more than they think" still isn't enough.

What doctors can already tell you without a form

HIPAA doesn't require a signed release before a doctor talks to family. The rule in 45 CFR 164.510(b) lets a provider share information with a family member, relative, close friend or anyone else your parent identifies, as long as it's directly relevant to that person's involvement in their care or in paying for it. HHS has a plain-English version for families.

How it plays out depends on whether your parent is there:

• Your parent is present and able to decide. The doctor can share if your parent agrees, if your parent is given the chance to object and doesn't, or if the doctor reasonably infers from the situation that your parent doesn't mind. You sitting in the exam room with them usually covers it.
• Your parent isn't there, or can't decide. The doctor can use professional judgment about whether sharing is in your parent's best interest, and if so share what's directly relevant to your role. The same rule lets them hand you filled prescriptions, medical supplies or X-rays to pick up.

Two limits. It's the doctor's call, not your right, so a cautious office can still say no. And they share what's relevant to your involvement, not the whole chart.

Some offices also have a policy stricter than HIPAA. The United Hospital Fund's Next Step in Care guide for providers puts it bluntly: "HIPAA does not require a written release for you to share information with family caregivers," but a hospital may have gone further on its own. The same guide quotes HHS on a point families rarely hear: nothing in HIPAA stops a provider from listening to you. You can always call and tell the doctor what you're seeing at home.

Four ways in, compared

People use "HIPAA form," "medical power of attorney" and "proxy" as if they were one thing. They're not.

And one that doesn't belong on the list: a financial power of attorney. HHS says a power of attorney that doesn't cover health care decisions doesn't make someone a personal representative for health information.

Why the health care power of attorney isn't always enough

Under 45 CFR 164.502(g), when someone has authority under state law to make health care decisions for an adult, providers must treat that person as the patient for HIPAA purposes. HHS explains this in its page on personal representatives. That's broad access.

The catch is the word "authority." As AARP describes it, a health care proxy gives you the right to talk with doctors and make decisions if your parent is unable to do so. Depending on the wording and your state's law, the document may only kick in after that point. While your parent is sharp enough to decide but tired of calling the cardiologist's office, you may not be anyone's personal representative yet. The HIPAA authorization covers that stretch.

AARP also notes that in some states a health care proxy removes the need for a separate HIPAA authorization, and that having both can help avoid delays. Read your parent's document, or ask the attorney who drafted it, to see when yours takes effect.

What a valid HIPAA authorization has to include

Doctors' offices usually have their own form, and that's normally the one to use. AARP says you can also get a general one from an elder law attorney, often alongside the health care proxy. Either way, the federal rule at 45 CFR 164.508 says a valid authorization must contain:

• A specific description of the information to be shared (for example, "all medical records, test results and billing information")
• Who is allowed to share it (the doctor, practice or hospital)
• Who may receive it (you, by name, plus any sibling who should be included)
• The purpose. "At the request of the individual" is enough when your parent is the one asking
• An expiration date or an expiration event
• Your parent's signature and the date. If someone signs as their personal representative, a description of that person's authority
• A statement that your parent can revoke it in writing, and how (or a pointer to the office's privacy notice that explains it)
• A statement about whether treatment can be conditioned on signing it
• A statement that information shared under it may be passed on by the recipient and no longer protected by HIPAA
• Plain language

The regulation also says the form isn't valid if any required element is left blank, if the expiration date has passed, or if the office knows it was revoked. So check the small boxes before your parent signs.

Choices worth thinking about:

• Expiration. The rule allows a date or an event. A date a few years out means signing a fresh form later. An event, such as discharge from a particular hospital stay, ends it sooner. Ask what the office's form allows, and note the date in your records.
• Scope. AARP points out a release can cover everything or only certain information, and past, present and future records or one medical event. Broad is easier for a caregiver. Narrow is your parent's right.
• Therapy notes. Psychotherapy notes have their own rule under 164.508 and generally need a separate authorization. A general release may not reach them.
• Names. List each person by full name. "My children" invites a phone call about which one you are.

Setting it up, one office at a time

This is not glamorous work. It is mostly phone calls and a stapler.

1. Talk with your parent on an ordinary day. Explain that this is about letting you help with appointments and calls, not taking over. It's their information, and the form is their choice.
2. List every place that holds their information. Primary care, each specialist, the hospital system they'd go to, the pharmacy, any home health agency, and their insurance or Medicare plans. A current medication list is a good map, since every prescriber on it is an office to call.
3. Use each office's own form when it has one. Staff know where their own form goes.
4. Confirm it's in the chart. Ask the front desk to scan it in and to note in the record that you're authorized. Then, a week later, call and ask a simple question to test it.
5. Do the Medicare form separately. Medicare's form CMS-10106 says that by law, your parent must give 1-800-MEDICARE permission in writing before it will share information with anyone else. They can submit it by logging in to their Medicare.gov account, or mail it to the address on the form. It lets your parent choose any information or only certain kinds (eligibility, claims, plan enrollment, premium payments), and either an end date or no end date. AARP notes private insurers have similar forms of their own, so a Medicare Advantage, Medigap or Part D plan may want its own.
6. Set up portal proxy access (more below).
7. Keep a record. Note which offices have the form, the date, and when it expires.

Patient portal proxy access

This is the part most HIPAA articles skip, and it's the one you'll use every week. Many health systems let an adult give a caregiver a separate login to their portal, often called proxy access. Depending on the access level, you can see test results, appointments and messages without waiting for anyone to call you back.

How it works varies by system, but a few things are common:

• You get your own login. BJC HealthCare's adult proxy form, for example, says the proxy must log in with their own username and password. Don't use your parent's password; proxy access exists so you don't have to.
• Your parent can often grant it from inside the portal. At National Jewish Health, an adult with an active account can invite a caregiver through the portal's sharing menu; otherwise there's a paper form for the medical records department. BJC's paper version is signed by both the patient and the proxy.
• There are levels. At National Jewish Health, full access includes medical records, test results, messaging and scheduling, while limited access shows only some information and restricts actions like messaging.
• If your parent can't sign, expect to send a copy of the health care power of attorney or a guardianship order instead.
• Paper requests take time. National Jewish Health says to expect a response to a paper request within two weeks.

Each health system is separate. If Mom sees doctors at two systems, that's two proxy requests.

Getting copies of the records themselves

Talking with the doctor and getting copies of the chart are different things. Your parent has a right to their own records, with narrow exceptions, under 45 CFR 164.524. The provider generally has 30 days to act on a request, with one 30-day extension if it explains the delay in writing, and it can charge only a reasonable, cost-based fee for copies.

With a signed authorization naming you, the office can release records to you directly. A personal representative can request them the same way your parent would. Either way, expect a records request form, and bring ID.

If what you really need is the latest medication list, recent lab results or the last discharge summary, the portal is usually faster than a records request.

When the office still says "HIPAA"

It happens, even with paperwork on file. A few things that tend to help:

• Ask whether your form is in the chart. Forms get lost between the front desk and the record. Have your copy ready to fax or upload.
• Put your parent on the phone. If your parent is able, they can tell the office, on a call with you, that it's fine to talk to you. Under 164.510(b), your parent's agreement is enough for the office to share what's relevant to your role.
• Ask for the privacy officer. HIPAA requires every covered provider to designate a privacy official, who usually knows the rule better than a busy front desk.
• Share, even if they won't. You can still tell the doctor about falls, confusion or skipped doses. They can listen.

One exception to know about: a provider may decline to treat someone as a personal representative if it reasonably believes that person has abused or neglected the patient, or that treating them as the representative could endanger the patient. That's in 164.502(g)(5). The provider also has to judge that treating that person as the representative isn't in your parent's best interest.

If your parent can no longer sign

A HIPAA authorization has to be signed by your parent or by someone with authority to act for them. If your parent no longer has capacity and never signed a health care power of attorney, the options usually run through state law: a default surrogate statute in many states, or a court guardianship. Our guide to important documents for aging parents walks through that fallback. It's slower and costs more than a form signed on a good day, which is the best argument for doing the forms now.

Keep copies of the authorization, the health care power of attorney and the Medicare confirmation with the rest of your parent's papers in an emergency binder, and put a copy of the proxy in the folder you'd grab for a hospital trip. Here's the full list of what to bring to the ER.

Frequently asked questions

Can doctors talk to family members without a HIPAA authorization?

Yes, often. HIPAA lets providers share information relevant to your role in your parent's care if your parent agrees or doesn't object, or, when your parent isn't present or can't decide, if the provider judges it's in their best interest. It's at the provider's discretion, which is why a signed authorization still helps.

Does a health care power of attorney replace a HIPAA authorization?

Once it's in effect, the agent is treated as the patient's personal representative, with the same access to health information. Some health care powers of attorney only take effect after a doctor finds the person can't make decisions, so a separate authorization covers the time before that. AARP suggests having both.

Does a HIPAA authorization expire?

It has to name an expiration date or an expiration event, and it stops being valid once that passes. Your parent can also revoke it at any time in writing, though that can't undo what the office already did in reliance on it.

Can I get my parent's medical records after they die?

Under HIPAA, the executor or administrator of the estate is treated as the personal representative for the records. Separately, providers may share relevant information with family who were involved in the person's care, unless that goes against wishes the person expressed. Medicare asks for court documents, such as letters testamentary, before 1-800-MEDICARE will release a deceased person's information.

Is there one HIPAA form that works everywhere?

A general authorization drafted by an attorney can work with any provider, but many offices still prefer their own form. Medicare uses its own form, and private insurers often have theirs. Plan on a small stack.

Doing the paperwork once

You can do all of this yourself with the checklist above, your parent's list of doctors, and a free afternoon for phone calls. If it helps to have it organized in one place, Emergency Binder Now turns about 25 minutes of guided questions into a printable binder for your parent, including pages that record whether each legal document exists, where it's kept, and who has a copy, plus a list of what's still missing. You can see a sample binder before deciding.

This article is general information, not legal or medical advice. HIPAA is federal law, but powers of attorney, surrogate decision-making and some privacy protections vary by state. For your parent's situation, check with an elder law attorney in their state.