HIPAA authorization — getting legal access to their medical information

This article is for educational purposes only and does not constitute medical, legal, or financial advice. Every family situation is different, and you should consult with appropriate professionals about your specific circumstances.

You called your parent's doctor with a simple question: how did the lab results come back? The nurse put you on hold. When she came back, she told you she couldn't discuss your parent's medical information with you. Your parent is right there in the room, and you're their adult child helping them manage their care, but the doctor won't tell you anything without your parent's specific written authorization.

This happens to people constantly. You're sitting in the waiting room with your aging parent, you've driven them to the appointment, you help them with their medications and remember what the doctors said last time—and the moment you step into a private conversation about their medical information, you hit a wall. This wall is HIPAA, the federal health privacy law.

HIPAA itself is important and good. It prevents insurance companies from selling your health information. It prevents a nosy neighbor from calling your doctor to find out what's wrong with you. But like many privacy laws, HIPAA can create real problems when it prevents your parent's actual care team from communicating. If you're going to help your parent manage their health, you need legal permission to access their medical information. That permission comes through a HIPAA authorization, sometimes called a HIPAA release or a medical records authorization.

This is not actually something most families think about until they need it. By then, it's usually too late to ask your parent to sign it, because they're confused or they're in the hospital or something has changed. Getting a HIPAA authorization signed early is one of those small things that prevents a much bigger problem later.

Why This Document Matters

HIPAA is a law that protects health information. It says that healthcare providers, hospitals, pharmacies, and insurers cannot share your information with others without your permission. Not with family members, not with your employer, not with the government, not with anyone. There are a few exceptions for direct treatment, but generally, sharing requires permission.

The permission is specific. You can authorize your doctor to share information with your daughter but not with your son. You can authorize information sharing for purposes of treatment but not for research. You can grant access to your primary care doctor's office but not to the orthopedic surgeon. The specificity matters.

Here's what happens without a HIPAA authorization. Your parent is in the hospital. You need to know what medication they're on because you're the one giving it to them at home. You call the hospital. The hospital says they can't tell you. Your parent says okay, they authorize it. But the authorization needs to be in writing. It needs to be in their medical records or on file. Getting it in writing while your parent is acutely ill and possibly confused is much harder than having it already done.

More complicated scenarios happen. Your parent loses capacity. They have dementia. They can't answer questions about their medical history. You're in a doctor's appointment and their new doctor asks if your parent has ever had a certain surgery. You have no idea because you've never been allowed to see their full medical records. This information would matter for their treatment, and you don't have access to it.

Or your parent is hospitalized and their condition changes. You're making decisions about what to do next. The doctor wants to discuss the prognosis with you. Without a HIPAA authorization, the doctor can discuss the information with your parent, but not with you, even if your parent is asking you to be involved in that discussion.

These situations are not hypothetical. They happen regularly, and they create stress at exactly the moment when you need clear information to make good decisions.

A HIPAA authorization prevents this. If your parent signs a HIPAA authorization while they have capacity, while they can read it and understand it and sign their name, you can access their medical information anytime you need to. If they lose capacity later, that authorization continues to apply. Their doctors can discuss their health with you. You can call and ask about lab results. You can get copies of their medical records. You can authorize medical decisions on their behalf.

The authorization also matters because it's broader and more straightforward than other documents. A power of attorney might give you some medical authority. An advance directive might address some medical decisions. But a HIPAA authorization specifically addresses the problem of accessing information. These documents work together, but they're not the same thing.

What It Does

A HIPAA authorization gives you specific rights to access your parent's health information and to communicate with their healthcare providers on their behalf. It authorizes you to receive medical information. It authorizes you to discuss your parent's medical situation with their doctors. It authorizes you to receive lab results, imaging reports, medication lists, and hospital records.

The authorization can be broad or narrow. A broad authorization says the healthcare provider can share all health information for any purpose. A narrow authorization might say you can only access information related to a specific condition, or only for purposes of treatment, or only from specific providers. Your parent gets to decide how broad or narrow to make it.

The authorization lasts for a specific period of time. Many authorizations last as long as your parent is alive and then expire. Some expire after a certain number of years. Some expire after a specific event, like your parent being discharged from the hospital. When your parent signs the authorization, they decide how long it lasts.

The authorization also specifies who has access. Usually you're authorizing one person or a small number of people to receive this information. Your parent might authorize their primary adult child but not anyone else. They might authorize both adult children. They might authorize their spouse and their adult child. That's their choice.

The authorization is different from a power of attorney, which gives you authority to make decisions on your parent's behalf. An authorization just gives you the right to know what's happening. It gives you information access. With a HIPAA authorization and no power of attorney, you can see your parent's medical records and talk to their doctors, but you cannot make medical decisions for them.

The authorization is different from an advance directive, which tells doctors what your parent wants to happen in specific situations. An advance directive might say "if I'm in a persistent vegetative state, I don't want life support." A HIPAA authorization doesn't address what you want to happen. It just addresses who gets to know about your parent's medical situation.

These documents complement each other. Together, they give you the information you need and the authority you need to help your parent manage their health. Separately, they're less useful.

Getting It Done

Your parent needs to execute the HIPAA authorization while they have the legal and mental capacity to do so. This means they need to be able to understand what they're signing. They need to understand that they're giving you access to their medical information. They need to be able to answer basic questions about what they want. If your parent is already confused or declining cognitively, you need to move on this sooner rather than later.

The HIPAA authorization should be prepared by an attorney or, in some cases, by your parent's healthcare provider. Many healthcare systems have their own HIPAA authorization forms. If you get a form from your parent's doctor's office, that's probably fine. If you're trying to create one yourself or use something you found online, you should have an attorney look it over. HIPAA authorizations are not that complicated, but they need to be properly executed to be valid.

The execution means your parent needs to sign it, probably date it, and probably have it witnessed or notarized. The exact requirements vary depending on your state and your parent's healthcare providers. Some providers will accept a simple signature. Some require a notary. Check with the specific healthcare provider about what they need.

Once it's signed, you need to deliver it to your parent's healthcare providers. Don't assume that one signed document is enough. Different providers have different systems. Your parent's primary care doctor might accept your HIPAA authorization, but the hospital where they might be admitted won't have it in their system. The specialist they might see in six months won't have it. You'll need to send copies to all the relevant providers or have your parent send them during appointments.

Keep a copy for yourself. Keep several copies. Some places will keep the original and not return it. Some will make a copy and return the original. Either way, you should have your own copy in your records.

Using It Properly

Once you have a HIPAA authorization, you can call your parent's doctor's office and talk about their health. You can request medical records. You can ask about lab results. You can discuss medication changes. But the authorization gives you the right to know. It doesn't give you the right to make decisions unless you also have power of attorney or are their legal guardian.

There's also a practical element to using the authorization. When you call a doctor's office, be clear about who you are and what authorization you have. Say something like, "I'm calling about my mother's care. I have her HIPAA authorization on file. I'm calling to ask about her recent lab results." Most office staff will know what that means.

Keep records of medical information you receive and conversations you have with doctors. If your parent's condition is changing or if you're making decisions about their care, having notes about what you discussed and when you discussed it matters. This is especially important if there's any family disagreement about your parent's care, because you'll want a record of what you were told.

Understand that the HIPAA authorization gives you the right to access information, but it doesn't require providers to do everything you ask. If you request records, they have a deadline to provide them (usually thirty days). If you ask to discuss your parent's care, the provider has to talk with you if your parent authorizes it. But the provider has the right to refuse certain requests if they have valid reasons.

Your parent can revoke the authorization at any time. If they want to take away your access to their medical information, they can sign a revocation. Make sure providers are notified of any revocation. Similarly, you could be removed from the authorization if your parent changes their mind about who should have access.

The HIPAA authorization is one piece of a larger picture. You probably also need a power of attorney for healthcare. You might need a living will or advance directive. These work together to make sure you have the information you need and the authority you need to help your parent as they age. Getting them all in place while your parent can still sign them yourself is so much easier than trying to handle everything through the court system later.

How To Help Your Elders is an educational resource. We do not provide medical, legal, or financial advice. The information in this article is general in nature and may not apply to your specific situation. If you are concerned about a loved one's cognitive health or safety, consult with their healthcare provider or contact your local Area Agency on Aging for guidance and support.