HIPAA Authorization for an Elderly Parent: Why Family Isn't Enough
Being next of kin doesn't entitle you to your parent's medical information. A short signed form changes that.
By naveen · Updated · How we research our guides
What to know
- A HIPAA authorization is a signed form in which your parent names people who may receive their medical information.
- The HIPAA Privacy Rule allows a provider to share information with family involved in a patient's care, but doesn't require it.
- The authorization covers information, not decisions; making medical decisions takes a health care proxy or medical power of attorney.
- It can help to sign it while your parent is able, alongside the power of attorney and advance directive.
- Retirement Checklist puts the HIPAA authorization in order with the other documents your family needs.
A HIPAA authorization for an elderly parent is a signed form in which your parent names the people their doctors, hospitals and insurers may share medical information with. Without one, the HIPAA Privacy Rule lets providers share some information with involved family, but doesn't make them.
Why won't the doctor's office talk to you?
Because the law lets them share, but doesn't require them to. The only disclosures the Privacy Rule requires a provider to make are to the patient (on request) and to HHS for compliance reviews (45 CFR 164.502(a)(2)).
Sharing with family is permitted, not required. A provider "may" disclose to "a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual," the information "directly relevant to such person's involvement with the individual's health care or payment related to the individual's health care" (45 CFR 164.510(b)). If your parent is present and capable, the provider can do that with their agreement, or if they don't object. If your parent isn't there or can't respond, the provider decides "in the exercise of professional judgment" whether sharing is in their best interests. A signed authorization replaces that judgment call with your parent's written instructions.
Who fills out a HIPAA authorization form?
Your parent signs it, because it's their information. You can help fill it in. The rule sets what a valid authorization must contain rather than prescribing one national form: a specific description of the information, who may disclose it, who may receive it, the purpose, "An expiration date or an expiration event," and the "Signature of the individual and date" (45 CFR 164.508(c)).
Because each practice, hospital system, insurer and pharmacy may have its own form, it can help to ask at the next routine appointment what they need and complete it while you're both there. Every valid authorization has an expiration date or event, so check that older ones are still live.
What does it let you do, and not do?
It grants access to information and nothing else. It confers no authority to make medical decisions, consent to treatment, or manage money. Your parent can narrow it to particular information or purposes, and "may revoke an authorization provided under this section at any time, provided that the revocation is in writing," except where the provider has already acted on it (45 CFR 164.508(b)(5)).
HIPAA authorization vs. healthcare proxy: what's the difference?
A HIPAA authorization grants access to information; a healthcare proxy grants authority to make medical decisions:
| HIPAA authorization | Healthcare proxy / medical POA | |
|---|---|---|
| What it grants | Access to medical information | Authority to make medical decisions |
| When it works | Once signed | When it takes effect under the document and state law |
| Example use | Chasing results, sorting bills, coordinating appointments | Treatment decisions during a serious illness |
| Federal rule | 45 CFR 164.508 | Once active, the agent is treated as your parent's personal representative (45 CFR 164.502(g)(2)) |
For decision-making authority, see advance healthcare directives; for money, a durable financial power of attorney.
What if your parent can no longer consent?
Then someone with legal authority has to act for them. Under HIPAA, a person who "has authority to act on behalf of an individual who is an adult" in health care decisions under state law must be treated as the patient's personal representative (45 CFR 164.502(g)(2)), and an authorization signed by a personal representative must include "a description of such representative's authority to act for the individual" (45 CFR 164.508(c)(1)(vi)). That person is the agent named in a healthcare proxy, if one was signed. If nothing was signed, providers can still share relevant information with involved family in your parent's best interests, but decision-making authority may have to come from a court through guardianship. That gap is the reason to sign these documents early.
Who should be named?
Whoever might need to call. The rule allows an authorization to name "person(s), or class of persons," so your parent can name more than one person (45 CFR 164.508(c)(1)(iii)). If two siblings share the load, naming both avoids one being turned away. Your parent sets the scope, narrow or broad, and can revoke it in writing at any time.
What if your parent refuses?
It's their information, so it's their call. It can help to ask for something specific rather than blanket access (so you can call about results while they're at work), and to explain that the form names exactly what may be shared and can be revoked in writing. Refusing the form isn't the same as objecting to your involvement: if your parent is present and doesn't object, a provider may still share information relevant to your part in their care (45 CFR 164.510(b)(2)).
What questions are worth asking?
- Which practices and systems does your parent use, and does each have a form on file?
- Does it cover everyone who might need it, or only whoever was at that appointment?
- When does it expire, and is that date or event still ahead?
- Are some records handled separately? Psychotherapy notes need their own authorization under 45 CFR 164.508(a)(2).
- Is there a patient portal, and does anyone else know it exists?
Frequently asked questions
Why won't the doctor's office talk to me about my parent?
Because HIPAA doesn't require them to. The Privacy Rule allows a provider to share relevant information with family involved in a patient's care when the patient agrees or doesn't object, or when sharing seems in their best interests, but leaves that to the provider. A signed HIPAA authorization replaces that judgment call with your parent's instructions.
Who fills out a HIPAA authorization form?
The patient, your parent, signs and dates it, because it's their information. You can help fill it in. The rule lists what every valid authorization must contain, including who may receive the information and an expiration date or event, but each practice, hospital system or insurer may have its own form.
Does a healthcare power of attorney already cover this?
Once the agent has authority to make health care decisions, HIPAA requires providers to treat them as your parent's personal representative. When that authority starts depends on the document and state law. A HIPAA authorization doesn't depend on incapacity, so it covers the ordinary moments of chasing a test result or sorting out a bill.
Can more than one person be named?
Yes. The rule allows an authorization to name one or more people, or a class of people, who may receive the information. Naming each sibling who might need to call can save repeating the exercise later. Your parent sets the scope: they can authorize broadly or limit it to particular information or purposes.
What if my parent refuses to sign one?
Then that's their decision: it's their information. It can help to explain the specific situation it's for, such as calling about test results while they're at work, rather than asking for blanket access, and to make clear the form can be limited and revoked in writing at any time.
Can my parent change their mind?
Yes. Your parent can revoke an authorization at any time, in writing, except to the extent the provider has already acted on it. It only grants access to information. It doesn't hand anyone decision-making authority, so revoking it changes who hears about your parent's care, not who decides it.
Getting started
Every family's order is different. The plan this site builds asks four questions, including which state your parents live in, and puts the handful of steps that matter most for your family in order. It's free and takes about 90 seconds.
Related guides
Sources
- 45 CFR 164.510, Uses and disclosures requiring an opportunity for the individual to agree or to object: When providers may share information with family and friends involved in care.
- 45 CFR 164.508, Uses and disclosures for which an authorization is required: What a valid authorization must contain, expiration, and revocation in writing.
- 45 CFR 164.502, Uses and disclosures of protected health information: General rules: Required disclosures and personal representatives.
More on what this tool does and doesn't do, or browse everything we've written.