Your mother is in the hospital after a fall, and you call the nurses' station from three states away. The nurse is kind but says she can't share details over the phone. Later, your mother's insurer won't discuss a denied claim with you either. You've heard the word HIPAA a dozen times this week.
A little paperwork, done while your parent is well, can make these calls much easier.
What HIPAA does
HIPAA is the federal law that protects the privacy of health information. Its Privacy Rule applies to most doctors, hospitals, pharmacies and health plans. The rule doesn't require a health care provider or health plan to share information with family or friends unless they are the patient's personal representatives1. That's why a well-meaning nurse may hesitate to tell you much.
But HIPAA is often misunderstood. It doesn't forbid sharing with family. It sets the conditions under which sharing is allowed, and many providers are more cautious than the law requires. Knowing the rules helps you ask for what you need politely and confidently.
When providers can talk to family
A provider or plan can share your parent's information with family or friends if they are involved in your parent's health care or payment for care, if your parent says it's okay, if your parent doesn't object, or if, using professional judgment, the provider believes your parent doesn't object1. For example, if your parent doesn't object, a doctor could talk with the family member who comes along to the hospital or the one who pays the medical bills1. A pharmacist can assume your parent doesn't object if you're sent to pick up a prescription1.
When your parent isn't there or is injured and can't give permission, a provider may share information with family if that seems to be in your parent's best interest1. In practice, the simplest step is for your parent to tell each doctor, in person or in writing, that it's fine to talk with you.
Personal representatives
A personal representative stands in your parent's shoes under HIPAA. Generally, a covered provider or plan must let the personal representative inspect and get a copy of the health information it keeps about the patient2. If a person can make health care decisions for your parent under a health care power of attorney, that person is the personal representative2. State law may affect how a personal representative is named2.
A key point: many health care powers of attorney only take effect when your parent can no longer make decisions. Until then, the agent may not have authority. A HIPAA authorization fills that gap. See health care proxy and power of attorney for an elderly parent.
After a death, the personal representative is the executor or administrator of the estate, or another person legally authorized to act for the deceased person or estate2. See what to do when a parent dies.
What a HIPAA authorization is
A HIPAA authorization is a signed document in which your parent gives permission for providers or plans to share health information with specific people. Federal rules list what a valid authorization must contain3. Among the core elements: a specific description of the information to be shared, who may disclose it, who may receive it, the purpose (a request by the patient is enough), an expiration date or event, and the patient's signature and date3.
The form must also tell your parent that they can revoke it in writing, explain whether treatment can be conditioned on signing, and note that shared information may no longer be protected once disclosed3. Many hospitals and insurers have their own forms, and some prefer them. Elder law attorneys often prepare a general HIPAA authorization alongside other planning documents; see elder law attorneys.
Why families sign one
A HIPAA authorization lets you talk with doctors, call the hospital, sort out insurance claims and get test results while your parent still makes their own decisions. It's especially helpful for long-distance caregivers, for children helping a parent manage multiple doctors, and for resolving billing and coverage questions with Medicare plans and insurers. See long-distance caregiving.
It also helps in the early stages of dementia, when your parent is still capable but may forget what the doctor said. With an authorization, you can call the office later to confirm instructions. See mild cognitive impairment.
What it doesn't do
A HIPAA authorization lets people receive information, but it doesn't give them the right to make medical decisions. That requires a health care power of attorney or proxy, or legal authority through guardianship. It also doesn't let anyone manage money or sign legal documents; that requires a financial power of attorney. Most families do all three. See guardianship of an elderly parent.
A provider may decline to treat a person as a personal representative if it reasonably believes that person might endanger the patient through abuse or neglect2.
How to set it up
Your parent should sign the authorization while they have capacity. Name each family member who should have access, and consider naming alternates. Decide how broad it should be: all health information, or limited to certain providers or types of records. Some people exclude especially sensitive information, such as mental health or substance use treatment, which may have extra protections.
Choose an expiration that makes sense. Some forms expire on a date, others at a specific event or never until revoked, as long as that's stated3. Give copies to each doctor, the hospital, the pharmacy, and every insurer, including the Medicare drug or Advantage plan. Ask each office to note it in your parent's file. Keep a copy on your phone.
Medicare's own form
Medicare has its own process. To let Medicare's customer service talk with you about your parent's claims and coverage, your parent can fill out Medicare's authorization form, or call 1-800-MEDICARE and give permission while you're on the line. Medicare Advantage and Part D plans usually require their own forms. See Medigap vs. Medicare Advantage for how plans differ.
Making provider calls go smoothly
Even with forms on file, calls go more smoothly if you're prepared. Have your parent's full name, date of birth and insurance information ready. Mention that a HIPAA authorization or power of attorney is on file and offer to send another copy. Ask for the best way to get updates, such as a patient portal proxy account. Many health systems let a family member set up proxy access to a parent's online portal, where you can see test results and send messages.
If a provider still refuses to talk with you, ask to speak with the privacy officer or patient advocate. Be patient with front-line staff, who are trained to be careful.
In the hospital
Hospitals are where HIPAA confusion often comes up. If your parent is awake and able, ask them to tell the nurse that you can be given information. Ask the nurse to note it in the chart. If your parent can't communicate, staff can use professional judgment to share what's in your parent's best interest1. Bring copies of the health care power of attorney and HIPAA authorization. Discharge planners and case managers will need to talk with you about next steps; see hospital discharge planning.
Revoking or updating
Your parent can revoke a HIPAA authorization in writing at any time, except to the extent a provider has already acted on it3. Update the authorization if family circumstances change, such as a divorce, a falling-out, or the death of a named person. Send the new version to every provider and plan that had the old one.
A quick checklist
To set up health information access for a parent: talk with your parent about who should have access; sign a HIPAA authorization naming those people; sign a health care power of attorney naming a decision-maker; complete Medicare and insurer forms; give copies to doctors, hospitals, pharmacies and plans; set up patient portal proxy access; and keep copies on hand and in a safe, accessible place.
In assisted living or a nursing home
When your parent moves into assisted living or a nursing home, the facility will usually ask who may receive health updates. Make sure the names on the facility's forms match your parent's HIPAA authorization and health care power of attorney. Ask to be included in care plan meetings, which your parent can approve in writing. Staff turnover means forms sometimes get lost, so check the file every year. See care plan meetings and nursing home resident rights.
If several siblings share caregiving, agree on who will be the main contact so the facility isn't fielding calls from everyone. That person can then update the rest of the family.
An example
After struggling to get updates during her mother's hospital stay, Grace asked her mother to sign HIPAA authorizations naming Grace and her brother. Her mother also signed a health care power of attorney. Grace gave copies to the primary care doctor, the cardiologist, the pharmacy and the Medicare Advantage plan, and set up proxy access to her mother's portal. The next time her mother had a test, Grace saw the results online and called the doctor with questions. This is an illustration; forms and policies vary.
