HIPAA and Family Caregivers: Access to a Parent's Medical Information

The federal HIPAA Privacy Rule lets a doctor talk with a family caregiver about a parent's care in many situations, even though "we can't, because of HIPAA" is often the first answer. Under HIPAA, a family caregiver's access to a parent's medical information runs through four legal routes, and which one fits depends on whether your parent can agree today, can no longer agree, or has already died. Once you know which route you're on, you'll know what to ask for and what to put in writing.

In This Guide

• Key Takeaways
• What HIPAA Lets a Doctor Tell a Family Caregiver About a Parent's Medical Information
• When Your Parent Can't Agree
• Personal Representatives: When You Stand in Your Parent's Shoes
• Getting Access to Your Parent's Medical Records Through the Right of Access
• HIPAA Authorization Forms for a Family Member
• Medicare Has Its Own Permission Step
• The Four Routes Side by Side
• What to Say When the Office Says "HIPAA"
• Frequently Asked Questions
• Learn More

What HIPAA Lets a Doctor Tell a Family Caregiver About a Parent's Medical Information

The HIPAA Privacy Rule is the federal regulation that governs how doctors, hospitals, pharmacies, and health plans handle health information. The HIPAA Privacy Rule has a provision written for exactly the situation family caregivers are in. Under 45 CFR 164.510(b), a HIPAA-covered provider or health plan may share with a family member, another relative, a close friend, or anyone else your parent identifies the health information that is directly relevant to that person's involvement in your parent's care or in paying for it.1

When your parent is present, or available beforehand, and has the capacity to make health care decisions, the HIPAA Privacy Rule gives the provider three ways to clear that sharing. The provider can get your parent's agreement, give your parent a chance to object and hear no objection, or reasonably infer from the circumstances, using professional judgment, that your parent doesn't object.1

Here's the part that surprises people in the other direction. The HIPAA Privacy Rule permits this sharing, but it doesn't require it. The HHS Office for Civil Rights says plainly that the rule does not require a health care provider or health plan to share information with family or friends unless they are the patient's personal representatives. So an office that declines to talk to you may be within the rule, even when your parent would have said yes. That's why the routes later in this guide, the ones that create a legal right rather than a permission, are worth setting up before a crisis.1

When Your Parent Can't Agree

Many adult children first run into HIPAA after a fall, a stroke, or a hospital admission, when their parent can't speak for themselves. The HIPAA Privacy Rule covers this. If your parent isn't present, or can't practicably agree or object because of incapacity or an emergency, the provider may use professional judgment to decide whether sharing is in your parent's best interests. If the provider decides sharing is in your parent's best interests, the HIPAA Privacy Rule lets the provider share only the information directly relevant to your involvement in your parent's care or payment for care.1

The same federal provision lets a provider use professional judgment to allow someone to act on a patient's behalf in picking up filled prescriptions, medical supplies, X-rays, and similar items.1

Two limits are worth knowing so you're not caught off guard. First, "directly relevant to your involvement" is narrower than your parent's whole chart, so ask for the specific things your caregiving role needs. Second, sharing under the involvement-in-care provision is still the provider's judgment call. If you need something broader, or you need an answer the provider is required to give, you'll want one of the routes below. Our guide to hospital discharge planning covers what to expect when a parent leaves the hospital.

After a parent dies, the HIPAA Privacy Rule lets a provider share with a family member who was involved in the parent's care or payment for care the information relevant to that involvement, unless doing so would go against a preference the parent expressed earlier that the provider knows about.1

Personal Representatives: When You Stand in Your Parent's Shoes

A personal representative is the HIPAA route that turns "may share" into a right. Under 45 CFR 164.502(g)(2), a HIPAA-covered entity must treat a person who has authority under applicable law to make health care decisions for an adult as that adult's personal representative, for the health information relevant to that authority. HHS Office for Civil Rights guidance says the HIPAA Privacy Rule generally also gives a personal representative the patient's own right to access their health records.2

Where does that authority come from? State law. HHS's guidance for individuals says a personal representative can be named several ways and that state law may affect the process, and it gives the most common example: if a person can make health care decisions for the patient using a health care power of attorney, that person is the patient's personal representative. Whether a particular family member qualifies as a HIPAA personal representative generally depends on whether that person has authority under state law to act for the patient. Our guides to advance directives and health care power of attorney and to guardianship vs. power of attorney explain how those documents and court orders work.2

Two practical points follow. If your parent can still make decisions and hasn't named a health care agent, helping them do so now gives you a route that doesn't depend on a provider's discretion. And when you use this route, bring a copy of the document that gives you health care decision-making authority, so the office can see that your authority covers health care decisions.

After a parent's death, the HIPAA personal representative is different. HHS OCR guidance says the HIPAA personal representative of a person who has died is an executor, administrator, or other person with authority under state or other law to act on behalf of the deceased person or the estate.2

There is one narrow exception. Under 45 CFR 164.502(g)(5), a provider may decline to treat someone as a personal representative only if it reasonably believes the patient has been or may be subjected to domestic violence, abuse, or neglect by that person, or that treating the person as representative could endanger the patient, and it also decides, using professional judgment, that treating the person as representative is not in the patient's best interest. Both conditions have to be met.2

Getting Access to Your Parent's Medical Records Through the Right of Access

Your parent has their own HIPAA right to their records, and it's often the fastest path when your parent is able to sign a request. Under 45 CFR 164.524, a person has a right to inspect and get a copy of their health information in a provider's or health plan's designated record set, with exceptions that include psychotherapy notes and information compiled for a legal proceeding.3

The timing is set by federal regulation. A HIPAA-covered entity may require the request in writing if it tells people so, and it must act on a right-of-access request no later than 30 days after receiving it. The covered entity can take one extension of no more than 30 more days, and only if, within the first 30 days, it gives the person a written statement of the reasons for the delay and the date it will finish.3

Your parent can also send the copy to you. Under 45 CFR 164.524(c)(3)(ii), if a patient's request directs the provider to send a copy straight to another person, the request must be in writing, signed by the patient, and clearly identify the person and where to send the copy. HHS OCR says a parent can direct a copy of their records to a family member this way even when that family member doesn't have the authority to be a personal representative.3

One court ruling narrows the HIPAA third-party copy route. HHS says that on January 23, 2020, a federal court in Ciox Health, LLC v. Azar vacated the HIPAA third-party directive insofar as it goes beyond requests for a copy of an electronic health record with the patient's information in an electronic format. So a provider's obligation to send records straight to you on your parent's signed direction now reaches requests for an electronic copy of an electronic health record. For paper records, your parent can request their own copy and share it with you, or sign an authorization, covered next. HHS also says the right-of-access fee limit applies to a person's request for their own records, not to a request to send records to a third party.3

HIPAA Authorization Forms for a Family Member

A HIPAA authorization is the most flexible route, because your parent decides exactly what you can receive. HHS OCR guidance says a HIPAA-covered entity is permitted to disclose a person's health information to anyone, including a family member, if the person provides a prior written authorization.4

Whatever form the office uses, 45 CFR 164.508 says a valid HIPAA authorization must contain at least these core elements:

• A description of the information to be disclosed, specific enough to identify it.
• Who is authorized to make the disclosure, such as the provider or the hospital.
• Who may receive it, which is where your name goes.
• The purpose. "At the request of the individual" is enough when your parent starts the authorization and chooses not to state a reason.
• An expiration date or an expiration event.
• Your parent's signature and the date. If a personal representative signs instead, the form must describe that person's authority to act for the parent.4

A HIPAA authorization must also tell your parent about the right to revoke the authorization in writing. Under 45 CFR 164.508, your parent can revoke a HIPAA authorization at any time in writing, except to the extent the provider has already acted on it. With limited exceptions, a provider may not make treatment, payment, health plan enrollment, or benefit eligibility depend on your parent signing an authorization.4

Consider asking your parent to sign a HIPAA authorization at each practice that matters most (the primary care doctor, the main specialist, the hospital system) while things are calm, and keep copies. If you live far away, our guide to long-distance caregiving has more on caring for a parent from a distance.

Medicare Has Its Own Permission Step

Calling Medicare about your parent's coverage involves a separate permission step. Medicare's fact sheet for people helping a friend or family member says Medicare can give a helper personal health information only if the person with Medicare gives verbal permission while the helper is on the phone with Medicare, or has added the helper as an authorized representative. According to that fact sheet, the "Authorization to Disclose Personal Health Information" form can be submitted online in the person's Medicare.gov account, after which the helper can call right away; a mailed paper form generally means waiting a few weeks.5

The same Medicare fact sheet says a doctor must get the patient's permission to talk with the helper about their care, and suggests asking the doctor's office how the patient can give it. Our guide to helping a parent with Medicare walks through the Medicare form and account steps.5

The Four Routes Side by Side

Here's how the four federal HIPAA Privacy Rule routes compare on what each takes and what each gets you.1,2,3,4

What to Say When the Office Says "HIPAA"

These scripts are starting points. Keep your tone calm; the person at the desk is usually following a policy, not trying to shut you out.

If your parent is with you or on the phone. "My mother is right here and she's fine with you talking to me. Mom, can you tell them that's okay?" Under the HIPAA Privacy Rule's involvement-in-care provision, a patient's agreement is enough for the provider to share information relevant to your role.1

If your parent can't speak for themselves. "I'm his daughter and I'm coordinating his care after discharge. HIPAA lets you use professional judgment to share what I need for that. Can you tell me his new medications and when his follow-up is?" Ask for the specific things you need, since the provider may share only what's directly relevant.1

If you're the health care agent. "I'm her agent under her health care power of attorney, which makes me her personal representative under HIPAA. Here's a copy. Can you add it to her file?"2

If you want records, not a conversation. "My father would like to request a copy of his records and have an electronic copy sent to me. What's your written request form?" Then note the date you submitted it: the provider has 30 days to act, with one possible 30-day extension.3

If you want an ongoing arrangement. "Can my mother sign your HIPAA authorization naming me, so you can talk to me going forward?"4

Learn More

Find personalized help getting the medical information you need to care for your parent at brevy.com.

The information on Brevy.com is for educational purposes only and is not a substitute for professional legal, financial, or medical advice. Rules vary by state and program and change frequently. Always verify with the relevant agency or a qualified professional. Brevy is not a law firm, financial advisor, or healthcare provider.