HIPAA Authorization for Elderly Parents
You call your parent's doctor to ask about their medication, and the office says, "We can't discuss that with you." Your parent is sitting right there and wants you to know—but the doctor's hands are tied.
This is HIPAA in action. Here's how to get proper authorization so you can be involved in your parent's healthcare.
What is HIPAA?
HIPAA (Health Insurance Portability and Accountability Act) protects the privacy of health information. Healthcare providers can't share your parent's medical information with anyone—including family members—without authorization.
This protection is important. But it can also be a barrier when you're trying to help care for your parent.
HIPAA doesn't prevent your parent from sharing their own information with you. They just need to tell their providers it's okay—and put it in writing to avoid hassles.
What You Need: HIPAA Authorization Form
A HIPAA Authorization Form is a document where your parent gives written permission for healthcare providers to share their medical information with you.
What the Form Should Include
- Your parent's name and date of birth
- Your name (and anyone else who should have access)
- What information can be shared (can be "all medical information")
- Which providers/entities are covered
- Purpose (typically "to assist with healthcare decisions")
- Expiration date or statement that it doesn't expire
- Your parent's signature and date
How to Get HIPAA Authorization
-
Ask each provider for their form
Most doctors' offices, hospitals, and pharmacies have their own HIPAA authorization forms. Ask for one at each provider your parent sees. -
Fill out the forms together with your parent
Your parent needs to complete and sign each form. If they have trouble writing, they can sign with an "X" if witnessed. -
Keep copies
Make copies of all signed forms. Give one to the provider, keep one for yourself, and keep an original somewhere safe. -
Bring the form to appointments
Until it's on file, bring your copy to appointments. Some offices lose paperwork or claim they don't have it.
Get HIPAA authorization from every provider at once. This includes primary care, specialists, hospitals, pharmacies, labs, and any facility your parent might visit. Do it now, not during an emergency.
HIPAA vs. Healthcare Power of Attorney
These are different documents with different purposes:
HIPAA Authorization
- Allows you to receive information about your parent's health
- Your parent still makes their own decisions
- Takes effect immediately
- You can talk to doctors, get records, understand what's happening
Healthcare Power of Attorney (Healthcare Proxy)
- Allows you to make decisions for your parent
- Only takes effect if your parent can't make decisions themselves
- Gives you authority to consent to/refuse treatment
- Automatically includes the right to access medical information
Bottom line: You need both. HIPAA authorization lets you be informed now. Healthcare POA lets you make decisions if your parent becomes incapacitated.
What If Your Parent Has Dementia?
If your parent has dementia but can still understand the basics of what they're signing, they can still sign a HIPAA authorization. The question is whether they understand:
- That they're giving permission to share their health information
- Who will receive the information (you)
- That they can revoke permission at any time
If they have Healthcare POA that names you as agent, and it's been activated (a doctor has declared them incapacitated), you likely already have the right to access their medical information.
If your parent can no longer understand what they're signing and there's no Healthcare POA in place, you may need to pursue guardianship through the courts to gain access to their medical information. This is expensive and time-consuming—which is why getting these documents done early is so important.
What Doctors Can Share Without Authorization
HIPAA does allow some information sharing without written authorization:
- If your parent is present and agrees verbally — The doctor can discuss care with you if your parent says it's okay
- If your parent is incapacitated — Doctors can share information with family if they believe it's in the patient's best interest
- Emergency situations — Providers can share information needed for treatment
However, having written authorization eliminates any ambiguity and prevents delays in getting information.
When Providers Won't Share Information
If you have proper authorization and a provider still won't share information:
- Ask to speak to their HIPAA privacy officer or compliance officer
- Show them your authorization form
- If you have Healthcare POA, show that as well
- Ask them to document in writing why they're refusing
- Contact the HHS Office for Civil Rights if they're violating HIPAA rules
Get All the Documents You Need
Our Estate Planning Workbook includes templates for HIPAA authorization and all essential care documents.
Get the WorkbookHIPAA Authorization Checklist
- ☐ Primary care physician
- ☐ All specialists (cardiologist, neurologist, etc.)
- ☐ Local hospital(s)
- ☐ Pharmacy
- ☐ Lab/imaging centers
- ☐ Urgent care/ER
- ☐ Home health agency (if applicable)
- ☐ Nursing home or assisted living (if applicable)
- ☐ Mental health providers
- ☐ Health insurance company