HIPAA Release for an Elderly Parent: How to Access Their Medical Records

Your parent is in the hospital. You call the nurse's station to ask about their condition. The response: "I'm sorry, we can't discuss that with you."

HIPAA — the Health Insurance Portability and Accountability Act — generally limits healthcare providers from sharing your parent's medical information without a permitted basis or authorization. Being family alone does not guarantee access, although providers may communicate with family in circumstances allowed by privacy rules.

The Three Ways to Get Medical Records Access

1. Standalone HIPAA Authorization Form

The simplest approach while your parent still has capacity: have them sign a HIPAA authorization form naming you as an authorized recipient of their medical information.

This is a separate document from a power of attorney or advance directive. It specifically authorizes healthcare providers to share protected health information with the named individuals — and your parent controls exactly how broad or narrow the access is.

Most hospitals and medical practices have their own HIPAA release forms. Ask each provider what it accepts, and make sure the authorization identifies the patient, the authorized recipient, the information covered, and an expiration date or event.

2. Healthcare Advance Directive (RSA 137-J)

New Hampshire's statutory advance directive incorporates a HIPAA release that allows the designated healthcare agent to access medical records and communicate with providers. But there's a critical limitation: this access activates only after the attending physician, physician assistant, or APRN certifies in writing that your parent lacks decision-making capacity.

Before that clinical certification, the healthcare agent has no HIPAA access through the advance directive. If your parent is hospitalized but still considered competent, the built-in HIPAA release hasn't triggered.

This is why a standalone HIPAA authorization is valuable even if your parent has an advance directive — it provides access before the capacity trigger occurs.

3. Guardianship Order

If your parent has already lost capacity and didn't execute any prior authorizations, a court-ordered guardianship under RSA 464-A may be needed for broader authority over the ward's person. The guardian should confirm with each provider what documentation it requires for medical-information access.

But this is the most expensive and time-consuming path to medical records access — a problem that a timely standalone HIPAA authorization may have helped avoid.

What the HIPAA Release Should Cover

A comprehensive HIPAA authorization for an aging parent should include:

• Named recipients: You, and ideally one or two backup contacts (siblings, spouse)
• Scope of information: "All medical records, including but not limited to diagnosis, treatment plans, medication lists, lab results, and imaging reports"
• Named providers: Specific doctors, hospitals, and pharmacies — or a general authorization covering any provider
• Duration: Consider making it open-ended rather than expiring after a set period, since the need for medical information access typically increases over time
• Right to revoke: Your parent retains the right to revoke the authorization at any time while competent

The Emergency Room Problem

The scenario families dread: your parent arrives at the emergency room unconscious or confused. No HIPAA form is on file, and no advance directive is available. Providers may have limited ability to share details or include you in decisions, while emergency treatment can proceed under the applicable emergency exception.

In genuine medical emergencies, hospitals generally provide treatment under the emergency exception — they don't need your consent to stabilize a patient. But access to details and participation in treatment decisions may remain limited without proper authorization.

New Hampshire hospitals will typically work with families to establish access through the patient once the patient regains capacity. But if the patient doesn't regain capacity, you're facing the guardianship pathway.

Taking Action Before the Crisis

The HIPAA authorization is arguably the most overlooked document in elder care planning. Execution requirements depend on the provider's form, so ask the medical practice what it accepts and whether notarization or witnesses are required.

Pair it with a healthcare advance directive for the capacity-trigger coverage, and add a financial POA for the money side — and you have the complete authorization framework.

The New Hampshire Power of Attorney & Guardianship Kit includes HIPAA authorization guidance alongside the healthcare directive and financial POA, ensuring no access gap exists when a medical crisis hits.

See more New Hampshire guides →