HIPAA, Medical Records, and Family Caregivers: A Practical Access Guide

Scope: This guide explains common U.S. health-information access tools for older adults and family caregivers. It is educational, not legal or medical advice. HIPAA is a federal privacy baseline; state law, the type of record, the organization holding it, and the authority written into a legal document can change the answer. The older adult's choices, privacy, and decision-making rights should remain at the center of the plan.

A daughter can sit beside her father during an appointment and still be unable to see his lab results later. A spouse may know every medication but have no separate portal login. A health care power of attorney may be stored in a desk drawer, yet no one knows whether it is active or what records it covers. Families often call all of these problems “HIPAA,” but they are different access problems with different solutions.

The goal is not to give one helper unlimited access. It is to choose the smallest, clearest form of access that lets the older adult receive practical help while preserving control.

Start by naming the task

Before asking a medical office for a form, write down what the helper actually needs to do. Most requests fit one or more of these tasks:

• Join an appointment and hear the care plan.
• Schedule visits, receive reminders, or ask routine questions.
• Use a patient portal to see results, instructions, or messages.
• Obtain copies of medical or billing records.
• Discuss claims or coverage with a health plan.
• Make health care decisions if the older adult cannot make them.

One form may not solve every task. A clinic's permission-to-discuss form may not create portal access. Portal proxy access may not let someone make treatment decisions. A broad legal document may still need to be reviewed by each organization before it recognizes the named person.

Four access lanes families should keep separate

1. Conversation permission during care

The HHS Office for Civil Rights explains that HIPAA can permit a provider or health plan to share relevant information with a family member, friend, or other person involved in care or payment when the patient agrees, does not object, or the professional reasonably infers no objection. If the patient is absent or incapacitated, a provider may share relevant information when professional judgment says it is in the patient's best interest.

This is useful for an appointment, a prescription pickup, or a hospital update. It does not automatically give the helper a full chart, a lasting portal account, or authority to make decisions. The provider is generally permitted—not always required—to share, and the information should relate to the person's involvement.

A practical step is for the older adult to introduce the helper and say what may be discussed: “I want my son included in today's discharge instructions and medication plan.” Ask the office to document the preference, but do not assume that one conversation follows the patient to every clinic.

2. A written HIPAA authorization

A HIPAA authorization can direct an organization to disclose specified information to a named person. HHS lists core elements such as a meaningful description of the information, who may disclose it, the recipient, the purpose, an expiration date or event, and the patient's or personal representative's signature and date. Organizations often provide their own forms, although federal rules do not require one universal format.

An authorization is a sharing instruction. It is not the same as appointing someone to make health care decisions. Families should read the scope before signing. “All records forever” may be more access than the task requires. A narrower authorization might cover discharge instructions, medication lists, appointment information, and billing records for a defined period.

3. Patient-portal proxy or delegate access

Many portals let a patient invite a caregiver as a proxy or delegate. The federal Patient Engagement Playbook encourages separate caregiver portal access and recognizes that systems may offer different access levels. This is safer and clearer than sharing the patient's username, password, or verification codes.

Ask the portal help desk or medical-records office:

• Does the portal offer adult proxy or caregiver access?
• What can the proxy see, download, request, or message?
• Can the patient limit access or revoke it online?
• Does access change if decision-making capacity changes?
• Will the proxy use a separate login and multifactor authentication?

Separate credentials create a clearer record of who did what. They also let the older adult change access without changing a personal password. Never ask the older adult to disclose a password in a family spreadsheet, text thread, or shared note.

4. Personal-representative authority

Under HIPAA, a personal representative generally stands in the individual's place for matters within the representative's legal authority. HHS notes that this status depends on applicable law and may arise through health care decision-making authority, guardianship, or another legally recognized role. The scope matters: limited authority may support access only to information relevant to that authority.

A health care power of attorney is therefore not a magic phrase. State rules and the document's terms may determine when it becomes effective, what decisions it covers, and what proof is required. The HHS personal-representative guide also describes an exception when a provider reasonably believes treating someone as the representative could endanger the patient in circumstances involving abuse, neglect, or domestic violence.

Keep a readable copy of the relevant document and identification, and ask the provider or plan where it should be reviewed. For help understanding whether a document is valid or active, use a qualified attorney in the older adult's state. Families comparing planning documents can also read Advance Directives vs. POLST/MOLST.

A setup checklist before a crisis

1. Ask the older adult what help is wanted. Discuss which people may hear appointment information, use portals, receive copies, or step into a formal decision role. Record any topics the person wants kept private.
2. Make an organization list. Include primary care, specialists, hospital systems, pharmacy, home health, health plan, and any separate behavioral-health or substance-use provider. Each may have its own process.
3. Choose the access lane for each task. Use appointment permission for a conversation, proxy access for recurring portal work, an authorization for defined disclosures, and legal-representative documents only for the authority they actually grant.
4. Call the right office. Ask for Health Information Management, Medical Records, the Privacy Office, portal support, or member services. Request the current form and submission instructions from an official number.
5. Complete forms carefully. Check names, date of birth, record types, date range, recipient, purpose, expiration, signature, and date. Keep a copy of what was submitted.
6. Build an access tracker. Record the organization, access type, helper, submission date, expiration, confirmation number, and review date. Do not put diagnoses, passwords, or complete medical records in the tracker.
7. Test access while the older adult can participate. Sign in with the proxy's own account, locate the medication list and after-visit instructions, and confirm where revocation or support requests go.

Add the tracker—not account passwords—to a family emergency binder. Review it after a move, a new health system, a change in the helper's role, or a major care transition.

How to request copies of records

With limited exceptions, HIPAA gives an individual the right to inspect or receive medical and billing information in a designated record set. A recognized personal representative can exercise access rights within the scope of that role. HHS says a covered organization generally must act on an access request within 30 calendar days. If it cannot, it may take one additional 30-day extension after giving written notice during the first period with the reason and expected completion date.

Start by asking for the records that solve the problem rather than requesting everything by default. Examples include a current medication list, discharge summary, imaging report, recent specialist notes, laboratory results, itemized bill, or claims record. Ask whether the records can be provided through the portal or in another electronic format the organization can readily produce.

The HHS medical-records guide says a provider may charge reasonable copying and mailing costs but cannot charge a search or retrieval fee under the HIPAA access right, and cannot withhold a copy because the patient has not paid for care. Fee rules can be more complicated when records are sent directly to a third party, so ask for an estimate and written explanation before agreeing to a large charge.

If information is inaccurate or incomplete, the patient may request an amendment. A provider may disagree, but the patient can ask to have a statement of disagreement added. Keep the original, the amendment request, and the response together.

An illustrative family example

Example: Rosa wants her son, Mateo, to help for three months after a hospital stay. During rounds, Rosa tells the team that Mateo may hear the discharge and medication discussion. That helps with the immediate conversation, but it does not create recurring access.

Before discharge, Rosa asks the hospital for an authorization covering the discharge summary, medication list, therapy instructions, and billing questions for 90 days. She also invites Mateo through the portal's adult-proxy feature, where he uses his own login. They store the hospital's confirmation and expiration date in an access tracker. Rosa keeps her own account credentials private.

Rosa's health care power of attorney names Mateo, but they do not assume it is currently active or needed for routine help. They ask a local attorney how the document operates under state law and give the hospital a copy only for review. Their practical records support the hospital discharge checklist and a current medication-management plan without transferring more control than Rosa wants.

Privacy and safety cautions

• Use separate logins. Turn on multifactor authentication and keep recovery codes in a secure place controlled by the account owner.
• Collect less. Download only what is needed. A complete chart creates a larger privacy risk than a targeted discharge summary.
• Protect paper and files. Lock paper records, encrypt devices, avoid public computers, and do not leave health information in an unlocked car or an ordinary family group chat.
• Review before forwarding. Records can contain another person's information, sensitive diagnoses, addresses, and insurance identifiers.
• Revoke stale access. Remove a proxy or let an authorization expire when the helper's job ends. Keep a note of the request and confirmation.
• Verify unexpected contacts. Do not send identity documents or medical records in response to an unsolicited call, text, or email. Contact the organization using its official website, card, or statement.

Some records need extra care. HIPAA treats separately maintained psychotherapy notes differently from the ordinary medical record. Federally assisted substance-use-disorder programs may also be subject to 42 CFR Part 2 confidentiality rules; HHS says compliance with the 2024 Part 2 final rule was required by February 16, 2026. State law can add protections. Ask the specific program or a qualified professional which rule applies instead of assuming one release covers every record.

When an office says, “HIPAA will not allow it”

Do not argue at the reception desk. First, identify the request: a care conversation, portal proxy, authorization, copy of records, or personal-representative access. Then ask which form, policy, or missing proof applies.

1. Write down the date, office, person contacted, and exact request.
2. Ask for the Medical Records or Privacy Office.
3. Ask whether the problem is identity verification, form language, expired permission, legal authority, record type, or another rule.
4. If a records request is denied or delayed, ask for the reason and next steps in writing.
5. Use the organization's complaint process if the issue is not resolved.

If someone believes a HIPAA-covered organization or business associate violated health-information privacy or access rights, the HHS Office for Civil Rights explains how to file a written complaint. HHS generally requires filing within 180 days of when the person knew about the act or omission, although good cause may support an extension, and retaliation for filing is prohibited. A privacy officer, patient advocate, legal-aid program, or attorney can help sort a records-process problem from a legal-authority dispute.

A concise next-action plan

Today: Ask the older adult which helper, tasks, organizations, and information are in scope. Do not exchange passwords.

This week: Request each organization's current authorization and proxy-access instructions. Create a minimal tracker and submit one complete form at a time.

Before the next appointment: Test the helper's separate login, bring identification and any relevant authority document, and ask the patient to state the desired involvement.

Every three to six months: Review who still has access, what has expired, and whether a care transition requires a new form. The safest access plan is understandable, limited, documented, and easy for the older adult to change.

Sources

• HHS Office for Civil Rights: Family Members and Friends
• HHS Office for Civil Rights: Your Medical Records
• HHS Office for Civil Rights: Individuals' Right Under HIPAA to Access Their Health Information
• HHS Office for Civil Rights: Personal Representatives
• HHS Office for Civil Rights: Authorization Core Elements
• ASTP/ONC Patient Engagement Playbook: Caregiver Portal Access
• HHS: Understanding Confidentiality of Substance Use Disorder Patient Records
• HHS Office for Civil Rights: Health Information Privacy Complaint Process