Colorado HIPAA Authorization Form

Your parent is in the hospital. The doctor mentions test results, medication changes, and a possible diagnosis — then asks if you have authorization to receive this information. You assumed being their adult child was enough. It isn't.

Under HIPAA (the Health Insurance Portability and Accountability Act), healthcare providers in Colorado cannot share your parent's protected health information with you unless one of a few specific conditions is met. Without proper authorization, you're locked out of your own parent's medical care.

Why Adult Children Don't Automatically Have Access

HIPAA is a federal law that applies uniformly across all 50 states, including Colorado. It protects a patient's right to control who sees their medical information. Being a family member — even a spouse or adult child — does not grant automatic access.

Healthcare providers can share information with family members only when:

1. The patient is present and agrees (or doesn't object) to the disclosure
2. The patient is incapacitated and the provider determines, in their professional judgment, that sharing is in the patient's best interest
3. The family member has been designated as the patient's personal representative through legal documentation

That second exception — professional judgment — is informal and unreliable. Different providers, different shifts, different hospitals will apply it differently. The only consistent path is having the legal documentation in place before a crisis.

Three Ways to Get Authorized Access

Option 1: HIPAA Authorization Form. The simplest approach while your parent has capacity. Your parent signs a HIPAA authorization form specifically naming you as an authorized recipient of their medical information. The form must include:

• Your parent's name and identifying information
• Your name and relationship
• The specific information authorized for disclosure (or "all medical records")
• The purpose of the disclosure
• An expiration date or event
• Your parent's signature and the date

Most Colorado hospitals and physician offices have their own version of this form. You can also use a standalone HIPAA release form. File it with every healthcare provider your parent sees — their primary care physician, specialists, the hospital system's patient portal, and the pharmacy.

Option 2: Medical Durable Power of Attorney (MDPOA). Under C.R.S. § 15-14-506, the healthcare agent named in an MDPOA has the right to access the patient's medical records. This is broader than a HIPAA form because it also grants decision-making authority — the ability to consent to treatments, refuse procedures, and make placement decisions.

The MDPOA activates when a physician certifies that the parent lacks decisional capacity. However, many Colorado healthcare systems will honor the MDPOA's record-access provisions even while the parent retains capacity, especially if the parent presents the document and confirms they want the agent to have access.

Option 3: Court-appointed guardianship. If your parent has already lost capacity and no MDPOA exists, the court-appointed guardian has full access to the ward's medical records as part of their guardianship authority. This is the most expensive and time-consuming path — but it's the only option when capacity is gone and no advance planning was done.

What to Do Right Now

If your parent still has capacity:

1. Have them sign a HIPAA authorization form naming you (and any siblings who should have access) as authorized recipients
2. Execute a Medical Durable Power of Attorney that explicitly includes health record access language
3. Register both documents with every healthcare provider, hospital system, and pharmacy your parent uses
4. Upload to patient portals — most Colorado hospital systems (UCHealth, SCL Health, Centura) use MyChart or similar portals where authorized representatives can be added

If your parent lacks capacity and no documents exist, your options are limited to the healthcare provider's professional judgment (unreliable) or pursuing guardianship through the probate court.

Common Mistakes

Filing with just one provider. A HIPAA authorization filed at the primary care office doesn't automatically transfer to the hospital, the specialist, or the rehabilitation facility. You need copies on file everywhere.

Using a generic form for a hospital system. Some hospital networks (like UCHealth) prefer their own proxy access forms for patient portal access. Ask their medical records department for the specific form they require.

Assuming the MDPOA is enough. While the MDPOA legally grants access, some providers still request a separate HIPAA form. Having both eliminates pushback.

Waiting until the hospital admission. In an emergency, you're dealing with a parent in crisis, overwhelmed staff, and institutional policies that default to caution. Getting documents on file before a crisis is infinitely easier.

The Colorado Power of Attorney & Guardianship Kit covers HIPAA authorization alongside the Medical Durable Power of Attorney — so your medical record access and healthcare decision-making authority are established in one coordinated process.

See more Colorado guides →