HIPAA Authorization in Connecticut: How to Access Your Aging Parent's Medical Records

You're at the hospital after your parent's fall, and the nurse won't tell you anything. Not the diagnosis, not the medications, not whether they're being admitted or discharged. You're their child. You drove them here. And you're being told that without proper authorization, the hospital can't share a thing.

This is HIPAA doing exactly what it was designed to do — protecting patient privacy. But for adult children managing an aging parent's care, it creates a brick wall at the worst possible moment. Connecticut has specific state laws that supplement HIPAA, and understanding both layers is the key to getting legal access to your parent's medical information before a crisis makes it urgent.

How HIPAA and Connecticut Law Work Together

HIPAA is federal law. It protects a patient's protected health information but does not automatically give family members access. A provider may share information directly relevant to a family member's involvement in care or payment when the patient agrees, does not object, or the provider determines the disclosure is in the patient's best interest. A written authorization provides a clear way to name who may access records. Connecticut General Statutes § 20-7c adds state-specific rules about medical record access, including a 30-day deadline for providers to respond to authorized records requests.

The simplest solution: your parent signs a standalone HIPAA authorization form naming you (and any other family members who need access) as authorized recipients of their medical information. This authorization should be separate from the health care representative appointment, because it serves a different purpose:

• A Health Care Representative appointment grants decision-making authority when the patient is incapacitated
• A HIPAA authorization grants access to medical records immediately, while the patient still has capacity

You need both. The HIPAA authorization lets you communicate with doctors, review lab results, and coordinate care right now. The Health Care Representative appointment gives you authority to make decisions later if your parent can't.

What the Authorization Should Include

A valid HIPAA authorization for Connecticut purposes should specify:

• Who is authorized — name every person who should have access (yourself, siblings, a spouse)
• What information is covered — medical records, billing records, pharmacy records, mental health records, substance abuse treatment records. If you don't specify a category, providers may refuse to release it
• Duration — make it indefinite or with a far-future expiration date, not tied to a specific event
• Right to revoke — HIPAA requires that the patient be informed they can revoke the authorization at any time

Some healthcare systems in Connecticut have their own HIPAA release forms that they prefer patients use. Having your parent sign the system-specific form during their next routine appointment makes the authorization immediately accessible in the provider's electronic health record.

Accessing Records Under CGS § 20-7c

Connecticut law gives patients (and their authorized representatives) the right to obtain copies of medical records from any healthcare provider in the state. Key provisions:

• Providers must respond within 30 days of a written request
• Records required for Social Security disability or VA appeals must be provided at no charge when the written request is accompanied by documentation of the claim or appeal
• Providers can charge reasonable fees for copies, but the fee cannot be used to delay or discourage access
• If a provider fails to respond within 30 days, the patient can file a complaint with the Connecticut Department of Public Health

For adult children acting under a health care representative appointment, the relevant authority to request records is tied to that appointment and its activation. A financial POA alone does not automatically grant medical-record access. A standalone HIPAA authorization sidesteps both timing and scope objections.

Practical Steps

Execute the HIPAA authorization at the same time as the other advance planning documents — the financial POA, the health care representative appointment, and the living will. Having your parent sign all four in one session, in front of the same two witnesses, is the most efficient approach.

After signing, deliver copies to:

• Your parent's primary care physician
• Any specialist they see regularly
• The local hospital (most have a patient records department that can file it)
• Their pharmacy (for medication history access)
• Their health insurance company

If your parent has already lost capacity and you don't have a HIPAA authorization, you'll need to rely on the health care representative appointment (if one exists) or petition for conservatorship through the probate court. The conservator can then authorize medical record access, but the process can take weeks, particularly in high-volume districts.

The Connecticut Power of Attorney & Guardianship Kit includes HIPAA authorization templates alongside the financial POA and health care representative forms, designed for a single coordinated signing session.

See more Connecticut guides →