HIPAA Authorization for an Elderly Parent in Idaho: How to Access Medical Records

You call your mother's doctor to ask about her latest blood work, and the receptionist tells you they can't share anything — not the results, not the diagnosis, not even whether she was seen that day. You've been driving her to appointments for months. It doesn't matter. Without a signed HIPAA authorization on file, federal privacy law treats you like a stranger.

This is one of the most frustrating walls adult children hit when caring for an aging parent, and it's entirely fixable with the right paperwork.

What HIPAA Actually Blocks (and Doesn't)

The Health Insurance Portability and Accountability Act restricts healthcare providers from sharing a patient's protected health information — medical records, test results, diagnoses, treatment plans, billing information — with anyone the patient hasn't explicitly authorized. Being next of kin doesn't override this. Being the person who handles everything else in your parent's life doesn't override this either.

There are narrow exceptions. Providers can share information with family members who are directly involved in a patient's care if the patient is present and doesn't object, or if the provider uses professional judgment to determine that sharing is in the patient's best interest. But in practice, many providers and hospitals default to refusing disclosure unless they have written authorization on file — it's the safest legal position for them.

How a HIPAA Authorization Works

A HIPAA authorization is a signed form where your parent specifically names who can receive their medical information, what information can be shared, and which providers are covered. Unlike a power of attorney, which grants decision-making authority, a HIPAA release only permits information sharing — it doesn't let you make medical decisions.

The form needs to include:

• Who is authorized to receive information (your name, and ideally any siblings who may need access)
• What information is covered (all medical records, or specific categories like lab results, treatment plans, billing)
• Which providers are authorized to share (specific doctor's office, hospital system, or all providers)
• An expiration date or event (most families choose "upon revocation" or "upon death")
• Your parent's signature and date

Each healthcare provider typically has their own HIPAA release form. But your parent can also sign a general authorization that covers all providers — some will accept it, while others will insist on their own version.

The Timing Problem: When Your Parent Can't Sign

A HIPAA authorization requires the patient's signature. If your parent has already lost cognitive capacity, they can't validly execute one.

This is where the healthcare power of attorney becomes critical. Under Idaho Code § 39-4510, a designated healthcare agent generally has the right to access the principal's medical information as necessary to make healthcare decisions. But not all providers interpret this the same way — some require an explicit HIPAA authorization even when a healthcare POA is in place.

The safest approach: have your parent sign both documents at the same time — a healthcare power of attorney and a separate HIPAA authorization covering all providers. If capacity is already gone, a court-appointed guardian has the legal standing to access medical records, but that process costs thousands and takes weeks.

Getting Records Released After Signing

Once you have a signed HIPAA authorization:

1. Make multiple copies — you'll need to submit one to each provider separately
2. Submit in person or by fax — most providers won't accept email submissions of HIPAA forms due to their own security policies
3. Request records in writing — pair the HIPAA form with a formal records request. Idaho doesn't set a statutory deadline for releasing records, but federal guidelines generally expect providers to respond within 30 days
4. Keep a log — track which providers received the form and when, so you can follow up on delays

What About the Idaho Healthcare Directive Registry?

If your parent has a completed healthcare directive registered with the Idaho Healthcare Directive Registry (IHDR), treating providers can already access the directive itself electronically. But the IHDR registration doesn't substitute for a HIPAA authorization — the registry stores the directive document, not a blanket authorization to share all medical records.

You need both: the healthcare directive registered with IHDR for emergency access to your parent's treatment preferences, and HIPAA authorizations on file with each active provider for ongoing information sharing.

Do It Now, Before You Need It

The worst time to discover you can't access your parent's medical records is during a hospital admission at 2 AM. A HIPAA authorization takes five minutes to sign and costs nothing.

The Idaho Power of Attorney & Guardianship Kit includes both the healthcare power of attorney and HIPAA authorization as part of the complete legal authority package — so you're not scrambling for a separate form at every new provider.

See more Idaho guides →