HIPAA Authorization Form California: How to Access Your Parent's Medical Records

You're sitting in the ER waiting room and the doctor won't tell you anything about your parent's condition. You're their adult child, you drove them to the hospital, and you've been managing their care for years — but without proper authorization, the hospital is legally required to treat you like a stranger.

HIPAA (the federal Health Insurance Portability and Accountability Act) and California's own Confidentiality of Medical Information Act (CMIA) both restrict who can access a patient's protected health information. Getting the right authorization in place before an emergency prevents this scenario entirely.

Two Layers of Privacy Law

California families deal with two overlapping privacy frameworks:

Federal HIPAA sets the baseline. Healthcare providers, insurers, and their business associates cannot share a patient's protected health information without written authorization — unless a specific exception applies.

California's CMIA (Civil Code Section 56 et seq.) adds stricter protections. Where HIPAA and CMIA conflict, the stricter rule applies. In practice, this means California providers are more cautious about releasing information than providers in states that only follow federal HIPAA.

The result: even if you have a power of attorney, some California healthcare providers will still ask for a separate HIPAA authorization form before sharing your parent's medical records.

How to Get a HIPAA Authorization Signed

A valid HIPAA authorization must include specific elements:

• Description of the information to be disclosed (medical records, lab results, imaging, billing records — be broad enough to cover what you'll actually need)
• Who is authorized to receive it (your name and relationship)
• Purpose of the disclosure ("coordination of care" or "family medical management" works)
• Expiration date or event (you can set this to "none" or "until revoked" so it doesn't expire during an ongoing care situation)
• Your parent's signature and date (or their legal representative's signature if they lack capacity)
• A statement that the authorization can be revoked in writing at any time

Most hospitals and physician offices have their own HIPAA authorization forms. The problem is that each provider's form only covers records held by that provider. If your parent sees multiple specialists, visits different hospitals, or has records at a skilled nursing facility, you'll need to submit authorization forms to each one separately — or use a comprehensive authorization that names all current providers.

The Advance Health Care Directive Shortcut

The most efficient approach is to include HIPAA authorization language directly in your parent's Advance Health Care Directive. California's AHCD (under Probate Code Sections 4600–4806) can include explicit language granting the healthcare agent immediate access to all protected health information.

When drafted this way, a single document covers both decision-making authority and information access. The healthcare agent can walk into any provider's office, present the AHCD, and request records without needing a separate HIPAA form.

The key phrase to include: authorization for the agent to "receive, review, and obtain copies of any and all protected health information, including but not limited to medical records, lab results, imaging studies, and billing records, from any healthcare provider, facility, or insurer."

What Happens in an Emergency Without Authorization

If your parent is incapacitated and you don't have any authorization in place, HIPAA does allow providers to share information with family members involved in the patient's care — but only at the provider's discretion. There's no guarantee they will.

California's default surrogate consent law provides a hierarchy for medical decision-making (spouse, then adult children, then parents), but this covers treatment consent, not necessarily information access. Some providers will share information with the default surrogate; others will insist on formal documentation.

In a true emergency, providers can share minimum necessary information if they believe it's in the patient's best interest. But "minimum necessary" is narrow, and you may not get the full picture you need to make informed care decisions.

Getting Full Legal Authority

A HIPAA authorization handles medical records access. But managing your parent's complete care — finances, Medi-Cal eligibility, IHSS hours, facility placement — requires a full set of legal documents. The California Power of Attorney & Guardianship Kit covers the advance health care directive with built-in HIPAA language, the financial power of attorney, and every supplementary form you'll need for California's benefits programs.

See more California guides →