HIPAA Authorization Form Illinois: Getting Access to a Parent's Medical Records

Why You Can't Just Ask for Your Parent's Records

Being someone's adult child gives you no automatic right to their medical information. Under HIPAA's Privacy Rule (45 CFR § 164.502), an adult child is not automatically the patient's personal representative. A provider may share relevant information with family involved in the patient's care in circumstances permitted by HIPAA, but a signed authorization gives you a clear basis for ongoing access.

This catches families off guard at the worst possible moment. Your parent is hospitalized after a fall, the doctor asks about their medication list and medical history, and you realize you have no legal standing to access their chart, talk to their specialists, or even confirm what room they're in.

The Stand-Alone HIPAA Authorization

A HIPAA authorization is a signed form where your parent specifically names you (or anyone else) as someone their healthcare providers can share medical information with. It's governed by federal law (45 CFR § 164.508) and is recognized by every healthcare provider in the country.

The form is straightforward. It must include:

• Your parent's name and identifying information
• Your name as the authorized recipient
• A description of the information to be disclosed (most families choose "all protected health information" to avoid gaps)
• The purpose of the disclosure (typically "at the request of the individual" or "for care coordination")
• An expiration date or event (many families write "upon my death or written revocation")
• Your parent's signature and the date

No witness or notary is legally required for a HIPAA authorization. However, adding a notary seal helps with institutional acceptance — hospital records departments process hundreds of authorization requests and a notarized form moves through their review faster.

HIPAA Authorization vs. Healthcare Power of Attorney

These documents serve different purposes and can work together or independently.

A HIPAA authorization grants access to medical records and information. It does not give you any decision-making authority. You can read the chart, talk to physicians, and receive test results — but you cannot consent to surgery, refuse treatment, or authorize a care facility transfer.

A healthcare power of attorney grants decision-making authority that inherently includes records access. Under 45 CFR § 164.502(g), a person authorized to make healthcare decisions for a patient is treated as a "personal representative" with full HIPAA rights. So if you hold a valid healthcare POA and your parent lacks capacity, you can access their records through that authority without a separate HIPAA form.

The stand-alone HIPAA authorization fills two gaps:

1. While your parent has capacity: The healthcare POA may not have activated yet (particularly a springing POA), but you still need records access to coordinate care, manage prescriptions, or communicate with specialists.

2. For people who aren't the healthcare agent: Siblings, a spouse, or other family members who need information access but aren't named as the POA agent.

Getting Providers to Actually Honor the Form

In theory, a valid HIPAA authorization obligates the provider to release records. In practice, hospital records departments and physicians' offices apply their own internal compliance procedures, which can create friction.

Common sticking points and how to handle them:

"We need our own form." Many health systems have their own HIPAA release form and prefer you use it instead of a generic one. Carry your parent's signed authorization, but expect to fill out the provider's form too. Having both speeds things up.

"The authorization has expired." If your parent signed the form years ago and it included an expiration date that's passed, you'll need a new one. Consider using an open-ended expiration like "valid until revoked in writing" to avoid this.

"We need to verify your identity." Bring a government-issued photo ID when requesting records. The provider is legally required to verify that the person requesting access is the person named in the authorization.

"The patient needs to request it themselves." If your parent has capacity and can speak for themselves, some providers prefer to hear it directly from the patient. This isn't a HIPAA requirement — it's an internal policy. The signed authorization should be sufficient, but having your parent call or confirm in person can resolve the issue fastest.

When Capacity Is Already Gone

If your parent can no longer sign documents due to dementia or another condition, you cannot get a new HIPAA authorization from them. At that point, your options depend on what's already in place:

• Healthcare POA exists: You access records as a personal representative under 45 CFR § 164.502(g). Bring the executed POA and a physician's capacity determination (if it's a springing POA) to the records department.
• No POA exists: You may qualify as a personal representative under state law through the Health Care Surrogate Act (755 ILCS 40/), but only after the attending physician and at least one other qualified health care practitioner certify your parent's incapacity and qualifying condition. Outside of that narrow circumstance, you'll need to pursue guardianship through the probate court to gain records access.

This is why getting a HIPAA authorization signed early — ideally at the same time as the healthcare POA — matters. It's a five-minute task when your parent is healthy and capable. After capacity is lost, the alternatives take weeks or months.

The Illinois Power of Attorney & Guardianship Kit includes a HIPAA authorization template alongside the property and healthcare POA forms, so your family can execute all three documents in a single sitting.

See more Illinois guides →