HIPAA Authorization Form New Jersey: Getting Access to Your Parent's Medical Records

Your parent was admitted to the ER after a fall. You rush to the hospital and ask the nurse about test results, treatment options, and discharge plans. The response: "We can't share that information with you." Your parent is conscious but confused, and the privacy officer explains that without a signed HIPAA authorization, federal law prevents them from discussing your parent's medical information with anyone — including their adult children.

Why the Advance Directive Isn't Enough

Many families assume that naming a healthcare representative in an advance directive automatically grants access to medical records. It doesn't — at least not while your parent retains any degree of decision-making capacity.

The advance directive becomes operative only after a clinical determination of incapacity for a specific healthcare decision. Until that threshold is crossed, your parent is considered their own decision-maker, and HIPAA's privacy protections remain fully in force. The healthcare representative designation sits dormant.

This creates an infuriating gap: your parent may be confused, disoriented, or unable to meaningfully participate in care discussions — but hasn't been formally determined to lack capacity. During this window, you're locked out of the information you need to coordinate their care, challenge a premature discharge, or communicate with specialists across multiple facilities.

What a Standalone HIPAA Authorization Does

A properly executed HIPAA authorization (also called a HIPAA release or medical information release) allows designated family members to access a parent's protected health information regardless of the parent's current cognitive status. It operates independently from the advance directive and is effective immediately upon signing.

The authorization permits providers to:

• Disclose medical records, test results, and imaging studies
• Discuss diagnoses, prognosis, and treatment options with you
• Share discharge plans and post-acute care recommendations
• Provide information to home health agencies coordinating care
• Release records to other providers you designate for second opinions

What the Form Must Include

Under the HIPAA Privacy Rule (45 CFR 164.508), a valid authorization must contain:

• Specific description of the information to be disclosed (or "all medical records" for comprehensive access)
• Name of the person(s) authorized to receive the information
• Name of the covered entity (hospital, physician practice, facility) authorized to disclose
• Purpose of the disclosure (can be "at the request of the individual" or "care coordination")
• Expiration date or event (many families use "upon written revocation" to avoid needing renewal)
• Signature and date of the patient (or their personal representative if they lack capacity)
• Statement of the right to revoke the authorization in writing

Timing: Execute It Before the Crisis

The HIPAA authorization requires your parent's signature while they have the capacity and willingness to sign. Once capacity is lost and no authorization exists, providers will refuse disclosure until you obtain either:

• A court-appointed guardianship (weeks to months)
• A clinical determination activating your healthcare representative authority under the advance directive

Neither of these helps during the acute phase when information access matters most — the first 48-72 hours of a hospitalization, when treatment decisions are being made rapidly and you're flying blind.

Practical Tips for Execution

Make it broad. Authorize disclosure of "any and all medical records and health information" rather than specifying particular conditions. You can't predict what records you'll need in an emergency.

Name multiple recipients. Include all adult children who may be coordinating care, plus their addresses. If only one sibling is named and they're traveling when the crisis hits, the others are locked out.

Provide copies to every provider. The form must be on file with each covered entity you want to communicate with — the primary care physician, specialists, the local hospital, home health agencies, and the pharmacy. Give copies to the parent's current providers proactively.

Keep originals accessible. Don't file the HIPAA authorization in a safe deposit box. Keep it in the same folder as the advance directive, power of attorney, and insurance cards — somewhere any family member can grab it and present it at an ER.

HIPAA Authorization vs. Power of Attorney vs. Advance Directive

You need all three. Each fills a different gap, and no single document covers what the others provide.

Get All Three Documents Together

The New Jersey Power of Attorney & Guardianship Kit includes the standalone HIPAA authorization alongside the advance directive and durable financial power of attorney — each with New Jersey-specific execution instructions and provider delivery checklists.

See more New Jersey guides →