HIPAA Authorization Form Virginia — Getting Access to Your Parent's Medical Records

Your father is in the hospital. You call to get an update on his condition, and the nurse says she can't share any information with you. Not his diagnosis, not his medications, not when he might be discharged. You're his daughter. You've been managing his care for three years. And legally, the hospital is right.

The Health Insurance Portability and Accountability Act (HIPAA) treats your parent's medical information as their private property. Being family doesn't grant you access. Being the person who drives them to every appointment doesn't grant you access. Only explicit, documented authorization grants you access.

How HIPAA Blocks Adult Children

Under HIPAA's Privacy Rule, healthcare providers cannot disclose a patient's protected health information (PHI) to anyone — including adult children — without the patient's written authorization. PHI includes:

• Diagnoses and medical conditions
• Test results and lab work
• Treatment plans and medication lists
• Hospital admission and discharge information
• Mental health and substance abuse records
• Billing and insurance information

If your parent is conscious and capable, they can verbally authorize the provider to share information during a specific visit. But that authorization is situation-specific — it doesn't carry over to the next call, the next department, or the next facility.

Two Ways to Get Permanent Access

Option 1: Standalone HIPAA Authorization Form

A HIPAA authorization form is a signed document from your parent specifically authorizing named individuals to receive their medical information. It can be as broad or narrow as the patient wants:

• Who gets access: Name specific individuals (you, your sibling, your parent's spouse)
• What information: All medical records, or specific categories (mental health records typically require separate authorization)
• Which providers: All healthcare providers, or specific facilities and physicians
• Duration: Until revoked, or a specific expiration date

The form must be signed by your parent while they have capacity. No notarization is required, but having the form notarized adds a layer of credibility when presenting it to providers.

Option 2: Embed HIPAA Authorization in the Advance Medical Directive

The more durable approach is to include explicit HIPAA authorization language in Virginia's Advance Medical Directive. Under the Virginia Health Care Decisions Act (Virginia Code § 54.1-2983), when a parent designates a healthcare agent in their advance directive, that agent gains the same rights as the parent to access medical records — but only if the directive includes explicit HIPAA release language.

This is the preferred approach because:

• The advance directive is the document healthcare providers review when the patient loses capacity
• Embedding the HIPAA authorization means providers see it at the exact moment they need it — when they're activating the healthcare agent's authority
• A standalone HIPAA form can get lost, misplaced, or forgotten in a drawer. The advance directive travels with the patient's medical file.

What to Include in the HIPAA Authorization

Whether standalone or embedded in the advance directive, the authorization should:

• Name the specific individuals authorized to receive information
• State that the authorization covers all protected health information, including but not limited to mental health records, substance abuse treatment records, and HIV/AIDS information (these categories have additional federal protections and need explicit mention)
• State that the authorization survives the patient's incapacity
• Include the patient's signature and date
• Include a statement that the authorization can be revoked in writing at any time

When HIPAA Access Is Already Granted Without a Form

There are limited situations where a healthcare provider may share information without a signed authorization:

• The patient is present and does not object. If your parent is in the room, awake, and doesn't protest when the doctor discusses their condition with you present, the provider can proceed.
• The provider determines it's in the patient's best interest. A provider can use professional judgment to share limited information with a family member involved in the patient's care. But this is discretionary — the provider can also refuse.
• The patient has a court-appointed guardian. A guardian of the person has legal authority to access the ward's medical records as part of their decision-making role.

None of these exceptions reliably guarantees access. The first depends on the parent being conscious and present. The second depends on the provider's willingness. The third requires going through the full guardianship process. A signed authorization form is the only approach that creates a reliable, portable right to information.

The Emergency Problem

The worst-case scenario: your parent arrives at the ER unconscious, and you need to provide their medical history, current medications, and treatment preferences. Without HIPAA authorization on file, the ER staff will treat based on what they can observe and test — not what you know from years of managing their care.

Virginia's ConnectVirginia registry allows patients to upload their advance directives so emergency providers can access them electronically. If your parent's advance directive includes HIPAA authorization and is registered, the ER can pull both the treatment preferences and the authorization simultaneously.

Combining HIPAA Access With the Full Legal Authority Package

HIPAA authorization is one piece of the legal authority puzzle. It gives you access to information — but not decision-making power. For complete coverage, your parent needs:

• HIPAA authorization — access to medical records and information
• Healthcare power of attorney / Advance Medical Directive — authority to make medical decisions when the parent can't
• Financial power of attorney — authority to manage money, pay bills, and handle financial institutions

All three are interconnected. A healthcare agent who can make treatment decisions but can't review the medical records is making blind decisions. A financial agent who can pay the hospital bill but can't discuss the treatment plan is operating in the dark.

The Virginia Power of Attorney & Guardianship Kit includes the advance medical directive with embedded HIPAA authorization language, the financial power of attorney, and the healthcare decision-making framework — all designed to work together so no gap exists between information access and decision-making authority.

See more Virginia guides →