HIPAA Authorized Representative: How to Access a Parent's Medical Records

What HIPAA Authorization Actually Gives You

HIPAA — the Health Insurance Portability and Accountability Act — governs who can access a person's protected health information (PHI). By default, healthcare providers, insurers, and Medicare cannot share your parent's medical records, claims data, or billing history with anyone, including their adult children. Verbal permission at a doctor's appointment doesn't create a durable legal right.

To get structured, ongoing access, you need to be formally designated as an authorized representative through the appropriate documentation. This isn't a single form — different agencies and providers use different mechanisms, and each grants a different scope of access.

The Two Medicare Forms You Need

Form CMS-10106: Authorization to Disclose Personal Health Information

This form gives 1-800-MEDICARE permission to share your parent's Medicare information with you. It covers billing history, claims data, eligibility status, and coverage details. It does not grant you the authority to make decisions or file appeals — it's read-only access.

The parent (the beneficiary) must sign this form while they have capacity. You'll need the parent's Medicare number, their signature, and the specific categories of information you're authorized to receive. The form was last revised March 1, 2026, with an OMB expiration of March 31, 2029.

Download it from cms.gov or request a copy by calling 1-800-MEDICARE.

Form CMS-1696: Appointment of Representative

If you need to do more than view records — if you need to file appeals, dispute coverage denials, submit grievances, or represent your parent in formal Medicare proceedings — you need Form CMS-1696. Under 42 CFR Section 405.910, this form designates you as a formal representative with legal authority to act on the beneficiary's behalf.

This is the form you need when Medicare denies a hospital stay classification, rejects a home health claim, or refuses to cover a specific treatment. The CMS-10106 lets you see what happened; the CMS-1696 lets you fight it.

Both forms can be submitted by mail or fax. Processing takes two to four weeks. File them before a crisis — doing paperwork while your parent is actively hospitalized adds stress to an already overwhelming situation.

Hospital and Provider-Level Authorization

Medicare forms cover the federal system. Individual hospitals, doctor's offices, and clinics operate under their own HIPAA release processes. Most use a generic HIPAA Authorization for Release of Information form that the parent signs, specifying:

• Who is authorized to receive information (you, by name)
• What information is covered (all records, or specific categories like lab results, imaging, prescriptions)
• The expiration date (some are time-limited, others remain valid until revoked)

Ask every provider your parent sees to add a signed HIPAA release to their file. This is especially important for the primary care physician, any specialists they see regularly, the hospital system they'd be admitted to in an emergency, and the pharmacy that fills their prescriptions.

Patient Portal Access

MyChart, Epic, Cerner, and other electronic health record systems have their own proxy access features. These typically require:

• A signed HIPAA authorization on file with the provider
• An in-person or verified identity setup at the provider's front desk
• The parent to authorize proxy access through their own portal account

Once configured, you'll have a separate login that lets you view (and sometimes manage) appointments, lab results, medication lists, and messages to the care team. This is far more practical than calling the office every time you need an update.

When the Parent Lacks Capacity

If your parent has already lost the ability to sign forms — due to dementia, a stroke, or another incapacitating condition — the process is harder but not impossible.

A healthcare Power of Attorney (also called a healthcare proxy or medical POA, depending on the state) grants you legal authority to make medical decisions and, by extension, access medical information. Present the executed POA document to each provider and request that it be added to the medical record.

If no healthcare POA exists, you may need to pursue legal guardianship or conservatorship through the courts. This is expensive ($3,000 to $10,000+ in most states) and time-consuming, which is why establishing these authorizations while the parent still has capacity is so critical.

UK and International Equivalents

In England and Wales, proxy access to NHS records is managed through the GP surgery. The parent completes a third-party consent form, and the GP configures access through the NHS App's Proxy Application Service. If the parent lacks capacity, the GP requires a registered Lasting Power of Attorney for Health and Welfare.

In Canada, health information access varies by province. Each province has its own health information privacy legislation (PHIPA in Ontario, HIA in Alberta, etc.), and hospitals typically require province-specific consent forms.

In Australia, caregivers can register as a Nominated or Authorised Representative on the My Health Record system. Nominated Representatives are appointed by the parent directly; Authorised Representatives are appointed when the parent lacks capacity, requiring evidence of enduring Power of Attorney or guardianship.

Building the Complete Access Framework

HIPAA authorization is one piece of the administrative puzzle. Your parent's digital life also includes banking portals, utility accounts, email, social media, and password management — each with its own access requirements and legal frameworks. The Managing a Parent's Digital Life toolkit coordinates all of these into a single 90-day implementation plan, including the specific forms, platform settings, and POA clauses you need for each system.