HIPAA Caregiver Access to Medical Records

The Problem: You Need the Records, and the Office Says No

You call your parent's doctor to ask about their latest A1C results or to clarify a medication change, and the receptionist tells you they cannot share that information due to HIPAA. You are left managing your parent's diabetes without access to the data you need to do it safely.

This happens constantly, and it is almost always wrong. HIPAA does not prohibit healthcare providers from sharing information with family caregivers. What it requires is that the sharing follows specific procedures. The problem is not the law — it is that front-desk staff and even some clinicians misunderstand what HIPAA actually says.

As a caregiver managing an elderly parent's diabetes, you need access to lab results, medication lists, appointment notes, and specialist reports. There are clear, legal pathways to get it.

Option 1: Patient Portal Proxy Access (the Best Approach)

Most healthcare systems now use electronic patient portals (Epic MyChart, Cerner Patient Portal, Athenahealth) where patients can view their records, message their doctors, and manage appointments. These portals offer a "proxy access" or "caregiver access" feature that gives you your own login credentials linked to your parent's account.

Proxy access is different from logging in with your parent's password. When you use proxy access:

• Your actions are logged under your name, maintaining the integrity of the medical record
• You can see lab results, medication lists, appointment summaries, and clinical notes
• You can message the care team on behalf of your parent
• The provider knows they are communicating with the authorized caregiver, not the patient

How to set it up:

1. Ask the patient registration or health information management office for an "adult proxy access" or "caregiver access" request form
2. Your parent signs the form (if they have capacity) or you present a valid healthcare power of attorney
3. Bring a government-issued ID for both you and your parent
4. The office activates your proxy account; timing varies by health system

If your parent receives care from multiple health systems, you will need to set up proxy access at each one separately. It is worth the upfront effort — once activated, you have real-time access to every new lab result, every medication change, and every visit note without calling and waiting.

Option 2: The HIPAA Right of Access Request

If a provider refuses to grant proxy access or you need records from a facility that does not offer it, your parent—or you as their HIPAA personal representative—can use the federal right of access to request copies of the parent's records.

Under the HIPAA Privacy Rule (45 CFR Part 164), a patient or their personal representative can request the designated record set in the requested electronic format when readily producible. The covered entity must provide access within 30 calendar days, or may take one additional 30-day extension if it gives written notice explaining the delay.

A patient may make a request for their own records. A "personal representative" under HIPAA includes:

• A person with healthcare power of attorney (also called a health care proxy or medical power of attorney)
• A court-appointed guardian

The request does not need to be on the provider's form. You can submit your own written request that states:

• The patient's full name and date of birth
• Your name and relationship
• A copy of your healthcare POA or guardianship document
• The records you are requesting (be specific: "all records from January 2025 to present" or "all endocrinology visit notes and lab results")
• Your preferred format (electronic is fastest — request a patient portal invitation or records via secure email)

The provider can charge only a reasonable, cost-based fee for permitted copying, supplies, postage, or an agreed summary. Electronic copies may therefore be minimal or zero. They cannot charge you for searching for or retrieving the records.

If a provider refuses your valid request, file a complaint with the HHS Office for Civil Rights. Providers who violate the Right of Access face enforcement actions — HHS has been actively pursuing these cases since 2019 under their Right of Access Initiative.

Option 3: Verbal Authorization for Day-to-Day Communication

For routine conversations — calling to ask about a medication, sitting in on an appointment, discussing test results — HIPAA allows providers to share information with family members when the patient is present and does not object, or when the provider reasonably infers from the circumstances that the patient would not object.

In practice, this means:

• If your parent is in the room during a doctor visit, the doctor can speak freely with you unless your parent objects
• If you call the doctor's office and your parent is on the line or has previously told the office you are their caregiver, most providers will discuss care with you
• If your parent has dementia and cannot meaningfully consent or object, providers can use their professional judgment to share information with the person who is clearly acting in the patient's best interest

The limitation of verbal authorization is that it is informal and provider-dependent. One nurse may speak freely with you; another at the same practice may refuse. Formal proxy access eliminates this inconsistency.

Avoiding the Password-Sharing Trap

Many caregivers simply log into their parent's patient portal using the parent's username and password. This works in the short term but creates real problems:

• Messages sent from the account appear to come from the patient, confusing the care team about who they are communicating with
• If a clinical decision is made based on a message you sent while logged in as the patient, and a bad outcome results, the attribution is muddled
• Some healthcare systems have terms of service that prohibit password sharing, and violations can result in account lockout

Proxy access solves all of these problems, although setup time varies by health system. It is worth doing correctly, especially for a complex condition like diabetes where you will be communicating with the care team regularly.

Getting Organized for Multi-Provider Access

Elderly diabetic patients often see multiple specialists — an endocrinologist, a podiatrist, an ophthalmologist, a nephrologist, a primary care physician. Each may be on a different health system with a different portal.

Create a list of every provider, their health system, and whether you have proxy access. Work through the list systematically. For specialists seen once or twice a year, at minimum make sure the office has your contact information on file and that your parent has signed a release allowing them to speak with you.

The Caring for a Parent With Diabetes at Home toolkit includes a care coordination log and HIPAA access request templates that help you organize multi-provider access and keep records of what is authorized where.