HIPAA Authorization and Accessing a Parent's Medical Records in New York

Being a Family Member Doesn't Give You Access to Medical Records

One of the most frustrating experiences adult children face when managing an aging parent's care is discovering that being next of kin gives them no automatic right to access their parent's medical records. The Health Insurance Portability and Accountability Act (HIPAA) is a federal privacy law, and it applies everywhere — including New York. Without a HIPAA authorization or another HIPAA-permitted basis for disclosure, a hospital, doctor's office, pharmacy, or home care agency cannot give adult children unrestricted access to a parent's diagnosis, medications, test results, or treatment plans. HIPAA may permit limited sharing with people involved in the parent's care in some circumstances, but that is not the same as ongoing records access.

This becomes a crisis when the parent is hospitalized and the family can't get information from the care team, when a new doctor needs the parent's medical history and the records are locked behind a HIPAA wall, or when the family is trying to coordinate care across multiple providers who won't talk to each other without written authorization.

How HIPAA Authorization Works

A HIPAA authorization is a signed document in which the patient (your parent) specifically consents to the release of their protected health information (PHI) to designated individuals. Under the HIPAA Privacy Rule (45 CFR § 164.508), a valid authorization must include:

• A specific description of the information to be disclosed — "all medical records" is acceptable, but specifying categories (diagnoses, medications, lab results, imaging, treatment notes) is more effective for ensuring providers release everything you need
• The name of the person or entity authorized to receive the information — this is you, specifically identified by name
• The name of the healthcare provider or entity authorized to disclose the information — each provider (hospital, physician practice, pharmacy, home care agency) needs their own authorization or one that names them specifically
• An expiration date or event — the authorization must state when it expires. Many families set the expiration far out (5 years) or tie it to an event ("until revoked in writing")
• The patient's signature and date — or the signature of their personal representative if the patient lacks capacity

Most healthcare providers in New York have their own HIPAA authorization forms. You can use theirs — or you can prepare a comprehensive standalone form that covers all providers, which is more efficient than filling out a separate form at every office.

What a Health Care Proxy Adds

If your parent has executed a New York Health Care Proxy under Public Health Law § 2981, the designated health care agent gains the right to access the parent's medical information — but only after the proxy is activated. Activation requires a formal determination by the parent's attending physician that the parent lacks capacity to make their own medical decisions.

Before activation, the health care proxy does not grant access to medical records. This is a common misconception that leaves families without access during the exact period when they need it most — the early stages of cognitive decline, when the parent is struggling with medical decisions but hasn't been formally declared incapacitated.

A HIPAA authorization signed while the parent has capacity fills this gap. It takes effect immediately and doesn't depend on any medical determination to activate. The most effective approach is to execute both documents simultaneously: a health care proxy for future medical decision-making authority, and a HIPAA authorization for immediate access to medical information.

When the Parent Lacks Capacity to Sign

If the parent already lacks the cognitive capacity to understand and sign a HIPAA authorization, the options narrow considerably:

Power of attorney with health information authority. If the parent previously executed a durable power of attorney that includes authority to access health information, the agent can present the POA to healthcare providers as the basis for access. Not all POAs include this authority — it depends on whether the document was drafted to cover healthcare information, which is a separate domain from financial management under New York law. A financial-only POA does not grant access to medical records.

Health care proxy (activated). Once the attending physician determines the parent lacks capacity, the activated health care proxy grants the agent both decision-making authority and the right to access medical information necessary to make those decisions.

Article 81 guardianship. If no POA or HCP exists, the family may need to pursue guardianship. A guardian of the person appointed under Mental Hygiene Law Article 81 with authority over health care decisions can access the incapacitated person's medical records as part of their guardianship powers.

HIPAA's "personal representative" rule. Under 45 CFR § 164.502(g), a person who has authority under applicable law to make healthcare decisions for an individual is treated as that individual's personal representative for HIPAA purposes. This means a court-appointed guardian, an activated health care proxy agent, or a POA agent with healthcare authority can access records even without a separate HIPAA authorization form.

Practical Steps for Getting Records Released

Even with proper authorization, getting records released can be slow. Practical tips:

• Present the HIPAA authorization proactively — don't wait until you need records urgently. Provide the signed form to every provider your parent sees, and ask them to add it to the patient's file.
• Request records in writing — verbal requests are often ignored or delayed. Submit a written request referencing the HIPAA authorization already on file.
• Know the timeline — under HIPAA, providers must respond to a records request within 30 days (with one 30-day extension if they notify you in writing). New York Public Health Law § 18 provides an additional state-law right to access records within 10 days.
• Request electronic records when possible — providers are required to provide records in electronic format if they maintain them electronically and you request electronic delivery.

The New York Power of Attorney & Guardianship Kit includes guidance on coordinating HIPAA authorization with the health care proxy and power of attorney documents, so the family has access to medical information at every stage — from early planning through a capacity crisis.

See more New York guides →