HIPAA Release for an Elderly Parent: How to Access Their Medical Records

Your parent is in the hospital. You call the nurse's station to ask about their condition. The response: "I'm sorry, we can't discuss that with you."

HIPAA — the Health Insurance Portability and Accountability Act — prevents healthcare providers from sharing your parent's medical information with anyone, including their adult children, without proper authorization. Being family doesn't override federal privacy law.

The Three Ways to Get Medical Records Access

1. Standalone HIPAA Authorization Form

The simplest approach while your parent still has capacity: have them sign a HIPAA authorization form naming you as an authorized recipient of their medical information.

This is a separate document from a power of attorney or advance directive. It specifically authorizes healthcare providers to share protected health information with the named individuals — and your parent controls exactly how broad or narrow the access is.

Most hospitals and medical practices have their own HIPAA release forms. You can also use a general authorization form that works across providers. In New Hampshire, there's no specific statutory form required — any written authorization that identifies the patient, the authorized recipient, the information covered, and an expiration date satisfies the federal requirements.

2. Healthcare Advance Directive (RSA 137-J)

New Hampshire's statutory advance directive incorporates a HIPAA release that allows the designated healthcare agent to access medical records and communicate with providers. But there's a critical limitation: this access activates only after a physician certifies that your parent lacks decision-making capacity.

Before that clinical certification, the healthcare agent has no HIPAA access through the advance directive. If your parent is hospitalized but still considered competent, the built-in HIPAA release hasn't triggered.

This is why a standalone HIPAA authorization is valuable even if your parent has an advance directive — it provides access before the capacity trigger occurs.

3. Guardianship Order

If your parent has already lost capacity and didn't execute any prior authorizations, a court-ordered guardianship under RSA 464-A gives the guardian access to medical information as part of their authority over the ward's person.

But this is the most expensive and time-consuming path to medical records access — a problem that a $0 HIPAA authorization form would have prevented.

What the HIPAA Release Should Cover

A comprehensive HIPAA authorization for an aging parent should include:

• Named recipients: You, and ideally one or two backup contacts (siblings, spouse)
• Scope of information: "All medical records, including but not limited to diagnosis, treatment plans, medication lists, lab results, and imaging reports"
• Named providers: Specific doctors, hospitals, and pharmacies — or a general authorization covering any provider
• Duration: Consider making it open-ended rather than expiring after a set period, since the need for medical information access typically increases over time
• Right to revoke: Your parent retains the right to revoke the authorization at any time while competent

The Emergency Room Problem

The scenario families dread: your parent arrives at the emergency room unconscious or confused. No HIPAA form on file. No advance directive. No one at the hospital can share information with you, and you can't authorize treatment.

In genuine medical emergencies, hospitals generally provide treatment under the emergency exception — they don't need your consent to stabilize a patient. But the information flow problem remains: you can't participate in treatment decisions, discuss prognosis, or coordinate post-discharge care without proper authorization.

New Hampshire hospitals will typically work with families to establish access through the patient once the patient regains capacity. But if the patient doesn't regain capacity, you're facing the guardianship pathway.

Taking Action Before the Crisis

The HIPAA authorization is arguably the most overlooked document in elder care planning, and it's the easiest to execute. No notary required, no witnesses needed for a standalone HIPAA form, and most medical practices will process one during a routine visit.

Pair it with a healthcare advance directive for the capacity-trigger coverage, and add a financial POA for the money side — and you have the complete authorization framework.

The New Hampshire Power of Attorney & Guardianship Kit includes HIPAA authorization guidance alongside the healthcare directive and financial POA, ensuring no access gap exists when a medical crisis hits.

See more New Hampshire guides →