HIPAA Release Elderly Parent Hawaii

Why a POA Doesn't Automatically Get You Medical Records

Families assume that holding a power of attorney — or even being the designated healthcare agent under a Hawaii Advance Health Care Directive — means hospitals and doctors will hand over medical records on request. That assumption fails at the front desk of nearly every provider.

HIPAA is federal law, and it overrides state assumptions about family access. Under HIPAA's Privacy Rule, healthcare providers generally cannot share a patient's protected health information (PHI) with adult children unless the patient has signed a specific HIPAA authorization, the requester holds active authority under a document the provider accepts, or a permitted involved-in-care exception applies.

A Hawaii AHCD (HRS 327E) gives your healthcare agent authority to make medical decisions, but many provider compliance departments distinguish between decision-making authority and information access authority. The result: your agent can authorize surgery but can't get the test results that inform the decision, because the records department won't release them without a standalone HIPAA release.

What a Valid HIPAA Authorization Must Include

A HIPAA authorization isn't a generic "release all records" letter. Federal regulations (45 CFR § 164.508) require specific elements:

1. Specific description of the information to be disclosed — "all medical records" works, but "records related to cardiac care" or "pharmacy records and lab results" is more targeted
2. Identification of who can disclose — the specific provider, hospital, or pharmacy being asked to release records
3. Identification of who receives the information — your name, relationship, and contact information
4. Purpose of the disclosure — "to assist with ongoing care management" or "for care coordination by family caregiver"
5. Expiration date or expiration event — use a calendar date or an event tied to the individual or the purpose of the disclosure
6. The patient's signature and date — or the signature of the patient's personal representative with proof of authority
7. Statement of the right to revoke — the patient must be informed they can revoke the authorization in writing, subject to applicable exceptions
8. Statement about redisclosure — information disclosed may be subject to redisclosure by the recipient and may no longer be protected by HIPAA
9. Statement about conditioning — whether treatment, payment, enrollment, or benefits eligibility can be conditioned on signing the authorization

Missing any of these elements gives the provider's compliance department grounds to refuse.

When Your Parent Can Sign

If your parent has cognitive capacity, the simplest path is having them sign HIPAA authorizations naming you as a recipient — one per provider is ideal, though a broadly worded authorization works across multiple facilities.

Do this at the same time you establish the power of attorney and advance health care directive. The three documents together — financial POA, AHCD, and HIPAA authorization — form a complete authority package. Sign them in the same sitting, in front of the same notary.

Distribute copies immediately. Give each of your parent's providers (primary care physician, specialists, hospital system, pharmacy) a signed copy. Hospitals are more likely to honor an authorization that's already on file than one you produce during an emergency at 2 AM.

When Your Parent Cannot Sign

If your parent has lost capacity, they can't sign a new HIPAA authorization. In that case, your path to medical records depends on what documents already exist:

If you hold an AHCD naming you as healthcare agent and the agent's authority has been activated (the physician has documented incapacity): you are the patient's "personal representative" under HIPAA. Providers must give you access to PHI as if you were the patient — but you'll need to present the AHCD and the physician's capacity determination to each provider's records department.

If you are the court-appointed guardian: the guardianship order makes you the personal representative for HIPAA purposes. Present the Letters of Guardianship.

If neither exists: you have no legal right to the records under HIPAA. The provider may use their discretion to share information with a family member "involved in care" under the HIPAA exception for treatment purposes, but this is discretionary — they can say no, and many do.

Common Rejection Scenarios and Fixes

"The authorization is too old." Some providers have internal policies rejecting authorizations older than a year, even though HIPAA doesn't require annual renewal when the authorization has not expired or been revoked. Solution: use a clear expiration date or event, ask each provider about its policy, and renew if needed.

"We need our own form." Some hospital systems require their proprietary HIPAA release form. This is legally questionable — HIPAA doesn't mandate provider-specific forms — but arguing health law at the admissions desk during a medical crisis isn't productive. Ask each major provider in advance whether they require their own form, and sign those too.

"The POA doesn't mention HIPAA." Correct — a financial POA under HRS 551E doesn't cover medical information access. You need either the AHCD with activated agent authority or a standalone HIPAA authorization. They're different legal instruments solving different problems.

The Hawaii Power of Attorney & Guardianship Kit includes the complete authority package — financial POA, healthcare directive, and HIPAA authorization — with execution checklists calibrated to Hawaii's specific requirements.

See more Hawaii guides →