HIPAA Release for an Elderly Parent in Washington: Accessing Medical Records

You're standing at the hospital nurses' station trying to find out what medications your parent is taking, and the nurse says she can't tell you. Not because she doesn't want to — because HIPAA prohibits sharing protected health information with anyone who isn't the patient or their authorized representative. You're their child, you drove them to the ER, and you're completely locked out.

This is one of the most common — and most infuriating — barriers adult children hit when managing an aging parent's care. The fix is straightforward, but most families don't set it up until they've already been refused.

What HIPAA Actually Blocks

HIPAA (the Health Insurance Portability and Accountability Act) prohibits healthcare providers from sharing a patient's "protected health information" with anyone who isn't authorized. Protected health information includes:

• Diagnoses and medical conditions
• Medications and treatment plans
• Lab results and imaging
• Appointment schedules and provider notes
• Billing information tied to treatment
• Mental health and substance abuse records (which have even stricter protections)

Being a family member doesn't automatically grant general access. Being listed as an emergency contact doesn't grant general access. Even being the person who pays the medical bills doesn't grant general access. A provider may rely on the patient's permission, a written HIPAA authorization, or legal authority through a healthcare power of attorney or court-appointed guardianship; treatment-consent rules are a separate question.

The HIPAA Authorization Form

The most direct solution is a signed HIPAA authorization — a form where your parent specifically authorizes named individuals to receive their protected health information. This is separate from a healthcare POA, though the two work together.

A HIPAA authorization should specify:

• Who is authorized — name each person individually (you, siblings, a spouse)
• What information can be shared — "all protected health information" is the broadest option; your parent can limit it to specific conditions or providers if they prefer
• Which providers are covered — all healthcare providers, or specific hospitals/clinics
• Duration — most authorizations remain effective until revoked, but your parent can set an expiration date
• Right to revoke — the form must state that the authorization can be revoked in writing at any time

Each provider has their own HIPAA release form, which creates a practical problem: your parent would need to sign a separate form at every hospital, clinic, pharmacy, and specialist. A universal HIPAA authorization — one document that covers all providers — is more efficient, though some facilities will still want their own version on file.

Healthcare POA vs HIPAA Authorization: The Overlap

A properly drafted Durable Power of Attorney for Health Care (DPOAHC) under RCW 11.125 gives your agent the authority to make healthcare decisions. Under federal law, a person authorized to make healthcare decisions qualifies as a "personal representative" with full rights to the patient's protected health information.

In theory, a healthcare POA alone should get you HIPAA access. In practice, it often doesn't — for a few reasons:

• Frontline staff don't know the rule. The receptionist at a medical office sees "no HIPAA form on file" in the system and refuses disclosure, even though your POA legally qualifies you.
• The POA isn't in their system. Even if the provider's legal team would accept it, the information isn't in the electronic health record where the nurse is looking.
• Some providers interpret HIPAA narrowly. They'll accept a POA for decision-making but want a separate authorization for records access, even though the regulation doesn't require it.

The safest approach: execute both documents. The healthcare POA gives you decision-making authority. The HIPAA authorization gives you records access in a format that medical office staff recognize and process quickly. Belt and suspenders.

When Your Parent Can't Sign

If your parent has already lost the capacity to sign a HIPAA authorization, the healthcare POA (if one exists) is your ticket. Present it to the provider's privacy officer (not the front desk) and cite 45 CFR § 164.502(g) — the regulation that designates healthcare agents as personal representatives with full HIPAA rights.

If there's no POA and no capacity to sign one, you may need court-appointed guardianship under RCW 11.130 for ongoing authority. Letters of guardianship can provide providers with recognized legal authority, but the process takes weeks to months and costs thousands.

Washington's informed consent statute (RCW 7.70.065) provides a limited fallback: family members in the statutory hierarchy can consent to medical treatment, which some providers interpret as including access to records related to that treatment. But this is treatment consent, not a general HIPAA waiver — it won't get you access to a comprehensive medical record.

Setting It Up Now

If your parent is still competent, get these documents in place today:

1. A HIPAA authorization naming you (and any siblings who need access) as authorized recipients of all protected health information
2. A Durable Power of Attorney for Health Care that includes explicit HIPAA language authorizing the agent to access all medical records
3. File copies with every provider your parent sees regularly — primary care, specialists, pharmacy, hospital

Don't wait for a crisis to discover you're locked out. The Washington Power of Attorney & Guardianship Kit includes the HIPAA authorization alongside the healthcare POA, so both documents are set up together and your access is covered from day one.

See more Washington guides →