HIPAA Release Form Indiana

When HIPAA Blocks You From Your Parent's Medical Information

You have been coordinating your parent's care for years. You drive them to appointments, manage their medications, and talk to their doctors. Then one day the hospital refuses to tell you anything — test results, diagnosis, treatment plan. Nothing. HIPAA's privacy protections have kicked in, and without a valid authorization on file, healthcare providers are legally prohibited from sharing your parent's protected health information with you.

This is not the provider being difficult. Federal law requires it. And in Indiana, state-level rules add specific requirements that a HIPAA release must meet to be valid.

Indiana's HIPAA Authorization Requirements

A valid HIPAA release in Indiana must contain several specific elements. It must identify the patient, name the person or entity authorized to receive the information, describe the specific health information to be disclosed, state the purpose of the disclosure, and include an explicit expiration date.

That expiration date matters more than most families realize. Under Indiana law, a HIPAA release is valid for a maximum of 180 days. After six months, the authorization expires and you need a new one. If your parent has an ongoing condition requiring continuous care coordination, plan to execute a new release every six months — or address the access issue through an Advance Directive that appoints you as Health Care Representative, which provides broader and more durable healthcare information access.

The authorization must be signed by the patient or their legally authorized representative. If your parent has already lost cognitive capacity, you will need a durable financial POA with healthcare information access provisions, a Health Care Representative appointment through an Advance Directive, or Letters of Guardianship from probate court.

The 30-Day Response Deadline

Once you submit a valid HIPAA release to an Indiana healthcare provider, they are not free to take their time. Under both federal HIPAA rules and Indiana Code § 16-39-1-1(e), providers must furnish the requested medical records within 30 days of receiving a written request.

If the provider cannot meet the 30-day deadline, they must notify you in writing and provide the records within an additional 30 days — for a maximum total of 60 days. Providers who fail to meet these deadlines are in violation of both federal and state law.

In practice, many providers respond faster than 30 days, especially when the request comes from a Health Care Representative or an agent acting under a power of attorney. Having your authorization form filed proactively — before you need the records — eliminates the processing delay when a crisis hits.

Medical Records Copy Fees

Indiana law permits healthcare providers to charge reasonable fees for copying medical records, but those fees are regulated under Indiana Code § 16-39-9-3. Providers cannot charge whatever they want.

Families requesting records for ongoing care coordination should be aware that these fees can add up, particularly when multiple providers are involved or when the request covers years of treatment history. Ask each provider about their fee schedule before requesting records, and specify exactly which records you need rather than requesting everything. A targeted request for the past two years of primary care records costs significantly less than a full historical file going back decades.

Electronic copies are generally less expensive than paper copies, and some providers waive fees for patient portal access if you have the parent's login credentials or authorization.

HIPAA Release vs. Advance Directive vs. Power of Attorney

Three different legal instruments can give you access to your parent's health information in Indiana, and understanding the differences helps you choose the right approach.

A HIPAA release is the simplest — it authorizes specific information sharing with specific people for a specific purpose. But it expires after 180 days, and it does not give you decision-making authority. You can see the records, but you cannot consent to treatment or direct care.

An Advance Directive appointing you as Health Care Representative under IC § 16-36-7 gives you both information access and medical decision-making authority. It does not expire after 180 days — it remains in effect until the declarant revokes it or a new Advance Directive supersedes it. For ongoing care coordination, this is the stronger instrument.

A durable financial POA under IC 30-5 does not directly address healthcare information, but if it includes explicit provisions for accessing medical records in connection with benefit applications or financial management, some providers will honor it for limited information requests.

For comprehensive coverage, most families need both a durable financial POA and an Advance Directive — which together cover financial management, healthcare decisions, and medical information access. The Indiana Legal Authority System provides guidance on executing both documents with Indiana-specific requirements, so your parent's care is not held up by institutional access barriers.

See more Indiana guides →