HIPAA Release Form Missouri: What Caregivers Need to Access a Parent's Medical Records

Why You Can't Just Call the Doctor's Office

You've been managing your parent's medications, driving them to appointments, and keeping track of their test results for years. Then one day you call the clinic to ask about a lab result and hear: "I'm sorry, we can't release that information without written authorization."

HIPAA — the Health Insurance Portability and Accountability Act — treats your parent's medical information as private regardless of how involved you are in their care. Being an adult child, even one who lives with the parent, doesn't give you automatic access. You need a signed HIPAA authorization form, and the details of how Missouri handles this matter more than most families realize.

How the HIPAA Authorization Works in Missouri

A HIPAA release is a standalone document that lets your parent designate who can receive their protected health information. It's separate from a healthcare power of attorney and serves a different function: the HCPOA gives you authority to make medical decisions, while the HIPAA authorization gives you the right to see and receive medical records.

You can have one without the other, but most families need both.

A valid HIPAA authorization in Missouri must include:

• The name of the person whose records are being released (your parent)
• The name of the person authorized to receive the information (you, and any siblings or other caregivers who need access)
• A description of the information covered — "all medical records" works, but some providers prefer specific categories (lab results, imaging, medication lists, mental health records)
• An expiration date or event (many families write "until revoked in writing" to avoid needing to re-sign annually)
• Your parent's signature and the date

There's no state-mandated form. Each hospital system, clinic, and insurance carrier typically has its own version. The Missouri Bar's three-part advance directive packet includes a HIPAA release as Part 3, which is the most commonly accepted template across the state's healthcare systems.

What Happens When Your Parent Can't Sign

This is where HIPAA and power of attorney intersect. If your parent has already lost the cognitive capacity to understand and sign a HIPAA authorization, you can't get one signed retroactively. However:

• If you hold a valid Healthcare Power of Attorney (HCPOA): Under HIPAA's privacy rule (45 CFR § 164.502(g)), a person authorized to make healthcare decisions for the patient is treated as the patient's "personal representative" and generally can access records within the scope of that authority without a separate HIPAA release. Present the HCPOA to the provider's medical records department.
• If there's no HCPOA: You'll need a court-appointed guardianship to gain personal representative status. This is one of the many reasons getting a HCPOA signed while your parent still has capacity is so critical.

Common Problems Missouri Caregivers Hit

Provider-specific forms: Large health systems like BJC HealthCare, Mercy, and SSM Health often ask caregivers to use their own internal HIPAA authorization form rather than a generic one. If your parent sees multiple providers, you may need to sign separate releases at each system. Ask whether the provider will accept a compliant third-party authorization; HIPAA does not require use of the provider's own form.

Mental health and substance use disorder carve-outs: Federal regulations (42 CFR Part 2) impose additional consent and disclosure protections for substance use disorder treatment records. A generic HIPAA release may not satisfy those Part 2 requirements, so ask the program what consent it requires.

Pharmacy records: Don't forget that pharmacies are covered entities under HIPAA too. If you need access to your parent's prescription history for Medicaid applications or medication management, include the pharmacy in your authorization.

Getting Ahead of the Problem

The single best time to handle HIPAA authorization is when your parent executes their healthcare power of attorney and advance directive. The Missouri Bar's combined form brings all three documents — HCPOA, living will, and HIPAA release — into one packet, so the same signing session can cover the stack; follow each part's own witness and notary instructions.

If your parent has already signed a HCPOA but skipped the HIPAA release, a standalone authorization can be signed at any time while they retain capacity. No notary is required for the HIPAA form itself, though some providers may request one.

Our Missouri Power of Attorney & Guardianship Kit includes step-by-step instructions for executing the full document stack — financial DPOA, healthcare POA, advance directive, and HIPAA authorization — along with a checklist for distributing copies to every provider, bank, and family member who needs one.

See more Missouri guides →