How to Request Medical Records for an Elderly Parent

Your parent's new cardiologist needs records from the primary care physician. The primary care office says they cannot release anything without a signed authorization. Your parent has moderate dementia and cannot sign anything. You have a healthcare power of attorney, but the records clerk says they've never seen one before and asks you to come back another day. This loop can repeat for weeks — unless you know exactly which forms to submit, which federal regulation gives you the right to those records, and how to escalate when a clerk stalls.

Your Legal Right to the Records

HIPAA — the Health Insurance Portability and Accountability Act — does not block caregiver access to medical records. It creates specific pathways for it. Which pathway applies depends on whether your parent retains cognitive capacity.

If your parent has capacity: They can sign a HIPAA authorization form directing the provider to release records to you. This is the simplest route. The authorization must specify what records to release, who receives them, the purpose, an expiration date, and the patient's right to revoke. Your parent can also use the Directed Right to Access under 45 CFR § 164.524, which requires the provider to send a designated record set directly to a third party (you) within 30 calendar days.

If your parent lacks capacity: A caregiver holding an activated healthcare power of attorney, healthcare proxy, or court-appointed guardianship is recognized as the patient's "personal representative" under 45 CFR § 164.502(g). As a personal representative, you legally stand in the shoes of the patient — meaning you have the same right to request, receive, and authorize disclosure of medical records as the patient would.

If you have no legal documentation: Most states have default surrogate decision-making laws that recognize a hierarchy of next-of-kin (typically spouse first, then adult children) authorized to access medical information and make healthcare decisions. However, relying on default surrogacy is significantly slower and more friction-prone than submitting formal documentation.

The Step-by-Step Request Process

Step 1: Identify what you need. Before contacting the records office, list the specific records you need: lab results, imaging reports, consultation notes, medication history, discharge summaries, or the complete medical record. Targeted requests are processed faster than blanket "send everything" requests and cost less if the provider charges per-page copying fees.

Step 2: Contact the Health Information Management (HIM) department. Call the facility — not the doctor's office front desk — and ask for the medical records or HIM department directly. Request their specific release-of-information form. Every health system has its own form, and submitting the facility's preferred form eliminates processing delays.

Step 3: Complete and submit the authorization. If your parent has capacity, they sign the facility's authorization form. If your parent lacks capacity, you sign as their personal representative and attach a copy of the activated healthcare POA or guardianship order, plus your government-issued photo ID. Submit everything together — the authorization, the legal documentation, and the ID — in a single packet. Splitting the submission across multiple visits creates filing gaps.

Step 4: Confirm receipt and set a deadline. Under HIPAA's right of access rule, the covered entity must provide the requested records within 30 calendar days. They may request a single 30-day extension if they notify you in writing with the reason for the delay. In practice, most facilities process targeted requests within 5 to 10 business days.

Step 5: Specify the format. You have the right to request records in the format of your choice — paper copies, electronic PDF, or through the patient portal — and the provider must comply if the format is readily producible. Electronic delivery is fastest and avoids per-page copying fees. HIPAA allows only reasonable, cost-based fees for paper copies; electronic transfers through existing systems are typically $0.

Common Roadblocks and How to Clear Them

The clerk says they need the patient's signature, not yours. Politely cite 45 CFR § 164.502(g) and explain that as the patient's personal representative, your signature carries the same legal weight as the patient's. Hand them a copy of the healthcare POA. If they persist, ask to speak with the HIM department supervisor or the facility's privacy officer.

The provider wants to charge excessive fees. HIPAA allows reasonable, cost-based fees for copying — labor, supplies, and postage. It does not allow flat per-page fees that exceed the actual cost. If a facility quotes a paper-copy fee that seems excessive, or any fee for electronic records delivered via existing portal infrastructure, request an itemized breakdown and cite the HHS Office for Civil Rights guidance on reasonable fees.

Records from a deceased provider or closed practice. State medical boards maintain records of closed practices and can direct you to the custodian of the records. The custodian is legally obligated to maintain records for the state-mandated retention period (typically 7 to 10 years) and must process access requests under the same HIPAA rules as an active practice.

The hospital says records are "privileged" or restricted. Providers may withhold psychotherapy notes (which are maintained separately from the medical record), records compiled for use in litigation, and records where the provider believes disclosure could endanger the patient. They may not withhold standard clinical records, lab results, imaging, or consultation notes based on a general claim of privilege.

Transferring Records Between Providers

When you are coordinating care across multiple specialists, the most efficient method is a provider-to-provider records transfer. Ask the sending provider's office to fax or electronically transmit records directly to the receiving provider using a standard medical release form. This avoids the intermediary step of receiving the records yourself and physically delivering them.

Initiate transfers within five business days of any specialist consultation. Delays in record transfers are one of the leading causes of care fragmentation in geriatric medicine — a cardiologist adjusting a medication without knowing what the nephrologist prescribed last week is exactly the kind of error that structured record management prevents.

The Caregiver's Guide to Doctor Communication includes a complete legal onboarding checklist for establishing record access across every provider in your parent's care network, plus a specialist coordination workbook for tracking which records have been sent where.