Medicare Authorization to Disclose: How Caregivers Get Access to a Parent's Records

You called Medicare to ask about your parent's home health claim, and the representative told you they can't discuss anything without authorization on file. Meanwhile, the appeal deadline is ticking.

This is the single most common roadblock caregivers hit when trying to manage a parent's Medicare benefits. The fix is a specific federal form — the CMS-10106, formally titled "Authorization to Disclose Personal Health Information" — and it takes about fifteen minutes to complete correctly.

What the CMS-10106 Does (and What It Doesn't)

The CMS-10106 is Medicare's own authorization form. It allows a beneficiary (your parent) to designate a person or organization to receive personal health information from 1-800-MEDICARE. It does not itself authorize a provider, Medicare Administrative Contractor, or Quality Improvement Organization to release records.

This is different from a general HIPAA release. A hospital or doctor's office HIPAA authorization lets you access clinical records at that specific provider. The CMS-10106 covers information released by 1-800-MEDICARE — such as Medicare eligibility, claims, plan enrollment, premium payments, and other information selected on the form.

You may need both. A HIPAA release gets you into the medical chart at that provider. The CMS-10106 gives 1-800-MEDICARE permission to share Medicare information with you; it does not itself appoint you to file appeals or access a provider's records.

How to Complete the Form

The CMS-10106 is a three-page form available on cms.gov. Here's what each section requires:

Section 1 — Beneficiary Information. Your parent's full legal name, Medicare Beneficiary Identifier (MBI — the 11-character alphanumeric code on their red-white-and-blue Medicare card), date of birth, and mailing address.

Section 2 — Authorized Recipient. Your full legal name or organization name and mailing address. If you are signing as a personal representative because your parent cannot sign, complete the personal-representative fields, including your relationship and contact information, and attach paperwork showing your legal authority, such as a durable power of attorney; if your parent signs, they can name you without a power of attorney.

Section 3 — Scope of Disclosure. Choose "Any information" or "Limited information." For limited disclosure, check the applicable categories, such as Medicare eligibility, claims, plan enrollment, and premium payments; use the "Other" field for additional information your parent wants shared.

Section 4 — Duration. The authorization can be set for a specific time period or left open until revoked. For an aging parent with ongoing care needs, an open-ended authorization prevents you from having to refile every few months.

Section 5 — Signature. Your parent or personal representative must sign and date the form. If you sign as the personal representative, attach a copy of the paperwork showing your legal authority.

Where to Submit It

Submit the completed form online through a secure Medicare.gov account or mail it to: 1-800-MEDICARE Written Authorization Department, PO Box 1270, Lawrence, KS 66044. Use the current form instructions for the submission method and address.

Keep a copy. When you call Medicare, reference the form by your parent's MBI and the date you submitted it. Processing can take time, so file this well before you need it — not the day an appeal is due.

When You Need It Most

Three situations where having this authorization already on file saves critical time:

Filing a NOMNC appeal. When a home health agency issues a Notice of Medicare Non-Coverage, you have until noon the day before services end to file a fast appeal with the BFCC-QIO. The fast-appeal deadline still applies even if this authorization has not yet been processed, so contact the QIO immediately rather than waiting for it.

Requesting a coverage redetermination. If Medicare denies a home health claim — say the MAC determines your parent doesn't meet the homebound requirement — you have 120 days to request a redetermination. The CMS-10106 gives 1-800-MEDICARE permission to share information; it does not itself appoint you to act for the MAC, so follow the MAC's instructions for representative status, requesting the claim file, and submitting supporting documentation.

Coordinating with the home health agency. Agencies often need to verify that you're authorized to receive clinical updates and participate in care planning. Having a HIPAA authorization on file with the agency — not just the CMS-10106 — eliminates the back-and-forth that delays care plan adjustments.

The Authorization Stack Every Caregiver Needs

The CMS-10106 is one piece of a broader authorization framework. Depending on what you need to do, you may also use a HIPAA authorization with each provider (hospitals, physicians, and the home health agency). A durable power of attorney for healthcare decisions is relevant if your parent cannot make those decisions, and a financial power of attorney may help if you're managing medical bills; these are separate from the CMS-10106.

Our Medicare Home Health and Skilled Nursing Benefit guide includes the complete authorization checklist, pre-written appeal templates for NOMNC and coverage denials, and a Jimmo citation letter for maintenance therapy disputes — everything you need to manage the administrative side of a parent's Medicare home health benefit without waiting weeks for callbacks.

File the CMS-10106 now, before a crisis forces you to scramble. The fifteen minutes it takes today can save days of frustration when a coverage decision goes sideways.

See more United States guides →