Attorney Referral Most people know that HIPAA is a federal privacy law that protects medical information. What most people don't know is exactly how it creates a practical problem for their family during a medical crisis — and that there is a simple document, separate from a Healthcare Proxy, that fixes it. Here is the specific problem: a Healthcare Proxy typically activates only after a physician formally documents that you lack the capacity to make medical decisions. Until that threshold is crossed, you are legally considered capable — even if you are unconscious in the ICU, even if you are
The Health Insurance Portability and Accountability Act — HIPAA — was enacted in 1996 to protect the privacy of individually identifiable health information. Under the HIPAA Privacy Rule, health care providers are prohibited from sharing a patient's medical information with any person who is not: the patient, a person the patient has formally authorized, or a "Personal Representative" as defined under state law. A spouse or family member is not automatically authorized. "Next of kin" status does not grant HIPAA access. Even an adult child who has lived with a parent for years and handles all of their daily affairs has no legal right to receive medical information about that parent without written authorization. A Healthcare Proxy often only activates once a physician documents incapacity. Before that determination is made — which can take hours or days during a hospitalization — the proxy holder has no more legal access to medical information than a stranger. An adult daughter calling from out of state to ask about her father's stroke is routinely told the hospital cannot share information. Not because the staff is being difficult. Because the law requires it.
A standalone HIPAA Authorization is a separate document that specifically names the individuals who are permitted to receive your medical information, regardless of your current capacity. It is not a healthcare decision document — it does not grant anyone authority to make medical choices for you. It simply authorizes disclosure. With a HIPAA Authorization in place, the people you name — a spouse, an adult child, the person named in your Healthcare Proxy, a sibling who lives out of state — can call the hospital and receive information about your diagnosis, your treatment, your stability, and your prognosis. They can be kept in the loop without you being formally declared incapacitated. They can make travel and care arrangements based on accurate information instead of guesswork. The authorization can be embedded in the Healthcare Proxy document or prepared as a standalone form. Either approach works, as long as it is presented to the relevant providers.
Under the HIPAA Privacy Rule, a person who has authority under state law to make healthcare decisions for another person may be treated as that person's "Personal Representative" — and Personal Representatives do receive full HIPAA access. An active Healthcare Proxy generally qualifies. But "generally" is doing real work in that sentence. The Healthcare Proxy is active only once the physician formally documents incapacity. And in practice, the administrative process of confirming that a proxy has been activated — presenting the document to hospital staff, waiting for it to be reviewed by the medical records department, having it entered into the patient's chart — takes time. During that process, family members may be denied information. A standalone HIPAA Authorization sidesteps this friction entirely. It does not depend on incapacity being declared. It is simply a standing authorization that takes effect immediately and remains in place.
Function Healthcare Proxy HIPAA Authorization Primary purpose Authorizes a person to Authorizes specific make healthcare decisions people to receive medical information When it activates When physician documents Immediately upon signing; incapacity no trigger required Who can be named One primary agent (plus Any number of individuals successor) What it allows Consenting to/refusing Receiving medical treatments; directing information, records, and care updates HIPAA access during Not until incapacity is Yes — immediately upon initial crisis formally documented presentation to provider Source: HIPAA Privacy Rule (45 CFR Part 164); Frank & Kraft — HIPAA Authorization vs. Healthcare POA; AccountableHQ.com; Unsworth LaPlante
Most estate planning attorneys include a HIPAA Authorization as part|Proxy and Living Will. If yours was prepared without one, it is a
HIPAA Privacy Rule (45 CFR Part 164); Frank & Kraft — HIPAA