Can a Doctor Share Your Parent's Medical Information With You?

One of the most frustrating moments in elder care is calling a doctor's office or hospital and being told they can't discuss your parent's condition because of HIPAA. Sometimes that's correct. Often it isn't. This page explains the rules — including the exceptions that apply when a family member is in danger.

The Baseline: HIPAA Protects Patient Privacy

The Health Insurance Portability and Accountability Act (HIPAA) gives patients the right to control who receives their medical information. Healthcare providers — doctors, hospitals, nursing homes, pharmacies — generally cannot share a patient's health information with family members without the patient's authorization.

This applies even to adult children, even to spouses, and even in urgent situations — with important exceptions.

When a Family Member CAN Receive Medical Information

1. The Patient Has Given Permission

If your parent has capacity, they can authorize you to receive medical information in several ways:

HIPAA Authorization Form: The provider's standard form designating you as someone who may receive information
Health Care Power of Attorney: If your parent has executed a health care POA naming you as agent, that document authorizes you to make health care decisions and receive health information on their behalf
Verbal authorization in the provider's presence: If the patient tells the provider directly "you can talk to my daughter about this," the provider may act on that

Once you're designated, providers can discuss the patient's condition, treatment, and records with you.

2. The Patient Lacks Capacity and You Are the Health Care Agent

If your parent is incapacitated and you hold a valid health care power of attorney, your authority to receive medical information and make health care decisions is legally established. Provide the POA document to each provider — the hospital, the specialist, the nursing home, the primary care physician — and ask that it be placed in the chart.

If your parent is incapacitated and there is no health care POA, you may need to seek guardianship to establish formal legal authority.

3. The Provider Determines Disclosure Is in the Patient's Best Interest

HIPAA's Privacy Rule (45 C.F.R. § 164.510(b)) allows providers to disclose information to family members when it is directly relevant to that person's involvement in the patient's care, and when the provider determines disclosure is in the patient's best interest — even without explicit patient authorization.

This is a judgment call that providers make routinely. Providers are often more cautious than the law requires. You can remind them of this provision.

4. The Serious and Imminent Threat Exception

45 C.F.R. § 164.512(j) allows a provider to disclose protected health information to prevent or lessen a serious and imminent threat to the health or safety of the patient or others — even without authorization.

This exception is narrow but important. If your parent's life is in immediate danger and a provider has information that is necessary to protect them, HIPAA does not prevent disclosure.

In practice, this exception is most relevant when a patient is refusing care and family members believe the refusal puts the patient's life at risk, or when a patient has communicated something to a provider that suggests immediate self-harm.

What HIPAA Does NOT Prohibit

There are common misconceptions about what HIPAA actually prevents. It does not prohibit:

A doctor from listening to information you provide about a patient
A provider from confirming or denying whether a patient is being treated (in most cases)
A provider from sharing information with someone the patient has previously identified as a contact
Communication with family members who are clearly involved in the patient's ongoing care, where the patient is present and does not object

If you are actively helping coordinate a parent's care — attending appointments, managing medications, communicating with providers — most healthcare settings will share necessary information as a matter of practical necessity. HIPAA does not require providers to obstruct family involvement.

When a Provider Says "We Can't Tell You Anything"

If a provider refuses to give you any information, ask specifically:

"Is my parent's health care POA on file?" If yes, your authority should be clear. If no, submit it.
"Are you declining under HIPAA?" Ask them to identify the specific provision they're applying.
"Can you tell me whether my parent is safe?" A provider can typically confirm whether a patient is receiving care and is stable, even if they won't give details.

If a provider is genuinely blocking access to information you have a legal right to receive — because you hold a valid health care POA — you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

The Practical Reality

HIPAA is frequently over-applied in clinical settings. Staff training is inconsistent. Many refusals are the result of caution, not legal requirement.

The most reliable way to ensure you have access to your parent's medical information is to have a health care power of attorney properly documented with every provider your parent sees — before a crisis happens.

If you're already in a crisis and don't have documentation, be persistent, ask to speak with the patient advocate or hospital ethics liaison, and document every interaction.

The information on this page is for educational purposes only and does not constitute legal advice. Please consult a licensed North Carolina attorney for guidance specific to your situation. Learn more about ElderAdvocate.law.

When the Current POA Agent Is Blocking Information Access

A situation that doesn't get enough attention: you are the successor POA agent, or you are an adult child with legitimate concern about your parent's care — and the current POA agent is refusing to share medical information or has instructed providers not to communicate with you.

What the current POA agent can and cannot do under HIPAA:

Under HIPAA, a POA agent who is legally authorized to make healthcare decisions is treated as the patient's "personal representative" for medical information purposes (45 C.F.R. § 164.502(g)). This gives the agent authority to access medical records and authorize or deny disclosure.

What this does not mean: the agent cannot instruct providers to withhold information from family members in ways that endanger the patient or constitute abuse. HIPAA's personal representative rule does not create a right to control all information flow — it addresses the agent's own access rights.

If you are a named successor POA agent:

Your succession rights depend on the document terms. If the triggering conditions have been met, you may have the legal authority to access medical records as personal representative — which supersedes the prior agent's authority. Get a formal written invocation of your succession documented and present it to the healthcare provider.

If you are an adult child without POA authority:

You may still have access under limited circumstances:

If the patient lacks capacity and there is no authorized agent, providers may share information with involved family members under 45 C.F.R. § 164.510(b) — the "involvement in care" provision
If the patient themselves has previously authorized sharing with you (a release signed while the patient had capacity)
If you are pursuing guardianship and need medical records for the proceeding — a subpoena or court order will compel production regardless of the agent's instructions

The nuclear option: APS referral. If the information blackout is part of a pattern of isolation and you believe the patient is being abused or exploited, APS can conduct an investigation that includes access to care records regardless of the agent's instructions.