What lets you speak for someone else at their appointment

The short version

Three things get called "being on the HIPAA form," and they're separate:

• Being told things. Being in the room, hearing the plan, asking questions. This one usually needs no paperwork at all.
• Getting records. Requesting a copy of the chart in your own name, without the patient there.
• Deciding things. Consenting to treatment, or refusing it, when the patient can't.

They come from different places. The first comes from the patient not objecting. The second comes from a signed authorization. The third comes from state law, and no form a practice hands you creates it.

People try to solve all three with one signature at the front desk, then find out at the worst moment that they solved only one.

You often don't need a form at all

This is the part almost nobody knows, and it's the part that resolves most day-to-day friction.

HIPAA lets a provider share information with a family member or friend who is involved in someone's care 45 CFR 164.510(b). If the patient is present and able to decide for themselves, the provider can share as long as the patient agrees, doesn't object when given the chance, or the provider can reasonably infer from the situation that they wouldn't mind. A patient bringing their daughter into the exam room and starting to talk is that inference.

No form. No advance registration. Just the patient not objecting, and the information being relevant to your involvement in their care.

It's permission, not obligation. A provider is allowed to share and can still decline, and some are cautious by disposition. But "HIPAA won't let me talk in front of your husband" is not a correct statement of the rule when the patient has said they want him there.

Where this runs out is the phone. Practices are far more careful with callers they can't see, and a great deal of caregiving happens by phone. That's the case for getting something in writing ahead of time.

The form that handles records and phone calls

A HIPAA authorization 45 CFR 164.508 is the signed document that lets a provider release information to a person the patient names. It's the thing people mean by "putting me on the HIPAA form," and it's what makes you a known quantity when you call.

The patient signs it, so it has to be done while they can. It names you, names what can be shared, and generally has an expiration. It can be revoked at any time, in writing.

Two things it does not do. It doesn't let you make decisions, and it doesn't carry across health systems. Each practice, hospital and health plan keeps its own, so the form on file at the primary care office does nothing at the hospital across town. If care is spread out, this needs doing more than once.

The one that lets you decide

To make decisions, you have to be what HIPAA calls a personal representative 45 CFR 164.502(g). That's a person with authority under state law to make health care decisions for someone. Where you have it, providers must treat you as if you were the patient for information relevant to that authority. Not "may share with." Treat as the patient.

HIPAA doesn't create this status. It defers to state law, which means the document that matters comes from outside the health system:

• A health care power of attorney, also called a health care proxy or agent depending on the state. Someone naming you while they're able to. This is the one to have.
• A court-appointed guardianship or conservatorship, when nobody was named in time and someone has to go to court. Slow, expensive, public, and avoidable with the paragraph above.
• Being the parent of a minor, in most circumstances.

Two near-misses cause real trouble:

• A financial power of attorney is usually not enough. The document that lets you handle a parent's bank account generally does not let you consent to their surgery. They're separate instruments in most states, and families discover the gap in an emergency department.
• A living will doesn't name a person. It records treatment wishes for specific circumstances. Valuable, and not the same as appointing someone. Many advance directive packets contain both, which is why they get conflated. Check that yours actually names an agent.

Being next of kin is not, by itself, this status. Many states have a default surrogate list that steps in when nobody was appointed, and the order and strength of those laws vary a great deal. It's a fallback, not a plan.

Children, and the year everything changes

Parents are generally their minor child's personal representative and can get records and make decisions. There are exceptions, and they're state-specific: where a minor can lawfully consent to a category of care on their own, where a court has authorized care, or where the parent has agreed to a confidential relationship between the child and the clinician. In those situations state law, not HIPAA, controls what a parent can see.

The one that surprises families is adolescence. Portal access that worked for years commonly narrows at 12 or 13, when a chunk of the record becomes confidential to the teenager under state law, and then ends at 18. At 18 your child is an adult, and unless they've signed something, you have no more access than a stranger. A college student going out of state is the standard cautionary version of this, and the fix is a health care proxy and an authorization signed before they leave.

Portal access is its own hurdle

Even with the right paperwork, the patient portal is a separate battle. Most systems support proxy or caregiver accounts, where you log in as yourself and see the patient's record, but setting one up is its own process with its own forms, often requiring the patient to initiate it from inside their own account.

It's worth doing properly. The common workaround, sharing a password and logging in as the patient, tends to break in ways that matter: messages you send appear to come from the patient, some systems detect and lock the account, and there's no record of who actually saw what. A proxy account also survives the patient becoming unable to help you set one up, which is exactly when you'll need it.

Set this up while things are calm. Every step of it is harder from a hospital room.

Veterans and the VA

The VA runs its own paperwork, and being set up at a community practice doesn't carry over to it.

• VA Form 10-0137 is the VA advance directive. It has a section naming a health care agent, and a living will section for treatment wishes. It's the document that establishes who can decide.
• VA Form 10-5345 authorizes the VA to release health information to a person or organization you name. It's the records-and-phone-calls form.

The direction matters. The VA's forms govern what the VA releases. A community care practice releasing records to you is governed by its own authorization, and by the ordinary HIPAA rules above. If you're managing care on both sides, expect to sign in both places.

The VA's caregiver programs are a separate track again, with their own eligibility and application, and being enrolled in one is not the same as having records access. Your local VA caregiver support coordinator is the person to ask.

Records moving from community care back to the VA is a distinct problem, and a common one. It's covered in its own guide.

After a death

Health information stays protected for 50 years after death. Access passes to the executor or administrator of the estate, or to whoever has authority under state law to act for the estate. A provider may also share information with family members who were involved in the person's care before they died, unless the patient had said they didn't want that.

In practice, the death certificate and the letters appointing an executor are what a records office will ask for. Requesting records early is easier than requesting them a year on, when the practice has changed systems.

Do this before you need it

Every one of these is easier to arrange on an ordinary Tuesday than during a hospitalization. If you're caring for someone, or expect to:

• A signed health care power of attorney, valid in the state where care happens. Naming a backup agent as well.
• A HIPAA authorization on file at each place they get care, including the hospital they'd be taken to.
• A proxy account set up on each portal.
• Copies you can actually reach: on your phone, not only in a drawer. A records office will take a photo of a signed document.
• A copy given to the practice in advance, and confirmation that it's in the chart. A document nobody has scanned in is a document that won't be found at 2am.

Then expect to be told no anyway, sometimes. Ask what specifically they need, ask for the privacy officer if the answer doesn't make sense, and be aware that "HIPAA doesn't allow it" is frequently a stand-in for "I'm not sure and I don't want to be the one who's wrong." Naming the document you hold usually moves it.