HIPAA and Sharing Information With Family: Consent and Access

Under HIPAA, a healthcare provider can share information with your family whenever you agree or don’t object, and when you can’t speak for yourself, the provider can still share what’s relevant to a family member’s involvement in your care using professional judgment. Written tools like authorization forms and healthcare powers of attorney make that access reliable rather than case-by-case. The specific rules shift depending on whether you’re present, incapacitated, a minor, or deceased, and a few categories of records carry stricter protections that apply even to close family.¹

When You Are Present and Able to Agree

If you’re at the appointment and capable of making decisions, a provider can talk to your family, friends, or anyone else involved in your care as long as you agree. That agreement doesn’t need a signature. Verbal permission works. So does simply not objecting when a family member is in the room during a medical conversation.² Bringing your spouse into the exam room while a doctor explains your test results is enough for the provider to reasonably infer you’re fine with them hearing it.

Practical care matters follow the same logic. A hospital can discuss your bill with the adult child who came with you and asked about charges, so long as you don’t object. A doctor can go over medication instructions with the friend driving you home from a procedure. The provider just needs to give you a reasonable chance to say no.

How Family Locates You in a Hospital

When you’re admitted, the hospital can list limited information in its facility directory: your name, your location in the building, your condition described in general terms like “stable” or “critical,” and your religious affiliation. Anyone who asks for you by name can be told your location and general condition. Clergy can also receive your religious affiliation.³

You can opt out of the directory entirely or restrict what’s included, and the hospital must tell you about the directory and give you a chance to object before listing you. If you arrive unconscious, the hospital can temporarily include you based on professional judgment about your best interest, then ask for your preference once you’re able to respond. One consequence worth knowing: if a worried family member calls asking about you but doesn’t know your name, the hospital cannot confirm you’re there.

When You Cannot Speak for Yourself

When a patient is unconscious, sedated, or otherwise unable to communicate, providers aren’t required to stay silent. The Privacy Rule lets them use professional judgment to decide whether sharing information with a family member or close friend serves the patient’s best interest.¹ An ER doctor can update a patient’s wife after a car accident even though the patient arrived unconscious and never had a chance to consent.

What gets shared has to be relevant to that person’s involvement in the care. A provider can tell you what prescription your sibling needs filled but can’t hand over their full medical history if it has nothing to do with the task at hand. A nurse who once discussed an unrelated past condition with the patient can’t repeat that information to a friend calling about the current hospitalization.

Phone Calls and Proof of Identity

HIPAA does not require a provider to demand proof that a caller is really a family member or friend. Providers set their own verification policies, and many hospitals use passwords or security questions, but federal law doesn’t mandate it.⁴ When the caller isn’t a family member or friend, the provider must be reasonably sure the patient asked that person to be involved in their care or payment before sharing anything.

No Documentation Needed in Emergencies

Family members sometimes worry they’ll be turned away from an emergency room because they can’t prove the relationship. In emergency and incapacity situations, HIPAA does not require family to produce identification or paperwork proving a relationship. The provider relies on the circumstances and professional judgment.⁵ That said, having a healthcare power of attorney or authorization form on file makes the conversation smoother, which is why setting those up in advance matters.

Written Tools That Guarantee Access

Relying on a provider’s professional judgment works in many situations, but it leaves room for inconsistency. One nurse might share freely; another on the next shift refuses. Formal written tools remove that ambiguity.

HIPAA Authorization Forms

A HIPAA authorization is a written document you sign that tells a provider exactly what information to share, with whom, and for what purpose. Federal regulations require plain language and specific elements: a description of the information covered, the name of the provider disclosing it, the name of the person receiving it, the purpose (if you’re initiating it, “at my request” is enough), an expiration date or event, and your signature and date.⁶

You can make the authorization broad or narrow. You could authorize a provider to share all your records with your spouse indefinitely, or limit it to specific lab results for a single consultation. You can revoke it in writing at any time, though revocation won’t undo disclosures the provider already made while the authorization was active. The form must also tell you that, generally, a provider cannot refuse to treat you just because you decline to sign.

Personal Representatives

A personal representative is someone who has legal authority under state law to make healthcare decisions for you. The most common route is a healthcare power of attorney, a document you sign while you’re competent that names someone to act on your behalf if you can’t. Under HIPAA, a personal representative “stands in your shoes” and has the same rights you would to access and control your health information.⁷

This is stronger than a standard authorization form. A personal representative can request records, receive updates from providers, and authorize further disclosures, all without a separate HIPAA authorization for each one. Providers must grant access to all health information relevant to the scope of the representative’s authority.⁸

Portal Access and Directed Copies

Many providers offer patient portals where records are available online. A personal representative can be granted “proxy” access, giving them ongoing electronic access to records, test results, and messages. Providers must use authentication controls to verify that the person logging in is actually you or your authorized representative.⁹

Even if a family member isn’t your personal representative, you can direct a provider to send copies of your health information to that person. The request must be in writing, signed, and clearly identify who should receive it and where. Providers should also accommodate standing requests so you don’t have to submit a new form every time.

Your Right to Restrict Sharing

HIPAA doesn’t only permit sharing with family. It also protects your right to limit it. You can ask any provider to restrict how they use or disclose your health information, including disclosures to specific family members. The provider must let you make the request, but in most cases is not required to agree to it.¹⁰

One situation forces a provider to honor your restriction. If you pay for a service entirely out of pocket and ask the provider not to share information about that service with your health plan for payment or operations purposes, the provider has to comply. Outside that narrow scenario, agreeing to a restriction is voluntary. If a provider does agree, it must follow the restriction except in a medical emergency.

Records With Stricter Rules

Two categories of health information carry extra protections that limit what providers can share with families, even when the patient has a personal representative or has given general permission.

Psychotherapy Notes

A therapist’s personal notes from counseling sessions, kept separately from the regular medical chart, are treated differently under HIPAA. These psychotherapy notes are excluded from the standard right of access, so even you, the patient, don’t have an automatic right to copies, and neither does your personal representative.¹¹ A provider needs a separate, specific authorization to release psychotherapy notes. General medical record authorizations don’t cover them.⁶

Regular mental health treatment records — diagnoses, medications, treatment plans — in the medical chart are not psychotherapy notes and follow the normal HIPAA sharing rules.

Substance Use Disorder Records

Records from federally assisted substance use disorder treatment programs are governed by a separate federal regulation, 42 CFR Part 2, which imposes stricter consent requirements than standard HIPAA. A patient generally must provide written consent that names the specific person receiving the information, describes what will be shared, and states the purpose.¹²

The gap widens when a patient is incapacitated. Under standard HIPAA, a provider can share with family based on professional judgment about the patient’s best interest. Under Part 2, for an incapacitated adult who hasn’t been declared incompetent by a court, the program director can only consent to disclosure for the limited purpose of obtaining payment from a health plan. For minors in substance use treatment, if state law allows the minor to consent to treatment without a parent, only the minor can consent to sharing records. If state law requires parental consent for treatment, both the minor and the parent must consent to disclosure.

Sharing to Prevent Serious Harm

Even without the patient’s consent, a provider can share health information when they believe in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to someone’s health or safety. The disclosure must go to someone reasonably able to prevent or reduce the threat, which can include a family member.¹³

In mental health contexts, this matters. If an adult patient who may be a danger to themselves stops attending therapy, the therapist can contact a family member to check on the patient’s well-being if the therapist determines there may be an emergency or the contact is needed to reduce a serious and imminent threat. The therapist can share only what the family member needs to help address the situation.¹⁴

Parents and Minor Children

Parents are generally treated as personal representatives of their minor children, with full access to the child’s records, because parents typically have legal authority to make healthcare decisions for their kids.¹⁵ Three exceptions strip a parent of personal representative status for certain records:

When state law allows a minor to consent to treatment on their own (common for reproductive health, some mental health services, and treatment for sexually transmitted infections), the parent is not the personal representative for records related to that care.
When a minor receives treatment at the direction of a court or a court-appointed individual, the parent is not the personal representative for those records.
When a parent agrees that the child and provider may have a confidential relationship, the parent’s access is limited to the scope of that agreement.

The ages at which minors can consent to their own care vary by state, typically falling between 12 and 18 depending on the type of treatment. Outside these specific exceptions, a provider cannot add extra restrictions on a parent’s access beyond what state law requires.

Divorced Parents

Divorce does not automatically change either parent’s HIPAA rights. Both parents generally remain personal representatives of a minor child unless a court order or separation agreement specifically strips one parent of that authority. Providers should look to the custody order or divorce decree for guidance. Sole custody, standing alone, does not necessarily eliminate the other parent’s right to access medical records unless the court order says so explicitly.¹⁵

When a Provider Can Refuse a Personal Representative

Legal authority as a personal representative isn’t absolute. A provider can refuse to treat someone as a personal representative if the provider reasonably believes the patient has been or may be subjected to domestic violence, abuse, or neglect by that person, or if granting access could endanger the patient. This requires an individualized, case-specific professional judgment that honoring the representative’s access would not be in the patient’s best interest.⁷

The protection applies to adults and minors alike. A physician who suspects a parent is abusing a child can decline to give that parent access to the child’s records. A provider who suspects an agent under a power of attorney is exploiting an elderly patient can refuse to share information with that agent.

After the Patient’s Death

HIPAA protections don’t end at death. A deceased individual’s health information remains protected for 50 years after death.¹⁶ During that period, a provider can share relevant information with family members who were involved in the patient’s care or payment before death, unless the deceased had previously expressed an objection.¹⁷

The executor or administrator of the estate is treated as the personal representative and can access health information relevant to settling the estate. Providers can also disclose information to coroners, medical examiners, and funeral directors as needed for their duties, without requiring family consent.

Fees for Copies of Records

When you or your personal representative requests copies of records, a provider can charge a reasonable, cost-based fee, but federal rules limit what that fee can include. The provider may charge for the labor of copying the records, the cost of supplies like paper or a USB drive, postage if you asked for mailed copies, and preparation of a summary if you agreed to one in advance.⁹

Providers cannot charge for searching for and retrieving your records, maintaining their systems, or verifying your identity. Those costs are explicitly prohibited, even if state law would otherwise allow them. For electronic records, the fee is limited to the labor of creating and delivering the copy and cannot include search-and-retrieval time. If a provider quotes you a fee that seems to bundle in administrative overhead, you have grounds to push back.

Filing a Complaint

If you believe a provider has improperly denied you access to a family member’s records when you have a legal right to them, or has shared information they shouldn’t have, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. The complaint must be filed within 180 days of when the violation occurred, though OCR can extend that deadline for good cause.¹⁸

You can file through the OCR Complaint Portal online, by email to OCRComplaint@hhs.gov, or by mailing a written complaint to the HHS Office for Civil Rights in Washington, D.C. The complaint needs to identify the provider, describe what happened, and explain how you believe the privacy rules were violated. If you’re filing on behalf of someone else, you’ll also need to provide that person’s name. Providers who violate HIPAA face civil penalties that scale with how culpable they were.¹⁹

1
HHS.gov. If the Patient Is Not Present or Is Incapacitated, May a Health Care Provider Still Share the Patient’s Health Information
2
HHS.gov. Disclosures to Family and Friends
3
GovInfo. 45 CFR 164.510 – Uses and Disclosures Requiring an Opportunity for the Individual to Agree or to Object
4
HHS.gov. If a Patient’s Family Member, Friend, or Other Person Involved in the Patient’s Care Calls a Health Care Provider, Does HIPAA Require Proof of Identity
5
HHS.gov. Summary of the HIPAA Privacy Rule
6
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
7
HHS.gov. Personal Representatives
8
HHS.gov. Personal Representatives
9
U.S. Department of Health & Human Services. Individuals’ Right Under HIPAA to Access Their Health Information
10
HHS.gov. Under HIPAA, May an Individual Request That a Covered Entity Restrict How It Uses or Discloses That Individual’s Protected Health Information
11
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
12
eCFR. Part 2 – Confidentiality of Substance Use Disorder Patient Records
13
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
14
HHS.gov. Additional FAQs on Sharing Information Related to Treatment for Mental Health or Substance Use Disorder
15
U.S. Department of Health & Human Services. The HIPAA Privacy Rule and Parental Access to Minor Children’s Medical Records
16
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information General Rules
17
HHS.gov. Health Information of Deceased Individuals
18
HHS.gov. How to File a Health Information Privacy or Security Complaint
19
Office of the Law Revision Counsel. 42 USC 1320d-5 – General Penalty for Failure to Comply With Requirements and Standards