HIPAA doesn't stop doctors from talking to family. Providers may share information with a family member involved in your parent's care unless your parent objects, and they generally must give access to a personal representative, such as an agent under a health care power of attorney. A signed HIPAA authorization helps when you need records or regular updates, or a provider asks for one. Medicare uses its own form, CMS-10106.
The nurse says, "I'm sorry, I can't discuss that because of HIPAA," and you're three states away, trying to find out whether your dad is being discharged tomorrow. Sometimes that answer is right, and sometimes there's a simple way through it. This post explains what HIPAA actually allows, the three ways to make sure providers can talk to you, what a valid authorization must contain, and how to set it all up before a move.
What does HIPAA allow without a signed form?
More than most families think. The U.S. Department of Health and Human Services (HHS) explains that a provider or health plan can share information with family or friends if they are involved in the patient's care or payment for care, and the patient says it's fine, doesn't object, or the provider believes, using professional judgment, that the patient doesn't object.
HHS gives everyday examples: a doctor can talk with the friend who comes to the hospital, and a pharmacist can give a prescription to the person picking it up. When the patient isn't there or is injured and can't give permission, a provider may share information with family if it seems to be in the patient's best interest.
The catch: HIPAA permits this, but doesn't require it. HHS is explicit that providers don't have to share information with family unless the family member is the patient's personal representative. So a cautious nurse saying no isn't breaking a rule, and that's why the routes below are worth setting up.
In the moment, a calm, specific request works better than an argument. What to say to the nurse: "I understand. I'm her son and I'm helping with her care after discharge. She's told the doctor I can be included. Could you check her chart for that, or could we call her together so she can tell you herself?" If your parent is awake and able, a three-way call lets them give permission directly.
What are the ways to make sure providers can talk to you?
There are three, and they work best together. Each covers a different gap.
| Route | What it does | How to set it up | Limits |
|---|---|---|---|
| Your parent tells the provider you're involved | Lets staff discuss care with you when your parent agrees or doesn't object | Your parent says so at a visit or by phone, and asks that it be noted in the chart | Permitted, not required; a provider can still decline |
| Written HIPAA authorization | Lets a specific provider disclose specific information to the people named | Your parent signs each provider's form, or a form that meets the federal requirements | One provider at a time; expires on the date or event stated |
| Personal representative | Gives you the right to see and get copies of your parent's health information, generally like your parent | You are named agent in a health care power of attorney, or have other legal authority to make health care decisions under state law | Tied to the legal authority; state law can affect it |
The National Institute on Aging suggests giving permission in advance for doctors or lawyers to talk with a caregiver, and notes it is different from naming a health care proxy, who can only make decisions when the person can't communicate. Our post on power of attorney before an assisted living move covers the proxy side.
What does a valid HIPAA authorization include?
The federal rule (45 CFR 164.508) lists what an authorization must contain. Providers usually have their own form that covers these, but it helps to know what to check before your parent signs:
- A specific, meaningful description of the information to be shared
- Who is allowed to disclose it (the provider)
- Who may receive it (you, and any siblings you want included, by name)
- The purpose; "at the request of the individual" is enough when your parent initiates it
- An expiration date or an expiration event
- Your parent's signature and the date, or, if a personal representative signs, a description of their authority
The form must also state that your parent can revoke it in writing, whether treatment can be conditioned on signing it, and that information shared may no longer be protected by the rule. It must be in plain language, and your parent gets a copy.
Practical tips: name every family member who may call, so one sibling isn't the bottleneck; think about the expiration the form asks for rather than leaving it blank; and keep a copy of every signed form in one shared folder. Also ask each provider whether its patient portal offers proxy access for a family member, and what your parent has to sign to set it up.
How does Medicare's own authorization form work?
Medicare has a separate form for its helpline: CMS-10106, "Authorization to Disclose Personal Health Information." The form states that 1-800-MEDICARE must have your parent's written permission before it can share their information with anyone else.
- Your parent can submit it online by logging in to their Medicare.gov account, which the form describes as the faster route.
- Or mail it to: 1-800-MEDICARE Written Authorization Dept., PO Box 1270, Lawrence, KS 66044.
- Your parent can change or cancel it at any time by writing to the same address.
This form covers 1-800-MEDICARE only. If your parent has a Medicare Advantage plan, a Part D plan or a supplement policy, ask each company whether it needs its own form.
One folder, every permission, before move day
Parent Move Plan puts the move's tasks, paperwork included, on real dates counted back from move-in day. In the Complete plan, the Team and Fair Share tabs give siblings far away a real share of the work, measured in hours.
Build your plan in 2 minutesHow do you set this up before an assisted living move?
Do it in the first week of planning, while your parent can sign and before a hospital stay makes it urgent. The steps:
- List every provider: primary doctor, specialists, pharmacy, the hospital system, any home health agency.
- Ask your parent to tell each one that you're involved, at the next visit or by phone.
- Sign each provider's authorization form, naming every family member who may call.
- Submit CMS-10106 for 1-800-MEDICARE, and ask any plans about their forms.
- Give copies of a health care power of attorney, if there is one, to each provider.
- Sign the community's release. Community admission forms may include one; California's LIC 602A, for example, has a section authorizing the doctor to release the medical report to the community, signed by the resident or their legal representative.
- Keep it together: one shared folder with every signed form, and a list of which provider has what.
What your parent can say to the doctor: "My daughter helps me with my care and she may call you. I'm fine with you talking to her about my health. Could you note that in my chart, and is there a form I should sign?"
These permissions go in the same folder as the rest of the admission papers; see documents you need for assisted living admission. They matter most during a hospital stay, when you need the discharge team's attention fast; what a discharge planner does explains that relationship. If you're coordinating from another state, moving a parent into assisted living from far away has more on staying in the loop. The full move sequence is in the moving-a-parent checklist.
Frequently asked questions
Can a doctor talk to a family member without a HIPAA authorization?
Often, yes. HHS explains that providers may share information with family or friends involved in a patient's care or payment if the patient agrees, doesn't object, or the provider believes, using professional judgment, that the patient doesn't object. HIPAA doesn't require them to share, though, unless you are the patient's personal representative.
Does a health care power of attorney give access to medical records?
Generally, yes. According to HHS, a person who can make health care decisions for the patient under a health care power of attorney is the patient's personal representative, and providers generally must let a personal representative inspect and get copies of the patient's health information. State law can affect this.
How do I get permission to talk to Medicare for my parent?
Your parent can sign Medicare's Authorization to Disclose Personal Health Information, form CMS-10106. It can be submitted online through your parent's Medicare.gov account or mailed to the address on the form, and your parent can cancel it in writing at any time.
What if my parent can't sign a HIPAA form?
When a patient isn't present or can't give permission, HHS says a provider may share information with family if it seems to be in the patient's best interest. For ongoing access to records, you would generally need legal authority to make health care decisions, such as a health care power of attorney. If none exists, an elder law attorney can explain the options, including guardianship.
Sources
- HHS: HIPAA, Family Members and Friends (accessed Sept 2026)
- HHS: HIPAA, Personal Representatives (accessed Sept 2026)
- Cornell LII: 45 CFR 164.508, Uses and disclosures for which an authorization is required (accessed Sept 2026)
- CMS: Form CMS-10106, Authorization to Disclose Personal Health Information (accessed Sept 2026)
- NIA: Getting Your Affairs in Order Checklist (accessed Sept 2026)
- California Department of Social Services: LIC 602A, Medical Assessment for Residential Care Facilities for the Elderly (accessed Sept 2026)