HIPAA doesn't stop doctors from talking to family. Providers may share details with a family member who helps with care, unless your parent objects. They generally must give access to a personal representative, such as an agent under a health care power of attorney. A signed HIPAA authorization helps when you need records or regular updates, or a provider asks for one. Medicare uses its own form, CMS-10106.
Key facts
- Under HIPAA, a provider or health plan can share details with a family member or friend who helps with a patient's care or pays for it, if the patient agrees, doesn't object, or the provider believes, using professional judgment, that the patient doesn't object. (HHS, 2022)
- HIPAA permits providers to share information with family but does not require it, unless the family member is the patient's personal representative. (HHS, 2022)
- A personal representative, such as an agent under a health care power of attorney, can generally see and get copies of the patient's health information. (HHS, 2020)
- Under 45 CFR 164.508, a HIPAA authorization must state an expiration date or event, carry the signer's signature and date, and say the signer can cancel it in writing. (Cornell LII, n.d.)
- Medicare's form CMS-10106, Authorization to Disclose Personal Health Information, is the written permission 1-800-MEDICARE must have before it can share a person's information with anyone else. (CMS, 2026)
The nurse says, "I'm sorry, I can't discuss that because of HIPAA." You're three states away, trying to find out whether your dad is being discharged tomorrow. Sometimes that answer is right, and sometimes there's an easy way through it. This post explains what HIPAA allows and the three ways to make sure providers can talk to you. It also covers what a valid authorization must contain and how to set it all up before a move.
What does HIPAA allow without a signed form?
More than most families think. The U.S. Department of Health and Human Services (HHS) says a provider or health plan can share details with family or friends who help with the patient's care or pay for it. That holds if the patient says it's fine or doesn't object. It also holds if the provider uses professional judgment and believes the patient doesn't object.
HHS gives everyday examples. A doctor can talk with the friend who comes to the hospital. A pharmacist can give a prescription to the person picking it up. Sometimes the patient isn't there, or is hurt and can't give permission. Then a provider may share details with family if it seems to be in the patient's best interest.
HIPAA permits this, but it doesn't require it. HHS is clear that providers don't have to share with family unless the family member is the patient's personal representative. So a careful nurse who says no isn't breaking a rule. That's why the routes below are worth setting up.
In the moment, a calm, specific request works better than an argument. You could try: "I understand. I'm her son and I'm helping with her care after discharge. She's told the doctor I can be included. Could you check her chart for that, or could we call her together so she can tell you herself?" If your parent is awake and able, a three-way call lets them give permission directly.
What are the ways to make sure providers can talk to you?
There are three, and they work best together. Each covers a different gap.
| Route | What it does | How to set it up | Limits |
|---|---|---|---|
| Your parent tells the provider you're involved | Lets staff discuss care with you when your parent agrees or doesn't object | Your parent says so at a visit or by phone, and asks that it be noted in the chart | Permitted but not required, so a provider can still decline |
| Written HIPAA authorization | Lets a specific provider disclose specific information to the people named | Your parent signs each provider's form, or a form that meets the federal requirements | One provider at a time, and it expires on the date or event stated |
| Personal representative | Gives you the right to see and get copies of your parent's health information, generally like your parent | You are named agent in a health care power of attorney, or have other legal authority to make health care decisions under state law | Tied to the legal authority, and state law can affect it |
The National Institute on Aging suggests giving permission ahead of time for doctors or lawyers to talk with a caregiver. It notes this is different from naming a health care proxy, who can only make decisions when the person can't communicate. Our post on power of attorney before an assisted living move covers the proxy side. If your parent may name more than one child, see whether two siblings can share power of attorney.
What does a valid HIPAA authorization include?
The federal rule (45 CFR 164.508) lists what an authorization must contain. Providers usually have their own form that covers these points. Still, it helps to know what to check before your parent signs:
- A specific, meaningful description of the information to be shared
- Who is allowed to share it (the provider)
- Who may receive it (you, and any siblings you want included, by name)
- The purpose, for which "at the request of the individual" is enough when your parent starts it
- An expiration date or an expiration event
- Your parent's signature and the date, or, if a personal representative signs, a description of their authority
The form must also say that your parent can cancel it in writing. It must say whether treatment can depend on signing it. And it must warn that shared details may no longer be protected by the rule. It has to be in plain language, and your parent gets a copy.
A few practical points. Name every family member who may call, so one sibling isn't the bottleneck. Don't leave the expiration blank. Think about when it should end. Keep a copy of every signed form in one shared folder. Also ask each provider whether its patient portal offers proxy access for a family member. If it does, ask what your parent has to sign to set it up.
How does Medicare's own authorization form work?
Medicare has a separate form for its helpline. It's CMS-10106, "Authorization to Disclose Personal Health Information." The form states that 1-800-MEDICARE must have your parent's written permission before it can share their information with anyone else.
- Your parent can send it online by logging in to their Medicare.gov account. The form calls this the faster route.
- Or mail it to: 1-800-MEDICARE Written Authorization Dept., PO Box 1270, Lawrence, KS 66044.
- Your parent can change or cancel it at any time by writing to the same address.
This form covers 1-800-MEDICARE only. Your parent may have a Medicare Advantage plan, a Part D plan or a supplement policy. If so, ask each company whether it needs its own form.
Get every permission signed before move-in day
Parent Move Plan puts the move's tasks, paperwork included, on real dates counted back from move-in day. In the plan, the Team and Fair Share tabs give siblings far away a real share of the work, measured in hours.
Get your first 3 days freeHow do you set this up before an assisted living move?
Do it in the first week of planning, while your parent can sign and before a hospital stay makes it urgent. The steps:
- List every provider: primary doctor, specialists, pharmacy, the hospital system, any home health agency.
- Ask your parent to tell each one that you're involved, at the next visit or by phone.
- Sign each provider's authorization form, naming every family member who may call.
- Submit CMS-10106 for 1-800-MEDICARE, and ask any plans about their forms.
- Give copies of a health care power of attorney, if there is one, to each provider.
- Sign the community's release. Community admission forms may include one. California's LIC 602A is one example. It has a section that lets the doctor release the medical report to the community, signed by the resident or their legal representative.
- Keep it together: one shared folder with every signed form, and a list of which provider has what.
Your parent could tell the doctor: "My daughter helps me with my care and she may call you. I'm fine with you talking to her about my health. Could you note that in my chart, and is there a form I should sign?"
These permissions go in the same folder as the rest of the admission papers, which are listed in documents you need for assisted living admission. They matter most during a hospital stay, when you need the discharge team's attention fast. Our post on what a discharge planner does explains that relationship. If you're helping from another state, moving a parent into assisted living from far away has more on staying in the loop. The full move sequence is in the moving-a-parent checklist.
Frequently asked questions
Can a doctor talk to a family member without a HIPAA authorization?
Often, yes. HHS explains that providers may share information with family or friends involved in a patient's care or payment if the patient agrees, doesn't object, or the provider believes, using professional judgment, that the patient doesn't object. HIPAA doesn't require them to share, though, unless you are the patient's personal representative.
Does a health care power of attorney give access to medical records?
Generally, yes. According to HHS, a person who can make health care decisions for the patient under a health care power of attorney is the patient's personal representative, and providers generally must let a personal representative inspect and get copies of the patient's health information. State law can affect this.
How do I get permission to talk to Medicare for my parent?
Your parent can sign Medicare's Authorization to Disclose Personal Health Information, form CMS-10106. It can be submitted online through your parent's Medicare.gov account or mailed to the address on the form, and your parent can cancel it in writing at any time.
What if my parent can't sign a HIPAA form?
When a patient isn't present or can't give permission, HHS says a provider may share information with family if it seems to be in the patient's best interest. For ongoing access to records, you would generally need legal authority to make health care decisions, such as a health care power of attorney. If none exists, an elder law attorney can explain the options, including guardianship.
What should a HIPAA authorization form to share medical information with family include?
The federal rule (45 CFR 164.508) says a valid authorization must describe the information to be shared, name who may share it and who may receive it, and state the purpose. It also needs an expiration date or event, plus your parent's signature and the date. The form must say that your parent can cancel it in writing, say whether treatment can depend on signing, and warn that shared details may no longer be protected. Providers usually have their own form that covers these points.
Can a nurse share patient information with family over the phone?
Often, yes, if the patient agrees or doesn't object, but HIPAA permits this and doesn't require it. A nurse who says no isn't breaking a rule. If your parent is awake and able, a three-way call lets your parent give permission directly, and your parent can also ask that your involvement be noted in the chart.
Sources
- HHS: HIPAA, Family Members and Friends (accessed Sept 2026)
- HHS: HIPAA, Personal Representatives (accessed Sept 2026)
- Cornell LII: 45 CFR 164.508, Uses and disclosures for which an authorization is required (accessed Sept 2026)
- CMS: Form CMS-10106, Authorization to Disclose Personal Health Information (accessed Sept 2026)
- NIA: Getting Your Affairs in Order Checklist (accessed Sept 2026)
- California Department of Social Services: LIC 602A, Medical Assessment for Residential Care Facilities for the Elderly (accessed Sept 2026)