Helping an aging parent manage medical care can feel like taking an unpaid administrative job with no training manual and an alarming number of fax machines. You may need to review test results, reconcile medications, question a bill, appeal a coverage decision, or simply figure out what happened during an appointment. Then a receptionist says, “We cannot speak with you because of HIPAA,” and the conversation stops faster than a pharmacy drive-through window at lunchtime.
The good news is that accessing a parent’s medical records is possible when the proper permissions are in place. The important catch is that being someone’s adult child, caregiver, emergency contact, or favorite person to call when the printer misbehaves does not automatically give you legal access.
You also need to separate two different information systems. A hospital or physician maintains the clinical medical record. Medicare maintains coverage, enrollment, claims, billing, and payment information. Permission to discuss one does not necessarily unlock the other.
This guide explains how HIPAA authorization, patient portal proxy access, health care power of attorney, Medicare representative forms, and caregiver assistance can work together.
What Does “Accessing a Parent’s Medical Records” Mean?
The phrase can refer to several different tasks. Identifying the task first will help you avoid completing the wrong forma surprisingly popular American health care tradition.
Accessing the provider’s clinical record
A doctor, hospital, laboratory, pharmacy, home health agency, or other provider may hold information such as:
- Office notes and hospital discharge summaries
- Medication and allergy lists
- Laboratory and imaging results
- Diagnoses, treatment plans, and procedure reports
- Billing and payment records
- Referral and consultation reports
Access to this information is primarily governed by HIPAA, applicable state law, and the provider’s identity-verification procedures.
Accessing Medicare information
Medicare information may include claims, Medicare Summary Notices, coverage decisions, premiums, deductibles, enrollment details, and payment history. Medicare claims can show which services were billed, what Medicare approved, what Medicare paid, and what the beneficiary may owe.
Claims are useful, but they are not a substitute for a complete medical chart. A claim may reveal that imaging occurred without explaining the radiologist’s findings. Think of the claim as the receipt and the clinical record as the story behind the purchase.
Helping with an appeal or complaint
A parent may also want you to speak and act on their behalf during a Medicare claim, appeal, grievance, coverage request, or complaint. That role can require a different authorization than the one used merely to discuss Medicare information.
Does HIPAA Prevent Adult Children From Helping?
HIPAA protects a patient’s health information, but it does not prohibit all communication with relatives. It establishes rules about when information may be used or disclosed.
An adult child has no automatic right to a parent’s complete medical record simply because of the family relationship. Access generally depends on one of the following:
- The parent signs a valid written authorization.
- The parent directs the provider to send records to the child.
- The child has legally effective authority as the parent’s personal representative.
- The provider shares limited, relevant information permitted by HIPAA based on the circumstances.
A provider may discuss information relevant to a person’s involvement in the patient’s care or payment when the patient agrees, does not object, or the provider can reasonably infer that the patient does not object. When a patient is incapacitated or unavailable, a provider may sometimes share relevant information if professional judgment indicates that doing so is in the patient’s best interest.
That flexibility does not create unlimited access to the entire chart. Being allowed to hear discharge instructions is not the same as being authorized to download ten years of medical history.
The Easiest Option: Written HIPAA Authorization
When a parent is capable and willing to give permission, a written HIPAA authorization is usually the cleanest approach. Ask each provider for its authorization or release-of-information form.
A valid authorization generally identifies:
- The patient whose information will be disclosed
- The person or organization allowed to receive it
- The information that may be disclosed
- The purpose of the disclosure, when applicable
- An expiration date or expiration event
- The patient’s signature and date
Your parent can authorize broad access or limit permission to particular records, providers, dates, or purposes. For example, the authorization might cover cardiology records from the past two years without including unrelated behavioral health information.
Ask whether the authorization allows both record delivery and verbal communication. Some offices use one form for releasing documents and another form for allowing staff members to speak with family caregivers.
Keep copies of signed documents. A form submitted to one hospital does not automatically appear in every independent physician’s system. Unfortunately, authorization forms do not travel around the health care system with the efficiency of spam email.
Set Up Patient Portal Proxy Access
Many health systems offer formal proxy or caregiver access to their patient portals. This can allow an adult child to use a separate username to view approved parts of a parent’s record.
Depending on the health system and permission level, proxy access may allow you to:
- Review test results and visit summaries
- See medication lists
- Request appointments or prescription renewals
- Exchange messages with the care team
- Download designated medical information
Formal proxy access is safer than sharing the parent’s password. Separate credentials create a record of who accessed the account and allow the parent or provider to change access without resetting the parent’s entire account.
Contact the provider’s medical records department, health information management office, privacy office, or portal support team. Ask specifically for “adult proxy access” or “caregiver portal access.” The parent may need to sign a form or complete the request while logged into the portal.
How to Get Permission to Discuss Medicare Information
A provider’s HIPAA form does not automatically authorize Medicare to discuss your parent’s account with you. Medicare has its own permission process.
Use Medicare’s disclosure authorization
The Authorization to Disclose Personal Health Information, Form CMS-10106, allows a Medicare beneficiary to give Medicare permission to share personal health information with a selected person or organization.
Your parent may also be able to add or manage representatives through a secure Medicare account. The authorization can help you discuss claims, billing, coverage, and other Medicare information within the permission granted.
This authorization applies to information held by Medicare. It does not force a doctor or hospital to release its clinical notes. You may need both a Medicare authorization and separate provider authorizations.
Use the appointment form for appeals and formal representation
When you need to represent your parent concerning a claim, appeal, grievance, or coverage request, the relevant document may be the Appointment of Representative, Form CMS-1696.
This role is more active than simply receiving information. An appointed representative may be able to submit evidence, receive notices, make requests, and participate in the appeal process on the beneficiary’s behalf.
Medicare Advantage and Part D plans may have their own procedures or forms. Contact the plan directly and ask what it requires for general disclosure, ongoing caregiver assistance, and formal representation in an appeal.
When a Parent Cannot Sign an Authorization
If a parent lacks decision-making capacity, access may depend on whether someone has legal authority to serve as the parent’s personal representative.
Health care power of attorney
A person named in a valid health care power of attorney may qualify as the patient’s personal representative when the document is legally effective. Some documents become effective immediately. Others are “springing” documents that take effect only after one or more clinicians determine that the patient lacks capacity.
Read the document rather than relying on its title. A financial power of attorney may authorize banking transactions without granting authority to make health care decisions or access medical records.
Court-appointed guardian
A guardian may have authority to access health information if the court order and state law give the guardian power over health care decisions. Providers commonly request a certified copy of the guardianship order and identification.
State law matters
HIPAA recognizes personal representatives based partly on applicable state law. The details of powers of attorney, guardianship, capacity, and estate authority vary by state. A provider may therefore ask for legal documents before recognizing someone as the patient’s representative.
When documents are disputed, incomplete, or rejected, consult an elder-law attorney or legal-aid organization in the parent’s state.
After a parent dies
Access to a deceased parent’s records generally depends on state law and estate authority. An executor, administrator, or other person legally authorized to act for the estate may qualify as the deceased person’s personal representative. A provider may request death documentation, court papers, identification, and a written request.
What Records Can Be Requested?
Patients generally have a HIPAA right to inspect or obtain copies of protected health information in a provider’s designated record set. A properly recognized personal representative can generally exercise the relevant access rights for the patient.
A focused request is often faster and less expensive than asking for “everything since the invention of penicillin.” Consider requesting:
- The current medication and allergy lists
- Recent office notes and discharge summaries
- Laboratory results from a defined period
- Imaging reports and, when needed, image files
- Specialist consultation reports
- Billing statements and itemized charges
Certain materials may be excluded from the HIPAA right of access, including psychotherapy notes kept separately from the regular record and information prepared for legal proceedings. Substance use disorder treatment records may also be protected by additional federal confidentiality rules under 42 CFR Part 2.
How Long Should a Medical Record Request Take?
Under the HIPAA Privacy Rule, a covered provider generally must act on an access request within 30 calendar days of receiving it. When the provider cannot complete the request within that period, it may use one additional 30-day extension if it gives written notice explaining the delay and stating when it expects to complete the request.
State law may require faster access or provide stronger patient protections. Providers may charge a reasonable, cost-based fee for copies, although state rules may limit fees or require free copies in certain circumstances.
Request an electronic copy when the records are maintained electronically and that format is workable. Before paying, ask for a written fee estimate and confirm whether the request includes imaging files, which may be handled separately.
What to Do When Access Is Denied
First, ask for the exact reason in writing. Many apparent denials are actually identity-verification problems, expired authorizations, missing signatures, or legal documents that have not been reviewed by the privacy office.
Use this escalation path:
- Confirm that the request went to the correct records department.
- Ask whether the authorization is complete and still valid.
- Provide identification and legal authority documents if required.
- Ask the provider’s privacy officer to review the decision.
- Request a written denial explaining any review rights.
- Consider filing a complaint with the HHS Office for Civil Rights when a HIPAA-covered organization improperly blocks access.
If Medicare or a health plan refuses to speak with you, verify whether the correct Medicare or plan-specific authorization has been submitted. Do not assume the hospital’s authorization was forwarded to Medicare.
Where Caregivers Can Get Medicare Help
Medicare
Call 1-800-MEDICARE at 1-800-633-4227 for assistance with Medicare claims, authorization procedures, coverage questions, and appeals. TTY users can call 1-877-486-2048. Have the beneficiary available when possible until formal permission has been recorded.
State Health Insurance Assistance Program
Every state has a State Health Insurance Assistance Program, commonly called SHIP. Trained counselors provide free, personalized Medicare counseling and are not insurance sales agents. SHIP can help families understand notices, compare coverage, identify appeal routes, and determine which Medicare form fits the situation.
The parent’s Medicare plan
For Medicare Advantage or Part D coverage, call the member-services number on the plan card. Ask how to establish a personal representative, authorized caregiver, or appointed appeal representative. Record the representative’s name, the date, and any confirmation number.
Privacy and Security Tips for Family Caregivers
Medical records may contain Social Security numbers, addresses, insurance identifiers, diagnoses, medications, and financial details. Treat the files as sensitive documents rather than as interesting family-group-chat material.
- Use official proxy access instead of sharing passwords.
- Enable multifactor authentication when available.
- Store electronic files in an encrypted or password-protected location.
- Avoid sending records through ordinary text messages.
- Do not use public computers to access health portals.
- Share only the information needed for the task.
- Review Medicare Summary Notices for unfamiliar services or billing errors.
A simple caregiver binder or secure digital folder can contain authorizations, powers of attorney, medication lists, insurance cards, provider contacts, recent discharge instructions, and appeal deadlines. Good organization cannot cure bureaucracy, but it can keep bureaucracy from eating your entire Tuesday.
Common Mistakes to Avoid
Assuming an emergency contact has full access
An emergency-contact designation tells the provider whom to call. It does not necessarily authorize the release of complete medical records.
Using one form for every organization
A hospital, physician group, pharmacy, Medicare, Medicare Advantage plan, and Part D plan may each maintain separate systems and authorization requirements.
Confusing power of attorney with Medicare representation
A power of attorney may establish authority under state law, but Medicare or a plan may still require documentation or a specific representative form. Similarly, becoming a Social Security representative payee is a separate process and does not automatically create authority over medical decisions or medical records.
Waiting until a crisis
The best time to arrange authorization is while a parent can clearly state preferences, sign documents, and participate in portal setup. The worst time is during an emergency while three relatives search a kitchen drawer for a document remembered only as “the blue paper.”
Caregiver Experiences and Practical Lessons
The following examples are composite caregiver scenarios designed to illustrate common experiences. They do not describe one identifiable patient or family.
Experience 1: The appointment that revealed nothing
Maria drove her father to several appointments and assumed that his doctors could discuss everything with her because she was sitting in the room. During visits, her father nodded when the physician included her in the conversation. Later, however, Maria called for a copy of his cardiology report and was told that the practice could not release it.
The office was not contradicting itself. Her father’s permission during the appointment allowed the physician to discuss relevant information at that time. It did not necessarily create a standing authorization for future phone calls or record releases.
Maria and her father completed the practice’s written authorization and requested formal portal proxy access. After that, Maria could review the medication list, download visit summaries, and prepare questions before appointments. The lesson was straightforward: informal involvement helps with conversation, but written permission makes ongoing care coordination far more reliable.
Experience 2: The Medicare form that did not open the hospital chart
Kevin’s mother authorized Medicare to discuss her information with him. He successfully called about an unfamiliar claim and learned what Medicare had approved. Encouraged, he asked Medicare for the physician’s detailed treatment notes.
That request reached the wrong organization. Medicare had claims information, but the treating physician maintained the clinical chart. Kevin then submitted a separate medical-record request to the physician group, using his mother’s signed HIPAA authorization.
This two-door problem is one of the most common sources of confusion. Medicare authorization may provide access to Medicare information, while each provider controls its own medical records. Sometimes caregiving is less like opening one filing cabinet and more like collecting keys from an unusually secretive hotel.
Experience 3: Preparing before cognitive decline progressed
Denise noticed that her mother was becoming confused about medications and insurance notices. While her mother could still understand and make decisions, the family met with an elder-law attorney, reviewed a health care power of attorney, created provider authorizations, and added Denise as a Medicare representative.
They also established portal proxy access at the primary care office and hospital. Denise created a secure list of medications, allergies, doctors, insurance contacts, and document expiration dates.
Months later, when her mother was hospitalized, Denise did not have to begin from zero. She still needed to provide identification and copies of legal documents, but the basic permissions were already in place. The experience showed that advance planning is not about taking control away from a parent. Done respectfully, it preserves the parent’s choices by documenting who should help and what that person may do.
Experience 4: When a caregiver could provide information but receive little
Thomas worried that his father had stopped taking an important medication. His father refused to authorize disclosure, so the physician could not freely discuss the medical record with Thomas. However, the office accepted the information Thomas provided about missed doses, confusion, and recent falls.
Privacy rules generally do not prevent a family member from giving relevant information to a provider. The provider may be limited in what can be disclosed in return, but the family’s observations can still help the care team assess risk.
The practical lesson was to separate “I need the doctor to tell me everything” from “I need the doctor to know something important.” Even without broad access, a caregiver can communicate a safety concern. In an immediate emergency, call 911 rather than waiting for a portal message to become the world’s slowest rescue vehicle.
Final Checklist for Accessing a Parent’s Medical Records
- Ask your parent what help they want and respect the boundaries they choose.
- Complete written HIPAA authorizations for relevant providers.
- Set up formal patient portal proxy access.
- Use Medicare’s disclosure authorization for Medicare-held information.
- Complete an Appointment of Representative form when handling a formal Medicare appeal or request.
- Check whether Medicare Advantage or Part D plans require separate forms.
- Review health care power-of-attorney or guardianship documents when the parent cannot consent.
- Keep copies of every form, submission date, and confirmation number.
- Store medical and insurance information securely.
- Contact Medicare or SHIP when the correct process remains unclear.
Conclusion
Accessing a parent’s medical records requires more than good intentions and a shared last name. The simplest path is usually to obtain written permission while the parent can participate, arrange proxy access with each provider, and establish separate authorization for Medicare and any private Medicare plan.
When a parent lacks capacity, a legally effective health care power of attorney, guardianship order, or other state-recognized authority may determine who can act as the personal representative. Because Medicare claims, provider records, Social Security benefits, and health care decisions operate under different rules, one authorization rarely handles every task.
A little paperwork completed early can prevent hours of confusion later. It can also help adult children focus on what matters most: supporting a parent’s care rather than becoming trapped in a telephone menu that keeps insisting your call is very important.
