Legal rights for family caregivers
Last checked: May 2026
A HIPAA release can help a caregiver talk with a doctor, hospital, Medicare, or an insurance plan about a loved one’s care.
It does not give you control over all care. It does not replace a health care power of attorney. But it can stop many phone-call problems before they start.
Quick answer: ask for the right permission form for the place you need to call
A HIPAA release is a written permission form. It lets a doctor, hospital, health plan, or Medicare share certain health information with the person named on the form.
For most caregivers, the first step is simple: call the doctor’s office, hospital records office, Medicare, or the insurance plan and ask, “What form lets my loved one give you permission to speak with me?”
HIPAA is the federal privacy law for health information. HHS says HIPAA protects patient privacy, but it also allows many routine talks with family, friends, or other people involved in care or payment when the patient agrees, does not object, or when the provider decides it is in the patient’s best interest in the situation. See HHS guidance on family members and friends and HHS FAQ guidance on sharing information with people involved in care.
A release helps most when you need to receive information. You do not usually need a release to give information to a doctor. You can tell the office what you saw, what medicines were missed, or what changed at home. The office may listen even if it cannot tell you private details back.
Who this helps
This guide is for a caregiver who needs to talk with a health office, hospital, Medicare, Medicaid plan, or insurance company about another adult.
It may help if you are:
- an adult child helping a parent;
- a spouse or partner handling care calls;
- a sibling, friend, neighbor, or other helper;
- a person trying to fix a bill, claim, referral, medication issue, or discharge problem;
- a caregiver trying to set up care at home, respite care, or a paid-caregiver path.
If your main question is whether you can be paid for care, read our guide on getting paid to be a caregiver. If you need time off from care, see respite care for caregivers. If your loved one needs someone to make medical decisions, see power of attorney for an aging parent.
What HIPAA blocks and allows
HIPAA does not mean every staff member must refuse to talk to family. It also does not mean a caregiver can get every record just by saying they help at home.
HIPAA mainly controls when covered health care providers and health plans may use or share protected health information. HHS lists covered entities to include many health plans, most health care providers, and Medicare and Medicaid programs on its HIPAA rights page.
Giving information is different from receiving information
You can give information
You can usually call or send a note to tell a doctor what is happening. You can say the person fell, stopped eating, missed medicine, seems confused, or cannot manage at home.
The office may not be able to confirm details back to you. But your report can still help the care team.
Getting information may need permission
If you need test results, medication details, claim facts, records, or a discharge plan, the office may need the patient’s permission, a valid authorization, or proof that you are a personal representative.
HHS says providers may share relevant information with people involved in care or payment in many cases, but the details depend on the facts.
What a HIPAA authorization form usually needs
HHS says a valid HIPAA authorization must include core details such as the information to be shared, who may share it, who may receive it, the purpose, an expiration date or event, and the signature of the patient or personal representative. See HHS guidance on authorization requirements.
The person can also revoke an authorization in writing, with some limits for actions already taken based on that authorization. HHS explains revocation in its authorization revocation FAQ.
What may pay or help
A HIPAA release does not pay a caregiver. It does not create coverage. It does not approve home care. But it can help you do the work that leads to coverage, care, payment, or an appeal.
For example, a release may help you:
- ask why Medicare, Medicaid, or a plan denied a claim;
- help with a care plan, referral, prescription, or prior authorization;
- talk with the hospital discharge team before your loved one comes home;
- ask what records are needed for a home care request;
- help file a complaint, claim, or appeal;
- check if the person may need a health care power of attorney.
If the issue is a hospital discharge, also read hospital discharge rights. If the issue is a Medicare denial, see how to appeal a Medicare denial.
| Path | What it may help with | Where to ask |
|---|---|---|
| Doctor office HIPAA release | Visits, results, medication questions, referrals, care orders | The doctor’s front desk, portal team, or medical records office |
| Hospital form | Discharge planning, records, billing, case management | Hospital patient registration, records office, or patient advocate |
| Medicare CMS-10106 | Giving 1-800-MEDICARE permission to share personal health information | Medicare’s official forms page or CMS form page |
| Insurance or Medicare Advantage plan permission | Claims, plan rules, prior approvals, care manager calls | The number on the insurance card |
| Health care power of attorney | Medical decision help when the document is in effect | State form, elder law attorney, legal aid, or court help center |
Who may qualify to receive information
The safest answer is this: the person who owns the health information chooses who may receive it, unless another law or document gives someone authority.
You may be able to receive information if:
- your loved one signs a HIPAA authorization naming you;
- your loved one tells the provider it is okay to speak with you;
- your loved one is present and does not object when the provider speaks with you;
- the provider uses professional judgment and shares only relevant information because you are involved in care or payment;
- you are the person’s legal personal representative for health care matters.
HHS says a personal representative can act for the person and exercise HIPAA rights when that representative has authority under state or other law. Read HHS guidance on personal representatives.
State law matters. A caregiver who has a financial power of attorney may not have health care authority. HHS says a non-health-care power of attorney does not, by itself, let the holder exercise HIPAA rights for health care matters, except in limited decedent situations. See the HHS FAQ on non-health-care powers of attorney.
Where to start first
Do this first
- Pick the place you need to speak with first: doctor, hospital, Medicare, insurance plan, or pharmacy.
- Ask for that place’s own permission form.
- Ask if your loved one can sign it in person, by portal, by mail, or by secure upload.
- Ask what the form will allow you to discuss.
- Keep a copy and write down the date it expires.
Do not assume one form works everywhere. A hospital form may not help with Medicare. A Medicare form may not help with a doctor’s office. A clinic form may not help with a separate lab, pharmacy, or health plan.
Phone script: asking for the right HIPAA form
Use this when calling a doctor, hospital, or health plan.
“Hi, my name is [your name]. I help [patient name] with care and paperwork. I know you may not be able to share details with me yet. What form does [patient name] need to sign so your office can speak with me about appointments, records, bills, or care instructions? Can you send the form by portal, email, mail, or give it to us at the next visit?”
If they say no, ask this:
“Can I still give information to the care team about what I am seeing at home? Also, who is the privacy officer or patient advocate if we need help with the permission process?”
What documents may be needed
You may not need every item. Ask the office what they require.
- Photo ID for the patient.
- Photo ID for the caregiver, if requested.
- The office’s HIPAA release or authorization form.
- Patient name, date of birth, address, and phone number.
- Caregiver name, phone number, address, and relationship.
- What information may be shared, such as appointments, medications, records, claims, or billing.
- How long the permission lasts.
- Patient signature and date.
- Health care power of attorney, guardianship order, or other legal paper if you are acting as a personal representative.
- Insurance card, Medicare card, Medicaid card, or plan member ID if the call is about coverage.
Doctor office and hospital forms
Many doctors and hospitals have their own forms. The form may be called a HIPAA release, authorization to disclose health information, permission to share information, release of information, or patient representative form.
Ask for the narrowest form that solves the problem. For routine care, your loved one may only want you to speak with the office about appointments, medicines, test results, referrals, and billing. They may not want all records shared.
Ask the office these questions:
- Does the form allow phone calls?
- Does it allow portal access or only staff conversations?
- Does it cover billing and records?
- Does it cover future visits and future records?
- When does it expire?
- Can the patient limit what is shared?
HHS says an authorization can cover information created after the form is signed if the form covers that type of information and has not expired or been revoked. See HHS FAQ 477 on future information covered by an authorization.
Medicare and insurance permission
Medicare has its own official form. Medicare says the Authorization to Disclose Personal Health Information, CMS-10106, is used to give Medicare permission to talk to someone you choose about claims and health records. See Medicare’s Other Forms page.
CMS lists the form as CMS-10106, with the title “1-800-Medicare Authorization to Disclosure Personal Health Information.” CMS shows a March 2026 revision date and March 31, 2029 OMB expiration date on its CMS-10106 page.
If your loved one has a Medicare Advantage plan, Part D drug plan, Medicaid managed care plan, retiree plan, or private insurance, call the plan too. The plan may have its own release or authorized representative process.
For Original Medicare claims, complaints, or appeals, Medicare says a person who needs someone to file a claim, appeal, or complaint on their behalf may need the Authorization to Disclose Personal Health Information form. See Medicare’s claims, appeals, and complaints page.
Tip: Ask each plan, “Do you need a HIPAA release, an authorized representative form, or both?” Some appeals may need a different form than a general permission-to-speak form.
When a power of attorney may be needed
A HIPAA release lets someone receive health information. A health care power of attorney may let someone make health care decisions if the document is valid and in effect.
HHS says that, generally, if a health care power of attorney is currently in effect, the named person is the patient’s personal representative under HIPAA. Some documents work right away. Others only work after the patient lacks capacity to make health care decisions. See HHS FAQ 3000 on health care power of attorney and access.
If your loved one can still understand and sign forms, it may be easier to handle this before a crisis. If they cannot understand or sign, ask a local elder law attorney, legal aid office, state court help center, or Area Agency on Aging about your state’s choices. Some states use different names, such as health care proxy, medical power of attorney, advance directive, or surrogate decision maker.
If your parent refuses to sign
If your parent or loved one has the capacity to make their own choices, they can usually refuse to sign a HIPAA release. You may disagree with the choice. The doctor may still have to respect it.
Do not try to trick the office. Do not pretend to be the patient. That can make things worse.
Important: You can still share safety facts with the care team. You can say, “I know you may not be able to talk back to me, but I need to report that she fell twice this week and is mixing up pills.”
If your loved one refuses, try a smaller request:
- Ask if they will let you attend one visit.
- Ask if they will sign a limited release for appointments and medicines only.
- Ask if they will let the office call you only after visits.
- Ask if they will name you for billing only.
- Ask if they will add you as an emergency contact, while knowing that this may not be the same as a HIPAA release.
If there is an immediate safety threat, call 911 or local emergency help. If you suspect abuse, neglect, or self-neglect, contact Adult Protective Services in the person’s state or ask the local Area Agency on Aging for the right office. ACL says the Eldercare Locator connects older adults and caregivers with local resources, including home care, transportation, caregiver education, and breaks from care. See ACL’s Getting Started page or the Eldercare Locator.
Where state rules matter
HIPAA is federal, but health care decision papers are often state-based. State law can affect who counts as a personal representative, how a health care power of attorney must be signed, when it starts, and whether a guardian or conservator is needed.
Start with these state routes:
- Your loved one’s doctor or hospital social worker.
- The hospital patient advocate or privacy officer.
- Your state or local Area Agency on Aging through the Eldercare Locator.
- Your state court self-help center for guardianship or conservatorship information.
- Legal aid or an elder law attorney for power of attorney questions.
ACL says legal help for older adults is part of the aging services network and can help protect independence, choice, and financial security. See ACL’s Legal Services for Older Americans Program.
What usually goes wrong
- The caregiver calls the wrong place. A doctor’s release does not make Medicare talk to you.
- The form is too broad or too narrow. Ask what it covers before it is signed.
- The form expired. Write the end date on your calendar.
- The office cannot find the form. Bring or upload a copy each time until it is added to the record.
- The patient portal has separate rules. Proxy portal access may need its own setup.
- Billing and medical records are separate. One department may need a different release.
- A financial POA is mistaken for health care authority. Ask if the document includes health care decisions.
- The patient gave verbal permission once. That may help for that visit, but it may not work for later phone calls.
What to do if the first path does not work
If the front desk says, “We can’t talk to you because of HIPAA,” do not stop there. Ask what exact step fixes the problem.
- Ask for the name of the form they need.
- Ask where to send the completed form.
- Ask if the patient can give permission during the call or visit.
- Ask if you can submit safety facts even if they cannot reply.
- Ask for the privacy officer, medical records office, patient advocate, or plan grievance unit.
- Ask for the answer in writing if they refuse to honor a signed form or legal paper.
If you think a covered health care provider or health plan broke HIPAA rules, HHS says anyone can file a health information privacy complaint with the Office for Civil Rights. HHS also says complaints generally must be filed within 180 days of the violation. See HHS on filing a health information privacy complaint and what to expect.
Official sources used / What we checked for this update
- HHS Office for Civil Rights: Family Members and Friends.
- HHS Office for Civil Rights: HIPAA sharing with family, friends, or others involved in care.
- HHS Office for Civil Rights: Authorization requirements.
- HHS Office for Civil Rights: Personal representatives.
- HHS Office for Civil Rights: Health care power of attorney and HIPAA access.
- Medicare.gov: Authorization to Disclose Personal Health Information, CMS-10106.
- CMS.gov: CMS-10106 form listing.
- ACL: Getting Started with local help and Legal Services for Older Americans Program.
Resumen corto en español
Un formulario HIPAA permite que un médico, hospital, Medicare o seguro comparta cierta información médica con la persona nombrada en el formulario.
El cuidador puede dar información al médico, aunque el médico no pueda responder con detalles privados. Para recibir información, muchas veces se necesita permiso del paciente, un formulario firmado o un documento legal de salud.
Empiece llamando a la oficina médica, hospital, Medicare o seguro. Pregunte: “¿Qué formulario necesita firmar mi familiar para que ustedes puedan hablar conmigo?”
About This Guide
CaregiverBenefits.org wrote this guide for family caregivers who need practical help with health privacy forms, care calls, coverage questions, and appeals.
We checked official federal sources first. We focused on steps a caregiver can take when trying to speak with a doctor, hospital, Medicare, Medicaid plan, or insurer.
Plain disclaimer
This guide is general information, not legal advice. HIPAA rules, state decision-making laws, hospital policies, and insurance forms can change. Ask the provider, plan, local agency, court, or a qualified attorney to confirm what applies in your situation.
FAQ
Is a HIPAA release the same as power of attorney?
No. A HIPAA release usually lets someone receive certain health information. A health care power of attorney may let someone make medical decisions if the document is valid and in effect.
Can I tell the doctor what is happening at home without a HIPAA form?
Usually, yes. You can give information to the doctor or care team. They may not be able to share private details back unless the patient has given permission or another rule allows it.
Can a doctor talk to me if my parent is in the room?
HHS says providers may speak with family or others involved in care when the patient is present, has capacity, and agrees or does not object. The provider should share only information that fits the situation.
Can a hospital talk to me if my loved one is unconscious?
HHS says a provider may share relevant information with family or others involved in care when the patient is not present or is incapacitated if the provider decides it is in the patient’s best interest.
Does one HIPAA form work for every doctor and insurance plan?
Often, no. Each doctor, hospital, pharmacy, Medicare office, Medicaid plan, or private insurer may have its own form or process. Ask each place what it needs.
What Medicare form lets Medicare talk to a caregiver?
Medicare uses the Authorization to Disclose Personal Health Information form, CMS-10106, for permission to share personal health information with someone the Medicare beneficiary chooses.
Can my parent refuse to sign a HIPAA release?
Yes, if your parent has capacity to make that choice. You can ask for a limited release, ask to attend a visit, or still give safety information to the care team.
What should I do if an office says “HIPAA” and refuses to help?
Ask what form or legal paper they need. Ask for the privacy officer, medical records office, or patient advocate. If you think HIPAA rights were violated, you can review HHS Office for Civil Rights complaint steps.
