A HIPAA authorization is a one-page form letting named people receive your medical information. It is the least interesting document we prepare and the one clients thank us for most often.
Without it, a hospital can lawfully refuse to tell your daughter whether you are in the building.
Why the directive alone is not enough
Your health care agent generally gets access under the directive, but only once the directive is operative and only for that one person. Your other children, your sibling, the friend who drove you in, none of them are covered.
And there is a timing gap. Records access is often useful before anyone has declared you incapacitated, when the family is just trying to understand what is happening. A standalone HIPAA authorization closes that gap.
Who to name
- Your health care agent and every alternate agent.
- Your successor trustee, since incapacity determinations under the trust often depend on medical records.
- Adult children you want informed, even the ones who are not making decisions.
- Anyone who might reasonably show up at a hospital asking about you.
Naming someone here does not give them decision authority. It only lets them receive information, which is a much lower stakes grant than people assume.
The trust connection
Most trusts define incapacity by reference to physician certification. If your successor trustee cannot legally obtain the certification, the mechanism your trust relies on stalls. Naming the trustee on the HIPAA authorization is what keeps that from happening.
The college student version
The day your child turns 18, you lose the right to their medical information. A student at UCLA who ends up in an emergency room is an adult, and the hospital owes you nothing.
A HIPAA authorization plus a simple health care directive costs almost nothing and takes fifteen minutes. Every parent sending a kid to college should do it, and almost none do.
“I've had clients call from a hospital lobby, furious that nobody will tell them anything about their own mother. The staff are not being difficult. They are following a federal law that a single signed page would have satisfied.”
Delia Vasquez-HartPractical details
It does not need to be notarized. Providers sometimes want their own version on file, so give a copy to your primary care office and sign whatever internal form they hand you as well. Belt and suspenders.
Set an expiration far out or none at all, and revisit it after a divorce or an estrangement, since revoking is a matter of writing to the providers who hold it.
Questions we get asked
Is this included in your packages?
Yes, in all of them. The $2,900 individual trust package, the $3,600 couple's package, and the $1,200 will-based package each include a HIPAA authorization.
Does it give anyone power over my care?
No. Information only. Decision authority comes from the advance health care directive.
What if a provider still refuses?
Ask for the privacy officer and show them the signed authorization. Refusals are usually front-desk caution rather than policy, and they resolve once someone senior looks at the form.
Do I need one for my parent?
You need them to sign one naming you. You cannot create it for them, which is why this conversation has to happen while they are well.
If you have an adult child heading to school this year, get a HIPAA authorization and a health care directive signed before they leave. We do that pair for existing clients' children at no charge, since it takes fifteen minutes and the alternative is a phone call I hate receiving.