How to get your parent’s doctors to talk to you

You call the cardiologist’s office to ask whether your father’s appointment got moved, and you are told they cannot tell you anything. You call the pharmacy to ask whether a prescription was ever sent, and you hear the word HIPAA. You are the one driving him to every visit, sorting his pills and paying his bills, and the system treats you as a stranger.

This is one of the most common frustrations families bring us, and the fix is mostly paperwork, done once. But it helps to understand what the rule actually says first, because a lot of what you are told at the front desk is caution rather than law.

The HIPAA Privacy Rule has a specific section, 45 CFR 164.510(b), about family and friends involved in a patient’s care. It permits a doctor, hospital, pharmacy or health plan to share information directly relevant to your involvement in your parent’s care or in paying for it, if your parent agrees or, when given the opportunity, does not object. If your parent is in the room and says “you can talk to my daughter,” that is enough. If you have been coming to appointments for a year and your father clearly relies on you, the provider is allowed to use professional judgment and infer that he does not object.

If your parent is incapacitated or it is an emergency, the rule goes further: a provider may share relevant information with a family member when, in their professional judgment, it is in the patient’s best interest. The HHS guidance gives the example of a doctor discussing an incapacitated patient’s condition with a family member over the phone.

The distinction families most often miss is the first two rows. A HIPAA authorization lets the office tell you things. A healthcare power of attorney lets you decide things, and it also makes you your parent’s personal representative, which under the privacy rule means the provider must treat you as the patient for access to records. You want both, and you want them while your parent still clearly has the capacity to sign. Once capacity is questioned, the alternative is a guardianship proceeding in court.

There is no single national HIPAA form; each organization uses its own, and a form signed at the primary care office does not carry over to the cardiologist, the hospital or the pharmacy. So the job is repetitive, but it is not hard. A valid authorization has to include a few things, and knowing them lets you check the form before your parent signs it:

• What information may be shared (tick “all” unless there is a reason not to).
• Who may share it (the practice) and who may receive it (you, by name, and any siblings who should also be able to call).
• The purpose (“involvement in my care” is fine).
• An expiration date or event. Many forms default to one year; write a longer period or “until revoked” if the form allows it, so you are not redoing this every twelve months.
• Your parent’s signature and the date, and a note that they can revoke it in writing at any time.

Ask for a copy of every signed form and keep them together, on paper and as photos on your phone. When an office says it has no release on file, the photograph ends the conversation.

Even with a healthcare power of attorney in hand, 1-800-MEDICARE will not discuss your parent’s claims or coverage with you unless Medicare has its own authorization on file. The form is CMS-10106, Medicare Authorization to Disclose Personal Health Information. Your parent fills it in, names you, and chooses whether it lasts indefinitely or for a set period. It can also be completed online through your parent’s Medicare.gov account. If your parent cannot sign, you submit it with a copy of the power of attorney attached.

Medicare Advantage and Part D plans have their own authorized-representative forms as well, separate from Medicare’s. If your parent is in a plan, call the plan and ask for theirs.

Phone calls are the slow way to get information. Almost every practice and hospital now has a patient portal, and every major portal supports proxy access: your own login that shows your parent’s results, messages, medication list and upcoming appointments. Ask each practice for its proxy form. Health systems using the same portal software often share one login across every practice in the system, which is the closest thing to a single view of your parent’s care that exists.

1. 1.Ask what they need. Usually the answer is their release form, and the fastest route is to get it signed that day, by fax or through the portal.
2. 2.Put your parent on the phone. A patient saying “you may talk to my daughter about this” in real time satisfies the rule, and most offices will proceed on that basis and follow up with the form.
3. 3.Ask to speak to the practice manager or privacy officer. Front-desk staff are trained to say no; the privacy officer knows what the rule permits.
4. 4.If your parent lacks capacity and you hold a healthcare power of attorney, say so and send it. A personal representative cannot be refused the patient’s own rights to information.
5. 5.Ask the doctor to call you. Providers are allowed to use professional judgment about family involvement, and a doctor who has met you will generally exercise it.
6. 6.Remember that the flow the other way is never blocked. You can always give the practice information about your parent: what you are seeing at home, medication mistakes, a fall. HIPAA restricts what they say, not what they hear.

The worst time to discover there is no release on file is the afternoon your father is in the emergency department and you are on the phone from two states away. The whole set, a HIPAA release at each office, a healthcare power of attorney, the Medicare form and portal access, takes a few hours spread over a couple of weeks, and it is the single most useful piece of preparation a family can do. Our aging-parents checklist puts it in the first week for a reason.

“HIPAA was written to keep strangers out. It was never meant to keep out the daughter doing the driving.”