The document your doctor needs but your lawyer probably didn't give you
You have a will. You have a health care power of attorney. You have a durable power of attorney for finances. You did the work. You sat with the attorney, you signed the documents, and you put the binder on the shelf in your home office.
And then the phone call comes, the kind no family wants to receive, and your daughter calls the hospital to find out what happened to you, and a polite voice on the other end says she is not authorized to receive that information.
Wait. What?
This is one of the most common gaps I see in otherwise complete estate plans, and it has nothing to do with bad lawyering. It has to do with a federal privacy law that most people, including many attorneys, do not fully integrate into their planning. The law is HIPAA, and the missing piece is a stand-alone HIPAA authorization that names the people who should be allowed to receive your medical information when you cannot ask for it yourself.
Let me walk you through why this matters and what you actually need.
What HIPAA does and does not allow
The Health Insurance Portability and Accountability Act, signed into law in 1996, includes federal privacy rules that govern how medical providers can share your health information. The intent of those rules is good. Without them, your insurer, your employer, and a long list of other interested parties could obtain and use medical details about you without your permission.
The cost of that protection, though, is that medical providers genuinely cannot share your information without authorization. They are not being unhelpful. They are not exercising discretion. They are following a federal law that comes with substantial penalties for violations.
That includes sharing information with your spouse, your adult children, your parents if you are an adult, and anyone else who might call to ask. Without a written authorization, a provider's default is to disclose nothing.
For the Department of Health and Human Services' overview of these rules, the HHS HIPAA privacy rule summary is the authoritative source.
Why your health care power of attorney is not enough
Most people assume that if they have signed a health care power of attorney, the named agent automatically has access to their medical information. That assumption is reasonable, and it is also incomplete.
Here's what most people don't understand: a health care power of attorney generally takes effect when the principal is determined to be unable to make their own health care decisions. That determination requires medical evaluation, which requires medical information. And the medical information is the very thing the agent does not yet have access to without authorization.
You can see the loop. The agent cannot act until incapacity is determined. Incapacity cannot be determined without medical input. The medical input cannot be shared without authorization.
In practice, this gets resolved one of two ways. Either the family pushes hard, eventually finds someone in the hospital who decides the spirit of the document is enough, and gets the information needed. Or the family hires a lawyer to escalate, which works but takes time and money.
A separate, stand-alone HIPAA authorization solves this problem cleanly by naming specific people who can receive medical information without any incapacity determination, full stop.
What a HIPAA authorization actually does
A HIPAA authorization is a written document, signed by you, that:
• Names specific individuals who are authorized to receive your protected health information
• Identifies the categories of information that may be shared, often broad categories like all medical records, mental health records, substance abuse treatment records, and HIV/AIDS-related information
• States the purposes for which the information may be used, often general purposes such as making medical decisions, coordinating care, and pursuing insurance claims
• Specifies how long the authorization remains in effect
• Notes that the authorization can be revoked at any time, and how to do that
The result is that your authorized people can call the hospital, the doctor's office, the lab, the pharmacy, the long-term care facility, and the insurance company, and actually get answers, without anyone having to determine that you are incapacitated first.
The specific scenarios where this matters
Let me give you four real-world scenarios, drawn from the kinds of calls our office actually fields.
The travel emergency. You are on vacation, you have an accident, and you are hospitalized in another state. Your spouse is reachable. Your adult children are reachable. None of them can find out from the hospital what is going on, because the hospital is in Colorado and your local lawyer's note about your power of attorney is back in North Carolina.
The adult child away at college. Your son is at school in Tennessee. He is in a car accident on the interstate. The hospital calls the emergency contact, but federal privacy rules limit what they can share. You drive seven hours to get there, and you arrive without knowing whether your son is in surgery, in stable condition, or worse. A signed HIPAA authorization could have changed that drive.
The slowly progressing condition. Your mother has been declining for two years. She still lives independently, mostly. She still makes her own appointments. She forgets to mention things to you, including a medication change last month and a fall last week. Without authorization, her doctor cannot loop you in proactively. With authorization, the doctor can include you in the conversation when something changes.
The insurance claim that requires medical records. You are filing a long-term care insurance claim or a disability claim on a parent's behalf. The carrier needs medical records. Without authorization on file, every record request becomes a request the parent has to make personally, even when the parent is the very person whose condition is the subject of the claim.
In every one of these scenarios, the HIPAA authorization is the difference between waiting on hold for forty minutes to be told no and getting the information your family actually needs.
How this should be set up
A few practical points.
Use a stand-alone document. Some health care powers of attorney include HIPAA language. That is fine, and useful. But a separate, stand-alone HIPAA authorization is more recognizable to medical providers, who see them every day, and gets accepted with less friction.
Name multiple people. Spouse, adult children, sometimes a sibling or a close friend. The point is to make sure that if one person cannot be reached, another can step in.
Include the right scope. A narrow authorization that only covers some categories of records leaves gaps. A broad authorization that covers all medical records, including mental health, substance abuse, and HIV-related records, generally serves the family best, though clients sometimes choose to limit specific sensitive categories.
Distribute copies. Give copies to each named person. Keep the original with your other estate planning documents. Some clients also load a digital copy into their phone or a shared family folder so it is available when they are traveling.
Update when life changes. A divorce, an estrangement, a death, a new spouse, a new child reaching age 18. Each of these is a moment to revisit who is authorized.
For more on how all of these incapacity-related documents work together, our article on what incapacity planning really means and why your family needs it covers the full picture, and our piece on what a power of attorney is and why you need one gets into the financial side.
When it makes sense to revisit
If your existing estate plan is more than a few years old, it is worth checking whether a stand-alone HIPAA authorization is part of it. Many older plans, particularly ones drafted before 2010 or so, did not consistently include this document, and even some newer plans treat it as an afterthought.
You should specifically check, or ask your attorney to check, whether:
• You have a stand-alone HIPAA authorization, separate from your health care power of attorney
• The authorization names every person you would want to be informed
• The scope of the authorization includes the categories of records that matter to you
• Your providers have a copy on file
For more on whether a broader plan refresh might be in order, our piece on your health changed, should your estate plan change too is a useful starting point.
Closing thoughts
HIPAA exists for good reasons, and your right to privacy in your medical records is a real and important right. But that right is yours to define. You get to decide who is allowed to receive information on your behalf when you cannot ask for it yourself.
The default answer, set by federal law, is no one. Without a written authorization, your spouse, your children, your parents, and anyone else who loves you is on the wrong side of the privacy wall when it matters most.
I want to strongly encourage you to confirm that a stand-alone HIPAA authorization is part of your estate plan. It is one of the smaller documents in the binder. It is also one of the documents your family will need first.
If we can be of assistance to you, please reach out to us at 919-647-9599 or schedule a discovery call. The Walls Law Group works with families throughout the great state of North Carolina to put complete, coordinated planning documents in place, including the small but critical HIPAA authorization that too many plans leave out.
The Walls Law Group serves clients in Raleigh, Cary, Apex, Morrisville, Holly Springs, Fuquay-Varina, Wake Forest, Pittsboro, and surrounding North Carolina communities.
This article is for general educational purposes only and does not constitute legal advice. HIPAA authorizations interact with state privacy laws and other planning documents in specific ways. For advice specific to your situation, please consult with a licensed North Carolina attorney.
