HIPAA release form for an aging parent: what it does and how to get one

You call the cardiology office to ask how your dad's appointment went, and the receptionist says she can't discuss him with you. Or the hospital discharge nurse asks whether you are "on the form." That is usually the moment adult children learn about the HIPAA release form.

This guide explains, in plain language, what a HIPAA release form is, when you actually need one for a parent, what a valid one must contain, who signs it, and how it differs from a healthcare power of attorney. At the end there is a printable checklist.

What is a HIPAA release form?

A HIPAA release form is a signed document in which a patient gives a doctor, hospital or health plan permission to share their health information with a named person, for a stated purpose, until a stated date or event. The federal regulation calls it an authorization; people also call it a HIPAA authorization form, a HIPAA waiver or a medical release form. They usually mean the same thing.

There is no single official government form. HHS says any authorization that meets the Privacy Rule's requirements can be used, whoever drafted it, and the rule does not require a particular format (HHS, 2023 (opens in a new tab)). That is why every hospital, insurer and state seems to have its own version, and why searches for a "HIPAA release form PDF" or "template" turn up so many different ones.

Do you actually need one for your parent?

Often less than people think. HIPAA already lets providers talk to family members who are involved in a patient's care:

• When your parent is present and able to decide, the provider may share information with you if your parent does not object, for example if your mom asked you to come into the exam room (HHS, 2017 (opens in a new tab)).
• When your parent is not present or is incapacitated, the provider may share information if, using professional judgment, it is in your parent's best interests.
• In both cases, the provider shares only what is relevant to your involvement in their care or payment for care.

So why get a release at all? Because "may" is not "must." Without something in writing, a cautious front desk, a billing department or a phone line may refuse, and you lose time when it matters. A signed release is most useful when:

1. You handle appointments, bills or insurance by phone, without your parent on the line.
2. You need copies of records sent to you (for a second opinion, a new specialist, or your own files).
3. You live far away and are not the sibling who goes to appointments.
4. Your parent is still fully capable now, and you want things set up before a crisis.

What a valid HIPAA authorization must include

Under 45 CFR 164.508, a valid authorization must contain these core elements (eCFR, 2026 (opens in a new tab)):

1. What information may be shared, described specifically enough to identify it (for example "all records" or "records about cardiology care").
2. Who may share it: the person or organization disclosing (a named doctor, a hospital system, "any health care provider").
3. Who may receive it: your name, and any siblings your parent wants included.
4. The purpose. "At the request of the individual" is enough when your parent starts the request and does not want to give a reason.
5. An expiration date or event, such as a date, "upon my death," or "when revoked in writing."
6. Your parent's signature and the date. If someone signs on your parent's behalf, the form must describe that person's authority.

It must also tell the signer that they can revoke it in writing, whether treatment or payment can be conditioned on signing, and that information shared may be re-disclosed by the recipient and no longer protected by HIPAA. The form must be in plain language, and a covered entity that asks for the authorization must give the signer a copy.

Does it need to be notarized?

Not under federal law. HHS states that the Privacy Rule does not require an authorization to be notarized or witnessed (HHS, 2023 (opens in a new tab)). A specific provider, insurer or state form may still ask for a witness or notary, so follow the instructions on the form you use.

Who signs the form?

Your parent does, as long as they understand what they are signing. That is the main reason to do this early: a release has to be signed by the patient, or by someone with legal authority to act for them.

If your parent can no longer sign, the person who can usually is their personal representative: someone with legal authority to make health care decisions for them, such as an agent under a healthcare power of attorney that is in effect, or a court-appointed guardian. That person signs and describes their authority on the form.

HIPAA release form vs. healthcare power of attorney

These two get mixed up all the time, and many families need both.

According to HHS, a healthcare power of attorney that is in effect generally makes the agent the patient's personal representative under HIPAA, with the same right to access health information as the patient (HHS, 2022 (opens in a new tab)). But if your parent's power of attorney only "springs" into effect when they lose capacity, it will not help you while they are still making their own decisions. A HIPAA release fills that gap. For the bigger picture of which documents to gather, see documents every aging parent should have.

Another route: your parent asks for records to be sent to you

If what you need is a copy of records rather than ongoing conversations, your parent can use their own HIPAA right of access and direct the provider to send the records to you. The request must be in writing, signed by your parent, and must clearly identify you and where to send the records (HHS, 2025 (opens in a new tab)). The provider generally has 30 calendar days to act, with one possible 30-day extension if it explains the delay in writing (HHS (opens in a new tab)). Our guide on how to organize your parent's medical information walks through requesting and sorting those records.

How to get a HIPAA release form for your parent, step by step

1. List who holds information. Primary care, each specialist, the hospital system, the pharmacy, the Medicare or insurance plan. Each may want its own form.
2. Ask each one for its form first. Most providers and health plans have their own authorization form, often on their website or patient portal, and they process their own form fastest. Some patient portals also offer proxy (caregiver) access, which is a separate setup.
3. Use a general form where none is offered. Any form that meets the federal requirements can work; some states publish one, for example the Texas Attorney General's authorization form (opens in a new tab). Check the elements above before your parent signs.
4. Name every sibling who needs access. If two of you share the calls, put both names on it. See sharing parent care with siblings.
5. Choose the scope and end date with your parent. Some parents are comfortable with "all records"; others want to leave out certain topics. It is their information and their choice.
6. Submit and confirm. Hand-deliver, upload or fax the signed form, then call a week later and ask: "Is the authorization on file for [parent's name]?"
7. Keep copies. Keep the signed originals together with your parent's other key papers.

Where to keep the signed copies

A release only helps if you can produce it when the office says "we don't have that." Keep a paper copy in your parent's caregiver binder, keep a photo or scan on your phone, and note on your parent's records which providers already have one on file. Bring a copy to the hospital; the hospital discharge checklist is a good moment to confirm the hospital has it.

If you use an organizing tool such as ParentFile, you can mark the HIPAA release in your parent's documents map, with where the signed copies are kept and which providers have one on file, so your siblings know it exists and where to find it. ParentFile organizes information; it does not create, store, file or validate legal documents.

Printable checklist: HIPAA release form for a parent

• Parent's full legal name and date of birth on the form
• What information may be shared (all records, or specific types)
• Who may share it (named doctors, hospital system, health plan, pharmacy)
• Who may receive it (each adult child or other helper, by full name)
• Purpose (or "at the request of the individual")
• Expiration date or event
• Statements about revoking, conditioning and re-disclosure are on the form
• Signed and dated by your parent (or by a personal representative, with their authority described)
• Any extra witness or notary steps the provider's form asks for
• Copy submitted to each provider and health plan, and confirmed on file
• Copies stored in the binder, on your phone, and with the sibling who goes to appointments
• Reminder set to review it each year or when your parent changes doctors