Dad Agreed to Sign a HIPAA Authorization. Make the Form Match the Help He Actually Wants.

Dad said you may speak with his doctors. Good. That agreement does not require him to open every medical record to you forever.

Local option: New Plan Care gives families in the St. Louis area in-home help so a parent can stay home: companionship, help with bathing and dressing, meals, and overnight care. Call (314) 405-0887.

A HIPAA authorization is permission to use or disclose specified health information. It is not a transfer of decision-making authority, and it does not make you Dad's health care agent. The federal rule requires a valid authorization to identify the information, who may disclose it, who may receive it, its purpose when required, and an expiration date or event. It must also explain Dad's right to revoke it and the possible consequences of redisclosure. HHS, HIPAA authorization requirements, collected in Sources.

The useful question is not, "Will Dad sign a release?" It is, "What job does this release need to do?"

Name the job before reading the form

Write one sentence describing what you need to accomplish. Perhaps you need to receive the discharge instructions after a fall, ask the primary care office whether a follow-up visit was scheduled, obtain a medication list for an appointment, or discuss one hospital bill.

Do not start with the broadest form in the packet. Start with that sentence. Then compare every blank on the form with the job.

If the job is limited to arranging one follow-up visit, access to Dad's complete record from every provider may be unnecessary. If you will coordinate care among several offices, a release naming only one clinic may be too narrow. The right scope is the smallest one that will still work when someone answers the phone on a bad afternoon.

Check the five working parts

The information: Look for language describing what may be disclosed. "All records" can include far more than a medication list or discharge summary. Ask whether the form can name particular record types, conditions, departments, or episodes of care. If Dad wants exclusions, ask the records office how its form handles them. Do not write homemade exceptions into a form and assume the computer system will honor them.

The sender: Confirm which organization may release information. A hospital authorization may not cover Dad's independent primary care office, specialist, pharmacy, ambulance service, or health plan. Ask each organization whether it requires its own form and where completed forms must be delivered.

The recipient: Use your full name and reliable contact information. If Dad wants two sons involved, name both rather than assuming one recipient may pass everything along. Ask whether the provider verifies callers with a password, date of birth, address, or another identifier.

The purpose: Describe the actual work in plain terms, such as coordinating follow-up care or helping resolve a claim. Avoid expanding the purpose merely because the form provides a large blank.

The stopping point: Federal rules require an expiration date or an expiration event related to Dad or the purpose. Ask Dad whether the permission should end after an appointment, after a course of treatment, or at another clear stopping point. A release that never reaches the job is useless. A release that outlives the job is untidy authority. HHS, authorization expiration and revocation guidance, collected in Sources.

Separate permission to talk from authority to decide

A release can let an office disclose information to you. It does not ordinarily authorize you to consent to treatment, refuse treatment, schedule against Dad's wishes, or sign financial agreements in his name.

Missouri law separately addresses an attorney in fact designated to make health care decisions. Subject to limits in the document and federal law, that person may receive information and review records connected with the delegated role. The power of attorney belongs in the medical record before a provider acts on it. Missouri Revised Statutes, health care power of attorney and medical records, collected in Sources.

If Dad has a health care power of attorney, bring it to the records office and ask two questions: "Is this in his chart?" and "When does your system treat it as active?" Do not assume the document and the HIPAA authorization perform the same job.

Ask whether a written authorization is needed for tonight's task

HIPAA does not automatically forbid a provider from speaking with family. When Dad is present and able to decide, a provider may discuss information directly relevant to your involvement if Dad agrees or does not object. When he is not present or cannot agree, a provider may sometimes share relevant information based on professional judgment and Dad's best interests. The rule permits those disclosures. It does not force a provider to make them. HHS, sharing information with family and friends, collected in Sources.

That means Dad may be able to handle an immediate call by telling the office, "You may discuss today's visit with my son," while a written authorization handles later calls when he is not beside you. Ask the office what it will document and whether its telephone staff can see that permission.

Find the revocation route before Dad signs

Dad may revoke an authorization in writing, except to the extent someone has already acted in reliance on it. The form should explain how. Before signing, locate the office, mailing address, portal route, or records department that accepts a revocation. Ask how Dad will know it was received and when the change reaches the people answering calls. HHS, revocation requirements, collected in Sources.

Also decide what happens to copies already in your possession. A provider can stop future disclosures, but it cannot pull information back out of your desk drawer. Tell Dad where you will keep records, whether you will print them, and who else can see them.

Test the release instead of admiring the signature

After the provider accepts the form, call the number you will actually use. Ask the staff member to confirm three things without requesting sensitive details: that the authorization is visible, that you are listed correctly, and that its scope covers the job you named.

If the answer is, "We cannot speak with you," do not argue from the parking lot. Ask whether the problem is identity verification, missing pages, the wrong legal entity, an excluded record type, an expired form, or a form that has not reached the chart. Those are different failures with different fixes.

Tonight, write the one job Dad has agreed you may do. Put the proposed authorization beside that sentence. Circle the information, sender, recipient, purpose, expiration, and revocation instructions. Anything you cannot circle becomes tomorrow's first question to the provider's records or privacy office.