Caregiver access to medical records: which route fits

This is not clinical evidence and not medical advice. It does not replace your care team. Discuss anything here with your clinician before you act on it. It isn't legal advice either. The first time a front desk tells you "she has to call herself," it feels like a wall. Usually it's a question about which door you're using. OCR's guidance points to a few separate routes. A personal representative, someone with authority under state or other law to make health care decisions for the patient, generally stands in the patient's shoes and can use their access rights. Someone without that authority can still receive a copy if the patient signs a written request naming them, or signs a HIPAA authorization. And a provider may talk with family or friends involved in the patient's care, within limits, without any form. Many portals add a fourth, practical door: proxy or shared access. Which one fits depends on whether the patient can take part, and what legal paperwork already exists. The questions below take each route in turn. For how a records request works, what it costs, and what happens when it's refused, see Getting your medical records and How to get copies of your medical records.

Proxy access, also called shared access, gives a caregiver their own login to view a patient's portal. ONC's Patient Engagement Playbook says offering this to caregivers has become much more common, and that federal rules require certified health IT to let patients and patient-authorized representatives, such as family caregivers, view, download, and transmit the patient's health information. The setup runs through the provider's own process. ONC tells practices to make registration steps and timelines clear to patients and caregivers, and notes access can be set at different levels, for example limiting an adolescent's information or sensitive items. MedlinePlus notes that a parent of a child under 18 may be given access to the child's portal too. So consider starting with the patient, while they can still click "invite," or with the clinic's portal help line. Ask what the proxy will and won't be able to see.

It's tempting when you're already juggling three portals. ONC's playbook points out the catch: when a patient shares their own credentials, the caregiver sees everything in that portal, including the patient's private messages to and from clinicians. ONC encourages practices to give each caregiver a unique, secure login instead. It says this respects the patient's preferences and improves security, because each person's use can be tracked separately. ONC also notes that separate caregiver access helps a practice tell whether it's exchanging secure messages with the patient or with someone helping. Consider asking your parent what they actually want you to see. Then ask the clinic about a proxy account set to that level.

OCR defines a personal representative as someone authorized under state or other applicable law to make health care decisions for the patient. For an adult, OCR's examples are a health care power of attorney, a court-appointed legal guardian, or a general or durable power of attorney that includes health care decisions. For a minor, it's usually a parent, guardian, or someone acting in place of a parent. The scope follows the authority. OCR says someone with broad decision-making authority is treated as the patient for all purposes, but someone holding a limited power of attorney for one decision, such as life support, counts only for information related to that decision. Parents of minors have exceptions. OCR lists three: the minor may lawfully consent to a service and does; a court or someone else is authorized to consent; or the parent agreed to a confidential relationship between the teen and the clinician. State law on parental access also controls. Because authority comes from state or other law, OCR says that law should be consulted. Consider bringing a copy of the actual document to the records office rather than describing it.

Yes, through two routes OCR describes. Under the right of access, the patient can direct the provider to send a copy of their records to you. OCR says that request must be in writing, signed by the patient, and clearly name you and where to send it, and the provider must comply except in limited circumstances. Separately, the patient can sign a HIPAA authorization letting the provider disclose information to any person, including a family member. OCR says an authorization can cover an "entire medical record" or "complete patient file," but a vague "all protected health information" may not be specific enough. For the basic rule on a family member requesting records, see Getting your medical records. The practical difference here: either route needs the patient's own signature, so it works best while the patient can still give it.

More than many front desks suggest. OCR says a provider may share information with family or friends who are involved in the patient's care or payment for care if the patient says it's fine, doesn't object, or the provider judges the patient doesn't object. OCR's example: if you don't object, your doctor could talk with the friend who goes with you to the hospital. HIPAA doesn't require written permission for this, OCR says, though the provider may prefer or require it. Consider asking about the clinic's own rule. The limits matter. Sharing is limited to what the person needs to know about the patient's care or payment. OCR's example: a nurse may not tell a patient's friend about a past medical problem unrelated to the current condition. And HIPAA doesn't require the provider to share with family or friends who aren't personal representatives. This conversation route is not a right to copies of the chart.

OCR addresses the moment, not the diagnosis. If the patient isn't present or is incapacitated, a provider may share information with family or friends if, in professional judgment, it's in the patient's best interest, limited to what that person needs for the patient's care or payment. OCR also says the provider isn't required to share and can wait until the patient can agree. For ongoing access, OCR's personal-representative guidance names a legal guardian of an adult and a health care power of attorney as people who must generally be treated as the patient. What those documents cover depends on state or other law. One exception: OCR says a provider may decline to treat someone as a personal representative if it reasonably believes the patient has been or may be subjected to abuse or neglect by that person, or could be endangered. Consider talking with the care team early, while your parent can still weigh in on who should be involved.

Briefly: OCR says HIPAA protects a person's health information for 50 years after death. During that time the personal representative, an executor, administrator, or other person with authority under state or other law over the decedent or estate, can exercise the decedent's rights, including access. Family or friends who were involved in care before the death, but aren't personal representatives, may receive information relevant to that involvement, unless that conflicts with a preference the person expressed that the provider knows about.

A short list saves a second phone tree. Consider asking: - Do you offer proxy or shared portal access, how does the patient set it up, and what will the proxy see? - What do you need to see to recognize me as a personal representative: a copy of the power of attorney or guardianship papers? - Do you have your own form for the patient to name me, or will you accept a signed letter that names me and where to send the copy? - What does your office require before staff will discuss my parent's care with me by phone? OCR notes HIPAA doesn't require written permission for those conversations, but providers may prefer or require it, so asking about the clinic's rule is reasonable. Once copies start arriving from several offices, keeping them together is its own job. Triangle is built to bring records from different doctors into one place. It doesn't diagnose or replace the care team.