HIPAA authorization and a health care directive

A client can have a carefully drafted health care directive and still discover that family members do not know how to obtain the information they need. The planning question is how decision-making authority, access to records, and permission to share information fit together.

The directive and HIPAA do different jobs

A health care power of attorney or advance directive is a state-law document. It can name an agent and define when the agent may make health decisions. HIPAA is a federal privacy framework governing protected health information held by covered entities and business associates. It identifies when a personal representative may exercise a patient's rights and when a covered entity may disclose information.

Under HIPAA, a person authorized under applicable law to make health care decisions for a patient is generally treated as that patient's personal representative. The representative can exercise the patient's rights within the scope of that authority, including access to relevant records. If a health care power of attorney is springing, the agent's HIPAA role may not begin until the document becomes effective. A limited authority may cover only information relevant to the specific decision.

When a separate authorization can help

A client may want a spouse, adult child, or other trusted person to receive information even before that person is acting as a legal personal representative. A HIPAA authorization can identify the information, recipient, purpose, and period of permission. It may reduce practical delays, but it does not automatically appoint the recipient to make medical decisions.

The distinction is important: permission to receive information is not necessarily authority to choose treatment, and authority to make a particular health decision may not grant unlimited access to every record for every purpose. The documents should match the role the client intends.

Limits and exceptions

HIPAA includes exceptions. A provider may decline to treat someone as a personal representative when professional judgment supports a reasonable belief that doing so could expose the patient to abuse, neglect, or endangerment. State law also governs the representative's underlying authority, including rules for minors, guardianship, and the activation of directives.

Planning checklist

1. Confirm who is appointed and whether the directive is immediately effective or triggered by incapacity.
2. Check whether the person's authority covers all health decisions or only a defined treatment.
3. Ask whether the client also wants another person to receive specified information through a HIPAA authorization.
4. Coordinate the documents with state-law counsel and ask the health system about its accepted forms and process.
5. Review after marriage, divorce, relocation, a change in health, or a change in trusted decision-makers.

A CFP professional can prompt the discussion and coordinate the estate plan with the client's broader incapacity plan. Drafting the directive, interpreting state law, or advising on a specific HIPAA dispute belongs with qualified legal counsel and the relevant health care organization.

Two documents solve different problems

A HIPAA authorization permits a covered entity to use or disclose specified protected health information to designated people for specified purposes. It is a privacy permission, not an appointment of a medical decision-maker. A healthcare power of attorney or healthcare proxy names an agent to make decisions when the patient cannot do so under the document and state law. A living will or advance directive records treatment preferences for particular circumstances.

A family member can be authorized to receive medical information without having authority to consent to surgery or choose treatment. Conversely, an appointed healthcare agent may need records to make decisions, but the directive and privacy documents should be coordinated so providers can verify the authority. A general emergency contact designation is not necessarily a HIPAA authorization or a valid proxy appointment.

The client should choose people who understand their wishes and can act under stress. Name successors, communicate the appointment, and make copies available to the agent and providers. State forms, witnessing rules, and default-surrogate laws vary. A document valid in one state may need review after relocation or a change in family circumstances.

What makes an authorization usable

A HIPAA authorization generally describes the information to be disclosed, who may disclose it, who may receive it, the purpose, an expiration date or event, and the individual’s signature. The Privacy Rule also requires statements about revocation, conditioning treatment or payment, and the possibility of redisclosure. An authorization that is too vague or expired may not be accepted. The covered entity can explain its form requirements, but the client should understand what access it grants.

The client can limit an authorization to certain providers, records, or a period. This may protect sensitive information while still giving an agent access to what is needed. Broad access can help a spouse coordinate care but also exposes more information. The individual may revoke the authorization in writing, subject to actions already taken in reliance on it. Keep the document current and store it with the advance directive.

A HIPAA authorization is not the only circumstance in which a provider may disclose information. The Privacy Rule permits certain disclosures to personal representatives and in emergencies, subject to law and professional judgment. A family member does not automatically become the personal representative merely by being related. The relationship, authority document, and state law matter.

Coordinate documents in the broader plan

Review the financial power of attorney separately. It appoints an agent for financial affairs, not medical decisions, and its authority may end at death. A healthcare agent generally does not gain power to pay bills or manage investments unless separately named under a financial document. Naming the same person in both roles may simplify coordination, but it can also concentrate authority; client preference and safeguards should guide the choice.

During incapacity, the agent may need to coordinate medical information, insurance, care providers, and family communications. The document should tell the agent how to apply the client’s preferences and whom to consult. The client can discuss values such as comfort, independence, faith, and acceptable quality of life. These conversations help the agent act when written instructions do not answer every medical scenario.

For CFP exam questions, ask whether the problem concerns information privacy, treatment decisions, or financial authority. HIPAA authorization addresses access to protected health information. A healthcare directive appoints or guides a medical decision-maker. Durable financial power of attorney covers financial matters while the principal is alive. The documents should work together, but they are not interchangeable.