Personal Representatives & Authorization

What this guide covers

Family members, friends, and professional patient advocates often hit the same wall: "I can't speak with you unless the patient signs a release." Personal Representatives & Authorization explains the main legal tools that unlock communication and records—and how to use them without mixing up forms that look similar but do different jobs.

This is a beginner guide for advocates, not legal advice. State laws on health care decision-making, guardianship, and minors vary. When documents must meet state-specific wording, pair this guide with state guides, state advance directive forms, and local legal help for high-stakes disputes.

Background on HIPAA rules: HIPAA & Privacy Rights. How to obtain copies once permission is clear: Accessing Medical Records.

Why authorization matters

Without proper authority, advocates cannot reliably get clinical updates, billing detail, claim status, or chart pages for an appeal. Guessing leads to delayed care, duplicate tests, and avoidable denials when key documents never reach the insurer.

Clear permission helps you:

Speak with nurses, doctors, and billing offices on the patient's behalf
Request and receive medical and billing records
File insurance appeals and sign plan forms
Coordinate care across providers
Resolve billing disputes without the patient repeating the story daily

Permission should be narrow (what information, which providers, how long) and dated. Over-broad releases slow privacy offices and create risk if the relationship changes.

Three tools advocates confuse

HIPAA authorization

A HIPAA authorization is a written permission for a covered entity to disclose specific PHI to a named person or organization for a stated purpose. It is not the same as the Notice of Privacy Practices patients receive at check-in.

Core elements federal law expects include:

Description of the information to be shared (specific or reasonably specific)
Who may disclose and who may receive
Purpose of the disclosure
Expiration date or event
Right to revoke in writing and how
Patient signature and date (or personal representative signature with authority attached)

HHS lists authorization requirements at HHS — HIPAA authorizations. Use facility-specific forms when required, but check that all elements are present.

HIPAA personal representative

A personal representativestands in the patient's shoes for HIPAA rights when the patient lacks capacity to exercise them, or for deceased patients under HIPAA's rules. Authority may come from state law—health care power of attorney, court-appointed guardian, parent of a minor, executor of an estate—not from being the person the patient "would have wanted."

The representative may sign access requests, authorizations, and restrictions the patient could have signed. The clinic may ask for proof: POA pages, guardianship order, letters testamentary, or birth certificate for a parent.

Health care power of attorney

A health care power of attorney (health care agent, proxy, attorney-in-fact for health decisions) is a state law document. It lets an agent make medical decisions when the patient cannot, within limits the form and state statute set. It may or may not automatically include every HIPAA disclosure advocates need—some forms are decision-making only; others mention records access explicitly.

Planning-focused overview: Healthcare Power of Attorney / Proxy. Caregiver angle: Permissions, HIPAA & Decision-Making Access.

Building a strong HIPAA release

When the patient can sign, walk through these steps:

Name the recipient— full legal name of the advocate or family member, not "family."
Scope the information— "All records" vs. "Billing records March–June 2026 from [facility]." Match the task.
Name disclosing parties— specific hospital, physician group, lab, or "any provider who treated [patient] for [condition/ dates]."
State the purpose— "Care coordination," "insurance appeal," "billing dispute," or "legal representation."
Set an expiration — one year is common; renew before appeals finish.
Sign and date — patient signs; witness or notary only if the form requires it.
Deliver to the right office — Health Information Management for records; billing for statements; insurer portal for plan forms.

Templates: Patient Rights Templates. Keep a copy for yourself before faxing the original.

When the patient cannot sign

Documents to collect

Ask the family what already exists:

Executed health care POA / health care proxy
Court guardianship or conservatorship order
Advance directive or living will (may name an agent even if focus is treatment wishes)
Rep payee or Social Security appointment letters (financial, not clinical—but clinics sometimes ask)
For deceased patients: executor or administrator appointment, death certificate

If nothing exists and the patient lacks capacity, the family may need emergency guardianship or rely on limited verbal updates until documents are signed. That path is state-specific and slow—another reason to encourage advance planning before crises.

Guardianship & conservatorship

A guardian (or conservator) appointed by a court has authority defined in the court order—sometimes medical decisions only, sometimes broader. HIPAA treats a court-appointed guardian as a personal representative when the order covers health care decisions. Bring a certified copy of the order to the privacy officer; do not assume staff will accept a phone description of the ruling.

Verbal permission & patient on the line

HIPAA permits many treatment-related conversations when the patient is present and agrees, or when professional judgment supports sharing with someone involved in care. That is fragile for ongoing advocacy.

Three-way call — patient on the line authorizes the advocate to hear and ask questions; note date and staff name in your log.
Bedside consent — alert patient signs a release while lucid, even during short windows in ICU.
Do not rely on verbal OK alone for records release, appeals, or weeks of billing follow-up.

Insurance & appeal representatives

Health plans often require their own appeal representation or appointment of representative forms in addition to HIPAA releases. Medicare, Medicaid managed care, and commercial plans differ. A complete HIPAA authorization to the insurer does not replace plan-specific appeal paperwork.

Check the denial letter for instructions. Use the Appeals Roadmap, Appeals Generator if your workflow includes it, and state playbooks when deadlines are tight. Authorize the advocate to receive copies of all appeal decisions.

For Medicare, an appointed representative can request an appeal and receive decision letters. Keep scope tied to the claim or enrollment issue at hand.

Patient portal access

Patient portals are usually tied to the patient's login, not a separate advocate account. Options:

Patient grants proxy or caregiver access if the portal supports it (varies by EHR vendor)
Patient shares login credentials (common in families but not ideal for security)
Advocate uses formal records requests instead of the portal for legal copies

Proxy access does not replace HIPAA releases to billing departments or insurers. Set expectations with families about what the portal can and cannot show (often missing nursing notes, imaging files, or older visits).

Minors & deceased patients

Parents and legal guardians generally exercise HIPAA rights for minor children, with exceptions when state law lets minors consent to certain care and shield those records from parents.

After death, HIPAA protects the decedent's information for 50 years. The personal representative of the estate, or persons authorized under state law, may access records for authorized purposes. Combine with probate documents when hospitals demand proof.

Advocate workflow checklist

Before a crisis

Encourage health care POA and HIPAA releases naming the primary caregiver or advocate
Store forms where family can find them (not only a safe deposit box)
List insurer member services numbers and portal logins in a shared document the patient controls

During hospitalization

Ask patient relations or the privacy officer how to file authorization
Get releases on file before discharge when possible—HIM backlogs worsen after the patient leaves
Confirm whether the POA is scanned in the electronic chart

After a denial or bill

Match authorization scope to the appeal or billing task
Request records under patient access rules in parallel—see Accessing Medical Records
Build the packet in Evidence Packets

Scenarios beginners run into

Adult child at bedside

Patient is alert. Have the patient sign the hospital's HIPAA form naming the child for information and decision discussion. If the child will handle billing and appeals, add a separate authorization to billing and the insurer. Photograph signed forms for the family file.

Spouse out of state

Fax or secure-email signed releases to the facility before calls. Use the patient portal only if the patient sets it up. Schedule three-way calls when staff resist email releases.

POA exists but hospital has no copy

Privacy office may refuse to treat the agent as representative until the POA is on file. Send a readable PDF immediately; follow up with certified mail if urgent decisions or records are blocked. Ask whether a covering physician can note the agent in the chart after review.

Siblings disagree

HIPAA follows legal authority, not family consensus. If one sibling holds POA, that agent generally acts unless the court says otherwise. Document concerns through the hospital grievance process or ethics consultation—see Hospital Grievances—rather than expecting staff to arbitrate family conflict without legal direction.

Insurer will not talk to advocate

Confirm the plan received its representation form and HIPAA authorization. Ask for a reference number. If still blocked, escalate to supervisor and note a potential privacy complaint path in Where to File Complaints.

Example:

Situation: Wife needs to dispute a $4,200 hospital bill. Husband has dementia and cannot sign.

Action: Locate health care POA naming the wife. Fax POA plus a HIPAA authorization from the wife as agent to hospital billing and HIM. Request itemized bill and clinical records for the admission. Parallel: file billing dispute per Billing Disputes once documents arrive.