Her Mother Is in the Hospital and the Nurses Won’t Tell Her Anything. One Signed Form Would Have Changed That

Hospital staff often decline to tell family members how a patient is doing, usually because of one federal privacy law and one form the patient hasn’t signed. That form is a HIPAA authorization: a signed note from the patient telling doctors and nurses who they can talk to. The law often allows more sharing than hospitals do.

What HIPAA Lets Hospitals Tell Family

HIPAA is often called the north star of federal health privacy law. Its Privacy Rule limits who can see or hear a patient’s medical information, and it also allows sharing with family. Under 45 CFR 164.510(b), providers may share. They can talk with a family member, another relative, a close friend, or anyone else the patient names, as long as the information directly relates to that person’s involvement in the patient’s care.

When the patient is present and able to make decisions, staff can ask the patient out loud and take a spoken yes, give the patient a chance to object, or reasonably infer from the circumstances that the patient doesn’t mind. HIPAA doesn’t require any of this to be written down, though some hospital policies do.

Sometimes the patient isn’t around or can’t give permission. HHS consumer guidance then says the provider may share or discuss the patient’s health information with family, friends, or others involved in her care. In an emergency or when the patient is incapacitated, that usually depends on staff judging that telling the family is in the patient’s best interest. The rule uses the word “may.” HIPAA permits disclosures to family and friends but does not require them, so each provider decides, and many hospitals decline to share.

One Signed Form Settles the Question

A HIPAA authorization is the patient’s written permission for providers to release her health information to the people she names. The rules for it are in 45 CFR 164.508. A valid one must describe the information to be shared, name who may share it and who receives it, and state the purpose. It also needs an expiration date or event, the patient’s signature and date, and a statement of the patient’s right to cancel it in writing. Once it’s in the chart, staff have the patient’s wishes in writing and don’t have to guess.

Why Families Usually Need Three Separate Documents

A health care power of attorney names an agent who makes medical decisions when the patient can’t. Some states call it a “health care proxy.” A HIPAA authorization covers information only. It doesn’t give anyone decision-making authority. Lawyers point out that having a directive and a medical power of attorney doesn’t necessarily give someone access to the records. A separate authorization is typically used so people who aren’t the agent, like other family members, can still get updates.

The third piece is a living will, another type of advance directive. The other kind is the health care power of attorney. A living will records the care a person would want if she couldn’t speak for herself. Each state has its own forms and requirements for these documents. That is why many families have an elder law attorney draft them for their state.

Moves That Help at the Bedside Right Now

Families stuck at the nurses’ station without paperwork still have a few options:

1. Families can ask to talk with the patient’s doctor or a hospital social worker, and they usually know the hospital’s policy better than whoever’s at the desk.
2. If the patient can talk, she can tell staff directly that it’s fine to share with her daughter. The rule allows spoken agreement.
3. Families can bring copies of any power of attorney, advance directive, or authorization already signed, so staff can add them to the chart.

Getting It Done While Everyone Is Healthy

These forms are easiest to sign when nobody is sick, and the patient can clearly understand what she’s signing. Families often give copies to each of her doctors and keep a scan on their phones so it’s ready in the ER. Many health systems also let patients give caregivers shared access to their online patient portals. Usually the patient has to sign the health system’s own form to set up that proxy access, which patients can ask about at an appointment.

Limits That Can Catch Families Off Guard

An authorization only works within its own terms. If the expiration date or event has passed, or the patient has canceled it in writing, it stops working. It also gives no decision-making power. Someone named only on an authorization can hear updates but can’t approve or refuse treatment.

That takes a power of attorney or proxy. Rules on signatures, witnesses, and notaries for state documents can differ, so a form that works in one state might be questioned in another. Some hospitals also ask patients to fill out their own version.

Of the three documents, the HIPAA authorization covers who can receive updates from hospital staff, and it names the people who should get updates and places the patient’s permission in the chart before anyone has to ask.

Contact [email protected] for any questions or corrections.