Caring for a parent, child, spouse, or other loved one often means handling their medical information — scheduling appointments, picking up prescriptions, or talking through results with their doctor. HIPAA protects each person's privacy, but it also recognizes that caregivers sometimes legitimately need access. The rules depend on the relationship, the person's age, and whether they can make their own decisions.
Personal representatives
Under HIPAA, a personal representative is someone with legal authority to make healthcare decisions for another person. In most cases, a personal representative has the same right to access that person's records as the patient would. Common examples include:
- A parent or guardian of a minor child, with some exceptions
- A person named in a valid healthcare power of attorney
- A court-appointed guardian
- An executor or administrator of a deceased person's estate
Proxy access to patient portals
Many health systems offer proxy or caregiver access, which lets an authorized person view a loved one's portal using their own separate login. This is far safer than sharing passwords, because it keeps each person's access properly recorded and can be revoked cleanly. Ask the provider's office how to set it up; in most cases the patient must sign an authorization first.
Minors and teenagers
Parents are generally the personal representatives of their minor children, so they usually can access those records. However, state law and certain sensitive services — such as some reproductive, mental health, or substance-use care — can limit a parent's automatic access. This is also why portal access for teenagers is often reduced once a child reaches a certain age, to protect the teen's confidential care under state law.
When the patient is an adult who can decide for themselves
If your relative is a competent adult, they control access to their own records — being family doesn't automatically grant you access. The simplest path is to have them either:
- Sign a written authorization allowing the provider to share information with you, or
- Set you up with proxy portal access so you can view their records directly.
Disclosures to family during care
Even without a formal authorization, a provider may share information that's directly relevant to your involvement in someone's care if the patient agrees, doesn't object when given the chance, or is not present and the provider judges sharing to be in the patient's best interest. This is what allows a doctor to update a spouse waiting outside the room.
| Situation | Usual path to access |
|---|---|
| Minor child | Parent/guardian as personal representative |
| Adult relative who can decide | Their signed authorization or proxy access |
| Incapacitated adult | Power of attorney or court guardianship |
Planning ahead for a loved one
The smoothest time to arrange access is before a crisis, not during one. If you anticipate caring for an aging parent or a spouse with a serious condition, consider helping them complete a healthcare power of attorney and set up proxy portal access while they're able to make those decisions clearly. Keep copies of any legal documents somewhere you can reach them quickly, and make sure their providers have those documents on file. Doing this work in advance spares you from scrambling for paperwork during a stressful hospitalization, when delays can directly affect the care your loved one receives.
When access is limited
If a provider declines to share information with you, ask them to explain the basis — it may be a state-law protection for a teen's confidential care, a missing document they need, or a patient who hasn't authorized the disclosure. Often the fix is simply providing the right paperwork or having the patient sign an authorization.