You have power of attorney. You call the doctor's office for test results. They won't tell you anything.
This is one of the most common and most infuriating surprises in caregiving, and it usually isn't the office being obstructive. It's a gap in the paperwork that most families don't know exists.
General information, not legal advice — and practices vary between providers and states.
What HIPAA actually does
The HIPAA Privacy Rule restricts how healthcare providers share a patient's protected health information. The default is that they don't share it, and the penalties for getting that wrong are real — which is why staff tend to be cautious.
The rule does permit providers to share relevant information with family involved in someone's care, using professional judgment. In practice, many organizations train staff to be conservative, so "permitted" often becomes "won't."
Why your POA may not open the door
Two documents get conflated here, and neither does quite what people assume.
A financial power of attorney covers money — banking, bills, property. It gives you no claim on medical information at all.
A healthcare power of attorney (healthcare proxy, medical POA) authorizes you to make medical decisions — but typically only once the person lacks capacity to decide for themselves. While your parent is still competent, the proxy may not be active, and the provider may quite correctly decline to discuss anything with you.
So there's a long middle period — often years — where your parent is capable but needs your help managing appointments and results, and you have no standing to get information. That's exactly the period most caregivers are in.
The fix: a HIPAA authorization
A HIPAA authorization is a separate document in which the patient names specific people who may receive their health information. It works regardless of capacity, and it's usually a one-page form.
Some things to get right:
- Every organization has its own form. The hospital, each specialist, the primary care practice, the lab, the pharmacy, the insurer. There is no universal one that everyone accepts — expect to sign several.
- Name everyone who might need it, not just the primary caregiver. If a sibling might call on a weekend, they need to be listed too.
- Check the scope. Some forms let the patient exclude categories — mental health, substance use, HIV status. Others have expiration dates. Read what you're signing.
- It must be signed while the person has capacity. Like every other document in this category, this is a thing to do early. Once capacity is gone, this option closes and you're relying on the healthcare proxy plus provider discretion.
Do this too: patient portal proxy access
Often more useful day-to-day than the paperwork. Most health systems allow "proxy" or "caregiver" access to a patient's online portal, letting you see results, message the care team, and manage appointments under your own login.
Ask for proxy access at every system your loved one uses. It takes a form and a few minutes at the front desk, and it saves an enormous number of phone calls.
A word of caution: many families skip this and just share the patient's password. That's understandable, and it usually works, but it means you're acting as them rather than as an authorized caregiver — which can muddy things and may violate the portal's terms. Proper proxy access is better where it's offered.
What HIPAA does not do
- It doesn't block emergency treatment. Clinicians will treat someone unconscious without hunting for paperwork.
- It doesn't stop providers talking to each other about a patient's care.
- It doesn't restrict the patient. They can always request their own records.
- It doesn't bind you. HIPAA applies to healthcare providers and related entities, not to family members.
If someone refuses to let you visit or cites HIPAA to shut down all family communication in an emergency, that's often a misapplication of the rule. It's reasonable to ask politely for a supervisor or the facility's patient advocate.
Practical checklist
- Sign a HIPAA authorization at each provider — primary care, every specialist, hospital, pharmacy, insurer.
- Set up portal proxy access everywhere it's offered.
- Keep a copy of each signed authorization somewhere every family caregiver can reach at 2am, not in one person's filing cabinet. This is exactly what the legal documents section is for — track which providers you've filed with and which are still outstanding.
- Re-check after any change — new specialist, new hospital system, or a form that's expired.
- Bring a copy to hospital admissions rather than assuming it's on file. Records don't reliably follow patients between systems.
The wider point
The pattern here repeats across everything legal in caregiving: the documents are far easier to put in place before you need them, and several of them can only be signed while the person still has capacity. A HIPAA authorization takes ten minutes at a front desk today. Working around its absence, later, can take weeks.