A HIPAA authorization is a signed permission that lets a doctor, hospital or insurer share your health information with the people you name. It is not the same as a healthcare power of attorney, which lets someone make medical decisions for you. Many estate plans include both so the people you trust can get information when you cannot ask for it yourself.
Under the HIPAA Privacy Rule, a covered entity such as a hospital or health plan generally needs your written authorization to use or disclose your protected health information for purposes the rule does not otherwise permit. The federal regulation lists what a valid authorization must contain (45 CFR 164.508).
| HIPAA authorization | Healthcare power of attorney | |
|---|---|---|
| Main purpose | Permits sharing of your health information | Names someone to make medical decisions if you cannot |
| Gives decision-making power? | No | Yes, within the document and state law |
| Typical user | Anyone who wants named people to see records | Anyone planning for possible incapacity |
| Can be revoked? | Yes, in writing | Yes, while you have capacity, under state rules |
Under HIPAA, if state law gives a person authority to make health care decisions for an adult, a covered entity must generally treat that person as a "personal representative" (45 CFR 164.502(g)). That is why a healthcare power of attorney often helps with access too. A separate authorization still adds clarity and can name people who are not your agent, such as a sibling who helps with care. See our guides to healthcare power of attorney and healthcare directive vs living will.
Sometimes. HIPAA permits providers to share information directly relevant to a family member's or friend's involvement in your care, using professional judgment and, when you are present, with your agreement or without your objection (45 CFR 164.510(b)). That is discretionary, not a right, and providers differ in how cautiously they apply it. A signed authorization removes the guesswork.
HIPAA protections continue for 50 years after death (45 CFR 164.502(f)). If an executor or administrator has authority under state law to act for the deceased person or the estate, the covered entity must treat that person as a personal representative for relevant information (45 CFR 164.502(g)(4)). Executors often need records for insurance, benefits or disputes. See the executor checklist.
Many online estate planning services include a HIPAA release with their healthcare documents. Trust & Will is the service we link to for guided estate plans; check what it includes and its current pricing on its own site. LawDepot offers templates you can compare. Our best healthcare directive services guide covers more options. For a complex family or medical situation, ask an estate planning attorney.
It is a signed permission that lets a healthcare provider or plan disclose your protected health information to people you name.
No. A HIPAA release allows information to be shared. A healthcare power of attorney names someone to make medical decisions for you. Many plans include both.
It must contain an expiration date or expiration event. You can also revoke it in writing at any time.
HIPAA itself requires a signature and date, not a notary. Some providers or state rules may ask for more, so check with the provider.
People you trust with private medical details, such as a spouse, adult child or close friend, plus a backup.
Yes, for 50 years after death, and an executor with authority under state law is treated as a personal representative for relevant information.
Yes. Many people sign a HIPAA authorization along with a healthcare power of attorney and living will.
Sources: Cornell LII, 45 CFR 164.508; 45 CFR 164.502; 45 CFR 164.510 (checked October 27, 2026). State law varies; confirm with an attorney.
Our 60-second quiz points you to the right service.
Take the Free Quiz →