California Advance Directive and HIPAA Authorization

You named a healthcare agent in your California advance directive. Your agent shows up at the hospital ready to make decisions. The nurse says they can't share your medical information because they don't have HIPAA authorization on file.

This happens more often than it should. California's AHCD grants your agent the authority to make healthcare decisions — but the federal Health Insurance Portability and Accountability Act (HIPAA) creates a separate layer of privacy protection that hospitals interpret conservatively.

Why Your AHCD Alone May Not Be Enough

Under Probate Code Section 4683, a California healthcare agent has the right to access your medical records to the same extent you could access them yourself. This should, in theory, override HIPAA concerns. In practice, hospital compliance departments are cautious.

The issue is timing. Your AHCD only activates when you lack capacity to make decisions yourself (unless you've specified immediate authority). But HIPAA authorization can be useful before incapacity — for example, allowing your agent to discuss your treatment plan with your oncologist while you're conscious but too fatigued to manage calls yourself.

A standalone HIPAA authorization form covers these gaps:

• Access to medical records before incapacity
• Communication with insurance companies about claims
• Access to mental health and substance abuse records (which have additional federal protections under 42 CFR Part 2)
• Access to HIV/AIDS-related information (protected under California Health and Safety Code Section 120980)

What a Proper HIPAA Authorization Includes

A HIPAA-compliant authorization for California must contain:

1. Specific description of information: What records your agent can access (all medical records, or specific categories)
2. Who can disclose: Which providers or facilities are authorized to release information
3. Who can receive: Your named agent(s)
4. Purpose: "At the request of the individual" or "for healthcare decision-making"
5. Expiration date or event: Can be "upon my written revocation" for ongoing access
6. Your signature and date
7. Right to revoke: Statement that you can withdraw authorization at any time

Unlike your AHCD, HIPAA authorization doesn't require witnesses or notarization. Your signature alone makes it valid.

Mental Health and Substance Abuse Records

California adds extra protections beyond standard HIPAA for certain categories:

• Psychotherapy notes: Require separate, specific authorization even from your healthcare agent
• Substance abuse treatment records (42 CFR Part 2): Require their own consent form — a general HIPAA authorization doesn't cover programs receiving federal funding
• HIV/AIDS test results: California Health and Safety Code Section 120980 requires specific written authorization before disclosure

If any of these categories are relevant to your medical history, you need explicit language in your HIPAA authorization covering them. A generic "all medical records" clause may not be honored by providers who maintain these protected categories separately.

How to Integrate HIPAA with Your AHCD

The cleanest approach is a two-document strategy:

1. Your AHCD — names your agent, grants decision-making authority under Probate Code Section 4701, takes effect upon incapacity
2. Standalone HIPAA authorization — grants records access immediately, covers all categories including protected ones, remains effective until you revoke it

Some California AHCD forms include a HIPAA waiver paragraph within the document itself. This is better than nothing, but hospitals that maintain separate compliance databases for HIPAA authorizations may not cross-reference your AHCD. A standalone form that their records department can file separately eliminates this friction.

What Your Agent Should Carry

When your healthcare agent arrives at a hospital or doctor's office, they should have:

• A copy of your executed AHCD showing their appointment
• A copy of your HIPAA authorization with their name explicitly listed
• Photo ID matching the name on both documents
• Your physician's contact information for verification

Getting Both Documents Right

The California Advance Directive & Living Will Kit includes both the AHCD and a California-specific HIPAA authorization form that covers standard medical records plus the protected categories (mental health, substance abuse, HIV/AIDS) that generic forms miss. The agent briefing template walks your agent through exactly what to say and show when requesting records access.

See more California guides →