Colorado HIPAA Authorization Form: Accessing a Loved One's Medical Records

You call your mother's doctor for test results and get stonewalled. You try to discuss your father's medication changes with his pharmacist and hear "we can't disclose that information." Welcome to HIPAA — the federal privacy law that treats every adult's medical information as confidential, even from their closest family members, unless a proper authorization is in place.

Why HIPAA Blocks Family Members

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule prohibits healthcare providers, insurers, and pharmacies from disclosing protected health information (PHI) to anyone — including spouses, parents of adults, and adult children — without the patient's written authorization. Once your child turns 18, you have no automatic right to their medical information. Once your parent enters a hospital, you cannot access their chart without authorization.

This isn't a Colorado-specific rule — it's federal. But the solution is executed at the state level, and Colorado's advance directive documents interact with HIPAA authorization in specific ways.

HIPAA Release vs. Medical Power of Attorney

These two documents serve different purposes:

HIPAA Authorization: Grants named individuals permission to receive your protected health information — view records, speak with providers about your condition, access billing details. It's a disclosure permission slip.

Medical Durable Power of Attorney (MDPOA): Grants one person authority to make medical decisions on your behalf when you're incapacitated. It implicitly includes access to medical information for decision-making purposes.

The overlap causes confusion: if the MDPOA implicitly grants record access, why do you need a separate HIPAA form? Because:

• The MDPOA only activates when you're incapacitated (if it's springing). Before incapacity, your agent has no authorization.
• Some insurance companies, pharmacies, and medical billing offices demand a standalone HIPAA release regardless of the MDPOA.
• You may want family members to access information even when no one has decision-making authority — routine appointment discussions, prescription questions, billing issues.
• A HIPAA authorization can cover people beyond your MDPOA agent — adult children, close friends, or multiple family members.

What a HIPAA Authorization Should Specify

An effective HIPAA release for Colorado healthcare planning includes:

• Named recipients — specific individuals authorized to receive your information (by full name)
• Scope of information — all medical records, or limited categories (mental health, substance abuse, HIV/AIDS records have additional federal protections requiring explicit authorization)
• Purpose — ongoing healthcare management, or limited to specific conditions/episodes
• Duration — how long the authorization remains valid (indefinite until revoked, or a specific end date)
• Right to revoke — acknowledgment that you can withdraw authorization at any time in writing

The College Student Emergency

Parents of college students attending Colorado institutions (CU Boulder, Colorado State, University of Denver, Colorado College) face this issue acutely. The day your child turns 18, HIPAA's privacy protections fully apply. If your 19-year-old is rushed to a hospital in Fort Collins after an accident, the ER cannot tell you their condition, test results, or treatment plan without authorization.

The combination of a signed HIPAA authorization plus an MDPOA (even a simple standing one) ensures you can both receive information about your child's condition and make medical decisions if they're unable to communicate. Many families execute these documents before move-in weekend and never think about them again — until the one emergency that makes them essential.

Executing the HIPAA Authorization

Unlike the Colorado Living Will (which requires witnesses or notarization), a HIPAA authorization has simpler execution requirements under federal law:

• Signed and dated by the patient
• Must contain specific required elements (description of information, who can disclose, who receives, purpose, expiration, revocation rights)
• No witnesses or notarization required by federal law (though some providers prefer notarization for verification)

The authorization takes effect immediately upon signing and can be revoked at any time through written notice to your healthcare providers.

Distributing Copies

Like all advance planning documents, a HIPAA authorization only works if the relevant parties have it on file. Distribute copies to:

• Your primary care physician
• Any specialists you see regularly
• Your health insurance company
• Your pharmacy
• Hospital medical records (upload to patient portal)
• Each person named as an authorized recipient (so they can present it when contacting providers)

Coordinating with Your Advance Directive Package

The most effective approach is executing your HIPAA authorization alongside your other advance planning documents (MDPOA, Living Will, CPR Directive worksheet) so everything is current, consistent, and distributed at the same time. The same witnesses or notary session can cover all documents (even though HIPAA authorization doesn't legally require it, having it notarized prevents provider pushback).

The Colorado Advance Directive & Living Will Kit includes a HIPAA authorization template designed to work alongside the MDPOA, with clear instructions on scope, duration, and distribution to Colorado healthcare systems.

See more Colorado guides →