Connecticut Advance Directive and HIPAA: How to Ensure Your Representative Can Access Medical Records

Appointing a health care representative in your Connecticut advance directive gives that person the authority to make medical decisions when you cannot. It does not automatically give them access to your medical records. Without a separate HIPAA authorization, your representative may not be able to get the information they need to make informed decisions — and the gap usually surfaces at the worst possible time.

Here is how HIPAA interacts with Connecticut's advance directive, what a HIPAA authorization should include, and why most off-the-shelf advance directive forms leave this piece out.

The Problem: Authority Without Information

Under Connecticut General Statutes § 19a-575a, your health care representative has broad medical decision-making authority once your physician determines you lack capacity. They can consent to treatment, refuse procedures, and direct end-of-life care.

But HIPAA (the Health Insurance Portability and Accountability Act) is a federal law that restricts who can access your protected health information. A state-level health care representative appointment does not automatically satisfy HIPAA's disclosure requirements.

In practice, this means your representative might have the legal authority to decide whether you receive a certain treatment — but cannot access the medical records that explain your current condition, medication history, or test results. They are being asked to make decisions with incomplete information.

When the Gap Shows Up

Before incapacity. If your representative is helping coordinate care while you are still competent — driving you to appointments, picking up prescriptions, talking to specialists — providers may refuse to share information with them without a HIPAA authorization on file.

During a medical crisis. Your representative arrives at a Connecticut hospital and needs to understand your condition to make treatment decisions. The attending physician can share information directly during clinical conversations, but the representative's access to charts, lab results, and records from other providers may be restricted.

Across providers. Your primary care physician may share information with your representative, but a specialist, pharmacy, or out-of-network facility may require their own documentation before releasing records.

What a HIPAA Authorization Should Include

A HIPAA authorization is a separate document from your advance directive. It should specify:

Who is authorized. Name your health care representative and alternate representative by full name. Include anyone else you want to have access — a spouse, adult child, or other family member.

What information is covered. You can authorize access to all medical records, or limit it to specific categories. Most people authorize broad access because narrow authorizations create gaps when unexpected conditions arise.

Which providers are covered. You can name specific providers or use broad language covering all healthcare providers, plans, and clearinghouses that maintain your records.

Duration. The authorization can be open-ended ("until I revoke it in writing") or time-limited. For advance care planning, open-ended is standard.

Your signature and date. HIPAA authorizations must be signed by the patient while they have capacity. Some providers also require a witness, though HIPAA itself does not mandate one.

Why Most Advance Directive Forms Skip This

Connecticut's official combined advance directive form from the Attorney General's office does not include a HIPAA authorization section. It addresses the appointment of a health care representative, living will instructions, conservator designation, and anatomical gifts — but HIPAA compliance is treated as a separate matter.

This is legally correct — HIPAA is a federal regulation and the advance directive is a state document — but it is a gap that catches families off guard. National form sites sometimes include a generic HIPAA release, but these may not meet the specific requirements of Connecticut healthcare providers or may use language that is too vague to be effective.

The Connecticut-Specific Angle

Connecticut healthcare providers — particularly hospital systems like Yale New Haven Health and Hartford HealthCare — have their own HIPAA policies and release forms. Some will accept a generic authorization, while others require their own form to be completed.

The practical approach:

1. Complete a standalone HIPAA authorization as part of your advance care planning
2. Ask your primary care physician if they have a facility-specific release form that should also be completed
3. If you are being admitted to a hospital, ask the admissions department whether they need a separate HIPAA authorization beyond your advance directive

Integrating HIPAA With Your Advance Directive Package

When you execute your Connecticut advance directive, add the HIPAA authorization to your planning package:

1. Execute the advance directive with two witnesses (plus optional notarized affidavit)
2. Sign the HIPAA authorization — no witnesses required under federal law, though some providers prefer them
3. Execute the financial POA with two witnesses and mandatory notarization
4. Distribute all three documents together to your representative, physicians, and facilities

Distributing the HIPAA authorization alongside the advance directive ensures that when your representative presents the directive, they can also demonstrate they have authorization to access your medical information. This prevents the "you have authority but we can't tell you anything" problem.

What Your Representative Should Know

Tell your representative:

• They should carry a copy of both the advance directive and the HIPAA authorization
• They may need to present the authorization at each new provider or facility
• If a provider refuses to accept the authorization, they should ask for the provider's own release form and have it on hand for future interactions
• The authorization does not expire unless you included an expiration date or revoke it in writing

Revoking the Authorization

You can revoke a HIPAA authorization at any time by notifying the covered entities in writing. Revocation is prospective — it does not affect disclosures that already occurred while the authorization was active.

If you revoke your advance directive, consider whether you also want to revoke the HIPAA authorization. They are independent documents — revoking one does not automatically revoke the other.

The Connecticut Advance Directive & Living Will Kit includes a HIPAA authorization template designed to work alongside the advance directive, with instructions on distribution and provider-specific tips for Connecticut hospital systems.

See more Connecticut guides →