HIPAA Authorization Form in New York: What You Need Beyond the Health Care Proxy

You have a Health Care Proxy naming you as your parent's medical decision-maker. You walk into their doctor's office to review their records and discuss treatment options. The receptionist asks for a HIPAA release form. You hand over the Health Care Proxy. The office says that is not sufficient — they need a separate authorization.

This happens constantly in New York because HIPAA and the Health Care Proxy serve different legal functions.

Why the Health Care Proxy Is Not Enough

A New York Health Care Proxy (under Public Health Law Article 29-C) authorizes your designated agent to make medical decisions on your behalf once a physician has determined you lack capacity. It does not, by itself, guarantee access to all medical records in all circumstances.

HIPAA (the Health Insurance Portability and Accountability Act) is a federal law that controls who can access your protected health information. While HIPAA allows healthcare providers to share information with a Health Care Proxy agent who is actively involved in care decisions, the scope and timing create practical gaps:

Before incapacity. If the principal has not yet been determined incapacitated, the Health Care Proxy is not active, and the agent has no authority to access medical records. A HIPAA authorization allows a designated person to access records at any time, regardless of capacity status.

Mental health and substance abuse records. New York Mental Hygiene Law imposes additional restrictions on the release of mental health treatment records. Federal regulations (42 CFR Part 2) impose even stricter protections on substance abuse treatment records. A Health Care Proxy may not be sufficient to access these categories without a specific HIPAA authorization.

Record requests from different providers. The principal may have medical records across multiple providers, hospitals, and specialist offices. Each provider may have different policies about what constitutes adequate authorization. A standalone HIPAA release form, specifically naming the authorized individual and the scope of records, reduces friction with provider compliance departments.

What a HIPAA Authorization Must Include

A valid HIPAA authorization under 45 CFR § 164.508 must include:

• A description of the information to be disclosed (all medical records, specific dates, specific conditions)
• The person or entity authorized to release the information
• The person or entity authorized to receive the information
• The purpose of the disclosure
• An expiration date or event
• The individual's signature and date
• A statement that the authorization can be revoked in writing at any time

There is no official New York State HIPAA authorization form. Most hospitals and medical practices have their own templates, but you can also prepare a standalone form that covers all providers.

When to Execute a HIPAA Authorization

Execute a HIPAA authorization at the same time you sign the Health Care Proxy and Power of Attorney. This ensures your designated agents have both decision-making authority (Health Care Proxy) and records access authority (HIPAA) from day one — not just after a physician has declared you incapacitated.

This is especially important in the common scenario where an adult child is managing an aging parent's care. The parent may still have capacity but need the child to coordinate between doctors, pharmacies, insurance companies, and specialists. Without a HIPAA authorization, each provider can refuse to share information, creating dangerous communication gaps in the parent's care.

The Three-Document System

In New York, comprehensive planning requires three medical-related documents:

1. Health Care Proxy — authorizes medical decision-making upon incapacity
2. Living Will — documents specific end-of-life treatment preferences under New York's "clear and convincing evidence" standard
3. HIPAA Authorization — grants access to medical records regardless of capacity status

A financial Power of Attorney is separate from all three and covers bank accounts, property, taxes, and other non-medical matters.

The New York Power of Attorney Kit covers the full set — the statutory financial POA, Health Care Proxy, Living Will, and HIPAA authorization — so families can execute all four documents in a single signing session without piecing together forms from multiple sources.

See more New York guides →