HIPAA Release Form Utah: When You Need One and How to Get It Right

You named a healthcare agent in your Utah Advance Health Care Directive. You assumed that meant they could access your medical records in an emergency. Then the hospital told them no.

This happens constantly, and it is not a mistake by the hospital. HIPAA (the Health Insurance Portability and Accountability Act) is a federal privacy law that controls who can see your protected health information. Appointing a healthcare agent gives that person authority to make medical decisions on your behalf, but it does not automatically grant unrestricted access to your medical records at every provider.

A HIPAA release form bridges that gap.

What a HIPAA Release Does

A signed HIPAA authorization permits specific named individuals to access your protected health information. It tells healthcare providers, hospitals, insurers, and pharmacies that you consent to sharing your medical records with the people you have listed.

Without it, providers can share information with your healthcare agent only to the extent necessary for the agent to make treatment decisions during a specific episode of care. Records from other providers, historical medical information, mental health records, and substance abuse treatment records may still be restricted.

The HIPAA release eliminates the need for your agent to argue about scope every time they request records from a new provider or facility.

Why the Advance Directive Is Not Enough

Utah's Advance Health Care Directive under Title 75A, Chapter 9 gives your healthcare agent the authority to make medical decisions and access records related to those decisions. But in practice, the handoff is not clean:

Multiple providers. If you see a cardiologist, a neurologist, and a primary care physician at different health systems, each system may require separate verification that your agent has authority before releasing records. A standalone HIPAA release on file with each provider preempts this.

Pre-existing records. The directive activates when you lose decision-making capacity. Your agent may need access to your medical history before that threshold is reached, especially when coordinating a care plan or consulting specialists about treatment options.

Mental health and substance abuse records. These categories receive additional federal protection under 42 CFR Part 2 and state mental health confidentiality laws. A general advance directive may not meet the specific authorization requirements for these record types.

Missionary Families: The Turning-18 Cliff

For Utah families preparing a young adult for LDS missionary service, the HIPAA release is not optional. The day your child turns 18, your automatic right to their medical information under HIPAA's parental access provisions ends completely.

If your 19-year-old missionary is hospitalized in another country and you call the mission medical team or the treating physician, they cannot share details about the diagnosis, treatment, or prognosis unless:

1. Your child appointed you as their healthcare agent in an advance directive, and
2. Your child signed a HIPAA release naming you specifically

The mission organization manages field operations but does not handle medical privacy authorizations. Without these documents, parents are dependent on whatever information the missionary can communicate themselves, which may be impossible during a serious medical event.

The pre-departure window is the time to execute both the healthcare directive and the HIPAA release, along with a financial POA to manage bank accounts, tax filings, and other domestic affairs while the missionary is serving.

What to Include in the Release

A properly drafted HIPAA release form should specify:

• Your name and identifying information (date of birth, address)
• Names of authorized individuals (not just "my family" or "my healthcare agent" — list each person by name)
• Scope of information covered (all medical records, or specific categories)
• Specific providers or facilities authorized to release records, or a blanket authorization for all providers
• Duration (many families set an expiration date or tie it to the duration of the advance directive)
• Your signature and the date

The release must be your voluntary, informed authorization. Providers will reject forms that appear coerced, incomplete, or unsigned.

Revoking the Release

You can revoke a HIPAA authorization at any time in writing. The revocation does not affect information already disclosed under the prior authorization, but it prevents future disclosures.

The Utah Power of Attorney Kit includes a HIPAA release template alongside the financial POA and healthcare directive, so all three documents can be executed together in one planning session.

See more Utah guides →