What Is a HIPAA Authorization and Why Your Plan Needs One

By Rozsa Gyene, California estate planning attorney, State Bar of California #208356. Published October 4, 2026. Last reviewed October 4, 2026

People search for a HIPAA authorization form for estate planning because a family member was once told, at a hospital desk, that the staff could not say anything. The rule behind that moment is federal, it applies in every state, and it has a clear exception for a signed authorization. This guide explains the rule from the regulation itself, as published on the Electronic Code of Federal Regulations and current as of October 1, 2026, and then uses the Illinois and Ohio health care power of attorney statutes as worked examples of how state law and the federal rule fit together. Other states have their own power of attorney statutes, but the federal rule is the same everywhere.

What HIPAA is

HIPAA is the Health Insurance Portability and Accountability Act of 1996, the federal statute the Illinois form itself names when it describes the agent's access to records (755 ILCS 45/4-10(c)(4)). The privacy rules written under it sit in Title 45 of the Code of Federal Regulations, Part 164, Security and Privacy, Subpart E, Privacy of Individually Identifiable Health Information; the eCFR lists section 264 of Public Law 104-191 and sections 13400 to 13424 of Public Law 111-5 among the authorities for Part 164. The general rule is one sentence: a covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart (45 CFR 164.502(a)). The permitted disclosures include disclosure to the individual; for treatment, payment, or health care operations; pursuant to and in compliance with a valid authorization under section 164.508; and as otherwise permitted by section 164.510 (section 164.502(a)(1)(i), (ii), (iv) and (v)). The authorization and the section 164.510 exception are the two routes that matter to a family.

Who the rule binds and what it protects

The rule binds covered entities. A covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter (45 CFR 160.103). A health care provider includes any person or organization who furnishes, bills, or is paid for health care in the normal course of business, and a health plan is an individual or group plan that provides, or pays the cost of, medical care (section 160.103). The rule reaches their business associates as well: persons who create, receive, maintain, or transmit protected health information on a covered entity's behalf for functions such as claims processing, billing, data analysis or practice management, or who provide legal, accounting, consulting or similar services involving that information (section 160.103). Your family members, your agent and your trustee are not covered entities; the rule does not stop them from talking to each other. It stops the provider from talking to them.

What it protects is protected health information: individually identifiable health information transmitted or maintained in electronic media or in any other form or medium (45 CFR 160.103). Individually identifiable health information is health information, including demographic information, created or received by a health care provider, health plan, employer, or health care clearinghouse, that relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or payment for that care, and that identifies the individual or could reasonably be used to identify the individual (section 160.103). The definition excludes employment records held by a covered entity in its role as employer and information about a person who has been deceased for more than 50 years (section 160.103), and the rule requires a covered entity to keep protecting a deceased individual's information for a period of 50 years following the death (section 164.502(f)).

What an authorization must contain

The regulation does not publish a form, but it lists what a valid one must say, and a covered entity may refuse a document that leaves anything out. The core elements are six: a description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion; the name or other specific identification of the person or class of persons authorized to make the disclosure; the name or other specific identification of the person or class of persons to whom the covered entity may make the disclosure; a description of each purpose, for which the statement at the request of the individual is sufficient when the individual initiates the authorization; an expiration date or an expiration event that relates to the individual or the purpose; and the signature of the individual and the date, with a description of the signer's authority if a personal representative signs (45 CFR 164.508(c)(1)).

Three statements must also appear, adequate to place the individual on notice of the individual's right to revoke the authorization in writing, with the exceptions and the method or a reference to the covered entity's privacy notice; whether the covered entity may or may not condition treatment, payment, enrollment or eligibility for benefits on the authorization; and the potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by the rule (section 164.508(c)(2)). The authorization must be written in plain language, and a covered entity that asks for one must give the individual a copy of the signed authorization (section 164.508(c)(3) and (4)). A valid authorization may contain additional elements as long as they are not inconsistent with the required ones (section 164.508(b)(1)(ii)).

The regulation also says when a document fails. An authorization is not valid if the expiration date has passed or the expiration event is known to have occurred; if it has not been filled out completely with respect to a required element; if the covered entity knows it has been revoked; if it is an improper compound authorization or was improperly made a condition of treatment; or if any material information in it is known to be false (45 CFR 164.508(b)(2)). An authorization may not be combined with any other document to create a compound authorization, with narrow exceptions for research and for combining one authorization with another (section 164.508(b)(3)), which is the reason an estate plan carries the authorization as its own document rather than as a paragraph inside the power of attorney. And a covered entity may not condition treatment, payment, enrollment or eligibility for benefits on signing one, apart from listed exceptions such as research related treatment (section 164.508(b)(4)); the authorization in your plan is for your benefit, not the provider's.

Why your health care agent still needs one

The Privacy Rule already recognizes the person you name in a health care power of attorney. A covered entity must treat a personal representative as the individual, and if under applicable law a person has authority to act on behalf of an adult in making decisions related to health care, the covered entity must treat such person as a personal representative with respect to protected health information relevant to such personal representation (45 CFR 164.502(g)(1) and (2)). The example states build on that. Illinois declares that a health care agent is a personal representative under state and federal law and has the authority of a personal representative under both unless the agency restricts it (755 ILCS 45/4-4(e-5)); the statutory form says the agent serves as the principal's personal representative as that term is defined under HIPAA and has the same right the principal has to examine and copy and consent to disclosure of all the principal's medical records the agent deems relevant (section 4-10(c)(4)); and each provider shall give an authorized agent the same right the principal has to examine and copy any part of the patient's medical records, whether they relate to mental health or any other condition (section 4-7(c)). Ohio provides that, unless the right is limited in the instrument, the attorney in fact has the same right as the principal to receive information about proposed health care, to review health care records, and to consent to the disclosure of health care records (Ohio Rev. Code 1337.13(A)(3)).

The catch is the word when. The personal representative rule attaches to a person who has authority to act, and in both example states the agent's authority to decide ordinarily begins at incapacity. In Ohio the attorney in fact shall make health care decisions for the principal only if the attending physician of the principal determines that the principal has lost the capacity to make informed health care decisions (Ohio Rev. Code 1337.13(A)(1)). In Illinois the statutory form's default box, the one that applies if no box is checked, authorizes the agent to make decisions for me only when I cannot make them for myself, as determined by the treating physicians (755 ILCS 45/4-10(b)). Until that determination is made, a provider looking at the document alone may reasonably conclude that the agent is not yet a personal representative. Both states saw the problem and let the document open the records early: Ohio's instrument may authorize the attorney in fact, commencing immediately upon the execution of the instrument and regardless of whether the principal has lost capacity, to obtain information concerning the principal's health, including protected health information as defined in 45 CFR 160.103 (Ohio Rev. Code 1337.12(A)(1) and 1337.13(A)(1)), and Illinois offers a second box under which, starting now, the agent has complete access to my medical and mental health records and the ability to communicate with my physicians, including the ability to require an opinion of my physician as to whether I lack the ability to make decisions for myself (755 ILCS 45/4-10(b)). A separate HIPAA authorization does the same job in a form every provider's privacy office recognizes, and it can name people who are not agents at all: a spouse who is not the first-named agent, an adult child who lives nearby, the successor agents.

Why your successor trustee needs one

A successor trustee has no health care role. The trustee's job, described in what a successor trustee does, is property: managing the trust's assets if you become unable to and distributing them after your death. But the moment the trustee steps in during your lifetime is a medical fact, your inability to manage your own affairs, and the trust document says how that fact is established. Under the Privacy Rule, a trustee does not fit the definition of a personal representative, which is reserved for a person with authority under applicable law to make decisions related to health care (45 CFR 164.502(g)(2)); authority over property is not authority over health care. Nor is a trustee a family member involved in your care within the meaning of the section 164.510(b) exception described below unless the trustee happens to be one. So a physician asked to confirm your condition to your trustee has no route under the rule except your own written authorization. Naming the successor trustee in the HIPAA authorization, as well as the health care agent, closes that gap, and it does so without giving the trustee any say in your treatment.

The family-and-friends exception and its limits

The Privacy Rule does let a provider speak to family without a signed form, within limits. A covered entity may disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person's involvement with the individual's health care or payment related to the individual's health care, and may use or disclose information to notify a family member, a personal representative, or another person responsible for the care of the individual of the individual's location, general condition, or death (45 CFR 164.510(b)(1)). The individual's agreement may be oral (section 164.510, opening paragraph). If the individual is present and has the capacity to make health care decisions, the covered entity may disclose if it obtains the individual's agreement, gives the individual an opportunity to object and none is made, or reasonably infers from the circumstances, based on the exercise of professional judgment, that the individual does not object (section 164.510(b)(2)).

When the individual is not present or the opportunity to agree or object cannot practicably be provided because of the individual's incapacity or an emergency, the covered entity may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the individual and, if so, disclose only the protected health information that is directly relevant to the person's involvement with the individual's care or payment or needed for notification purposes; the rule gives picking up filled prescriptions, medical supplies and X-rays as examples (45 CFR 164.510(b)(3)). After death, a covered entity may disclose to family members and others who were involved in the individual's care or payment before death the information relevant to that involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity (section 164.510(b)(5)). Three limits follow from the text. Each rule says may, so the provider decides; each is confined to information directly relevant to the person's involvement, not the full record; and each depends on the provider's judgment about who is involved in your care, which a stranger at the desk cannot know. An authorization removes all three uncertainties by naming the people and the scope in advance.

Revocation and expiration

An individual may revoke an authorization at any time, provided that the revocation is in writing, except to the extent that the covered entity has taken action in reliance on it or, where the authorization was a condition of insurance coverage, other law gives the insurer a right to contest a claim (45 CFR 164.508(b)(5)). A covered entity that knows an authorization has been revoked may not rely on it (section 164.508(b)(2)(iii)), and it must document and retain any signed authorization (section 164.508(b)(6)). Because the required statements include a description of how the individual may revoke, or a reference to the provider's privacy notice that describes it (section 164.508(c)(2)(i)), the practical method is a short signed letter to each provider that holds a copy.

Expiration is built into the form. The authorization must carry an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure (45 CFR 164.508(c)(1)(v)), and once that date has passed or the event is known to have occurred the authorization is not valid (section 164.508(b)(2)(i)). An authorization signed as part of an estate plan therefore needs an expiration term that will not run out before the crisis it was signed for. After death the rule continues for 50 years (section 164.502(f)), and a covered entity must treat as the personal representative an executor, administrator, or other person who has authority under applicable law to act on behalf of a deceased individual or of the individual's estate (section 164.502(g)(4)). State law can also carry the agent past death for records: Illinois provides that a health care agency may extend beyond the principal's death if necessary to permit anatomical gift, autopsy, disposition of remains, or access to medical records (755 ILCS 45/4-3), and its form grants the agent access to my medical and mental health records, and sharing them with others as needed, including after I die (section 4-10(b)).

One more limit: abuse and endangerment

The personal representative rule has a safety valve that a HIPAA authorization does not override. A covered entity may elect not to treat a person as the personal representative if it has a reasonable belief that the individual has been or may be subjected to domestic violence, abuse, or neglect by such person, or that treating such person as the personal representative could endanger the individual, and it decides in the exercise of professional judgment that doing so is not in the individual's best interest (45 CFR 164.502(g)(5)). Illinois reaches a similar result from the other direction by barring the attending physician and other treating providers from serving as agent at all (755 ILCS 45/4-5), and Ohio by barring the attending physician and the nursing home administrator (Ohio Rev. Code 1337.12(A)(2)). Choose the people on your authorization the way you choose an agent: for trust, availability and a willingness to ask doctors hard questions.

How the authorization in the site's plan fits

In the site's documents the HIPAA Authorization is its own item in the portfolio, listed after the General Durable Power of Attorney and before the state's health care documents, and it is included in both the Complete Estate Plan and the Will Package in every state. The health care documents that follow it differ by state: in Illinois a Power of Attorney for Health Care and, when your end-of-life instructions call for it, a Living Will Declaration; in Ohio a Durable Power of Attorney for Health Care and, on the same condition, a Living Will Declaration; in many states a single Advance Health Care Directive. The guide to health care power of attorney vs. living will explains those documents. Signing the authorization is the easy part; the federal rule asks only for the individual's signature and date (45 CFR 164.508(c)(1)(vi)) and does not call for a witness or a notary. What matters afterward is distribution: give a copy to your primary physician, keep one with the health care documents, and make sure the people named know where it is, because the rule lets a provider disclose only pursuant to and in compliance with a valid authorization it has in hand (section 164.502(a)(1)(iv)).