A Utah HIPAA authorization allows designated individuals to access your protected health information under the Health Insurance Portability and Accountability Act. While a medical power of attorney grants decision-making authority, a separate HIPAA authorization ensures your agent and family members can obtain medical records and communicate with healthcare providers about your condition.
Last updated: June 2026
Key Takeaways
- HIPAA privacy rules prevent healthcare providers from sharing medical information without authorization, even with family members, unless specific exceptions apply.
- A HIPAA authorization allows designated individuals to access your medical records and communicate with healthcare providers about your condition and treatment.
- Utah’s advance healthcare directive form typically includes a HIPAA authorization provision that satisfies federal requirements.
- Without a HIPAA authorization, your loved ones may be unable to obtain medical information even if they have a medical power of attorney.
Many Utah residents assume that their spouse or adult children can automatically access their medical records and talk to their doctors about their condition. Under HIPAA, this is not always the case. Federal privacy regulations protect your medical information, and healthcare providers may only share it with individuals you have specifically authorized. A HIPAA authorization ensures that the people you trust can get the information they need to help make medical decisions and coordinate your care.
The HIPAA authorization is closely related to the medical power of attorney but serves a different purpose. The medical power of attorney gives someone authority to make medical decisions. The HIPAA authorization gives someone access to your medical information so they can make informed decisions. Most Utah advance healthcare directives include both provisions, but a separate HIPAA authorization may also be useful in certain circumstances.
Why is a HIPAA authorization important for Utah estate planning?
A HIPAA authorization is essential for effective healthcare decision-making during incapacity. Your healthcare agent cannot make informed medical decisions without access to your medical records and the ability to discuss your condition with your doctors. Without a HIPAA authorization, healthcare providers may refuse to share information with your agent, citing federal privacy regulations, which defeats the purpose of having appointed an agent in the first place.
Even if you have not appointed a formal healthcare agent, a HIPAA authorization allows your family members to obtain information about your condition and coordinate your care. In emergency situations, the ability to access medical information quickly can be critical for making treatment decisions. A HIPAA authorization eliminates delays and ensures that your loved ones have the information they need when they need it.
How does a HIPAA authorization work in Utah?
A HIPAA authorization is a written document that identifies the individual or individuals who are authorized to receive your protected health information. The authorization must specify the information that may be disclosed, the purpose of the disclosure, and the expiration date of the authorization. Under federal law, healthcare providers must honor a valid HIPAA authorization and may share the designated information with the authorized individuals.
Utah’s advance healthcare directive form includes a HIPAA authorization provision that becomes effective when the directive becomes effective. This authorization allows your healthcare agent to access your medical records and speak with your healthcare providers about your condition and treatment. Some people also choose to execute a separate, standalone HIPAA authorization that is effective immediately, allowing family members to access medical information even while the principal is still competent.
Under HIPAA, healthcare providers may share medical information with a patient’s family members, relatives, or close personal friends who are involved in the patient’s care if the patient has been given an opportunity to agree or object and does not object. However, a written HIPAA authorization provides greater certainty.
Who should be named in a HIPAA authorization?
You should name anyone who may need to access your medical information or participate in your healthcare decisions. The most common choices include your healthcare agent under your medical power of attorney, your spouse or domestic partner, your adult children, a close friend who will be involved in your care, and your primary caregiver. You may name multiple individuals and grant them varying levels of access to your information.
It is important to discuss your HIPAA authorization with the individuals you name so they understand that they have been authorized to access your medical information. They should know where to find the authorization if it is needed and understand how to present it to healthcare providers. Giving each authorized individual a copy of the authorization is a good practice.
Does a medical power of attorney include HIPAA authorization?
In Utah, the advance healthcare directive form includes a provision that serves as a HIPAA authorization for the appointed healthcare agent. This provision satisfies the federal requirements for authorizing the release of medical information. However, the authorization is typically tied to the agent’s authority under the medical power of attorney and becomes effective only when the directive becomes effective.
If you want family members or other individuals to have access to your medical information before you become incapacitated, or if you want someone who is not your healthcare agent to have access, you should execute a separate, standalone HIPAA authorization. This separate authorization can be effective immediately and can name individuals other than your healthcare agent. Some people execute HIPAA authorizations for their spouse and adult children even when they are healthy, simply to ensure that their loved ones can obtain information if needed.
How long does a HIPAA authorization remain valid?
The validity of a HIPAA authorization depends on its terms. Most estate planning HIPAA authorizations are drafted to remain in effect indefinitely or until revoked. However, federal law allows you to specify an expiration date in the authorization. If you do not specify an expiration date, the authorization remains effective until you revoke it. You may revoke a HIPAA authorization at any time by providing written notice to your healthcare providers.
It is important to note that a HIPAA authorization in an advance healthcare directive automatically terminates upon your death, though your personal representative may have access to your medical records under probate law. If you want someone to have access to your medical information after your death for purposes such as handling claims or reviewing your medical history, you should name them in your estate planning documents.
What information can be disclosed under a HIPAA authorization?
A HIPAA authorization can authorize the disclosure of any protected health information, including diagnosis, treatment plans, test results, medical history, and billing information. The authorization should specify the types of information that may be disclosed and the purpose of the disclosure. A comprehensive authorization allows healthcare providers to share any information relevant to the authorized individual’s role in your care.
Some people choose to limit the authorization to specific types of information, such as information related to a particular medical condition. Others grant broad authorization to access all medical records. The scope of the authorization should reflect your comfort level and the role the authorized individual will play in your healthcare. Your estate planning attorney can help you draft an authorization that meets your specific needs.
Frequently Asked Questions
Do I need a separate HIPAA authorization if I have a medical power of attorney?
In Utah, the advance healthcare directive form includes a HIPAA authorization for your healthcare agent. However, a separate authorization may be needed if you want others to have access before incapacity or if you want to name additional individuals.
Can my spouse access my medical records without a HIPAA authorization?
Under HIPAA, healthcare providers may share information with a spouse who is involved in your care if you do not object. However, a written authorization provides greater certainty and avoids potential delays or disputes.
Does a HIPAA authorization expire?
A HIPAA authorization expires on the date specified in the document. If no expiration date is specified, the authorization remains effective until you revoke it.
Can I revoke a HIPAA authorization?
Yes. You may revoke a HIPAA authorization at any time by providing written notice to your healthcare providers. The revocation is effective when received, though it does not affect information already disclosed.
Is a HIPAA authorization the same as a medical power of attorney?
No. A HIPAA authorization allows someone to access your medical information. A medical power of attorney allows someone to make medical decisions. Both are typically included in an advance healthcare directive.
Does a HIPAA authorization need to be notarized?
Federal HIPAA regulations do not require notarization. However, Utah’s advance healthcare directive includes notarization or witness requirements that apply to the entire directive, including the HIPAA authorization section.
Can a HIPAA authorization be used after death?
A HIPAA authorization typically terminates upon death. After death, the personal representative may access medical records under probate law, and the executor may need a court order for certain information.
Need a Utah HIPAA authorization?
A HIPAA authorization ensures that your loved ones can obtain the medical information they need to make informed decisions about your care. An experienced estate planning attorney can help you include a comprehensive HIPAA authorization in your advance healthcare directive.
Ensure your family can access your medical information when it matters most with a properly drafted HIPAA authorization.
Jeremy Eveland or call (801) 807-9123.
This article is for informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship.
Comments are closed.