Why won't the medical records office accept my power of attorney?

Because HIPAA does not ask what a document is called. Under 45 CFR 164.502(g)(2) a provider must treat someone as a personal representative only where applicable law gives that person authority to act for an adult 'in making decisions related to health care,' and then only for information relevant to that representation. OCR's guidance chart puts the test as 'A person with legal authority to make health care decisions on behalf of the individual' and gives three examples: a health care power of attorney, a court appointed legal guardian, and a 'General power of attorney or durable power of attorney that includes the power to make health care decisions.' A financial power of attorney that says nothing about health care decisions does not meet the test (guidance read 5 September 2026 through an Internet Archive capture; hhs.gov was unreachable that day).

How long does a provider have to respond to a records request?

Thirty calendar days from receipt under 45 CFR 164.524(b)(2)(i), with one extension of no more than 30 further days, and only if the provider sends a written statement of the reason and the date it will act inside the first 30 days. OCR calls 30 days an outer limit. Some states are shorter and the shorter rule applies: California requires inspection within five working days and copies within 15 days, and New York gives ten days for inspection.

Can the facility charge for copies of the chart?

It may impose a reasonable, cost-based fee limited to labor for copying, supplies, postage, and preparing an agreed summary (45 CFR 164.524(c)(4)). Search and retrieval time is not chargeable. State caps can be lower: 25 cents per page in California, 75 cents per page in New York. Both states also require copies at no charge when the records are needed to support a claim or appeal for a public benefit program — in California on a written request plus proof, and limited to one free copy of any relevant portion.

The request was denied. Is that the end of it?

The denial has to be in writing, in plain language, and it has to give the basis, any review rights, and how to complain, including the name or title and telephone number of the entity's contact person (45 CFR 164.524(d)(2)). One denial ground aimed at personal representatives is reviewable by a second licensed professional who did not make the first decision. Complaints go to the covered entity or to the HHS Office for Civil Rights under 45 CFR 160.306.

HIPAA Authorization vs POA: Getting a Parent's Records

The business office answers on the first ring. Yes, it can email the itemized statement. Yes, someone will walk through the ancillary charges line by line, and yes, the billing address can be changed today.

Forty minutes later, two corridors away, the medical records window is handed the same document and says no. Not a delay, not a callback. No.

Nobody changed their mind in between. The two counters are applying two different paragraphs of the same rule, and only one of those paragraphs creates something you can enforce.

The phrase the records window is looking for

HIPAA does not care what the document is titled. It asks one question, at 45 CFR 164.502(g)(2):

If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.

Two conditions, both load-bearing. Authority in making decisions related to health care, and even then, only for information relevant to that representation. Paragraph (g)(1) then says a covered entity must treat a personal representative as the individual "for purposes of this subchapter," except as paragraphs (g)(3) and (g)(5) provide. That is the whole prize, because the individual is the one holding a right of access.

The Office for Civil Rights publishes a chart of who must be recognised. The adult row answers with a test — "A person with legal authority to make health care decisions on behalf of the individual" — and then gives three examples under it: a health care power of attorney, a court appointed legal guardian, and the one families misread, a "General power of attorney or durable power of attorney that includes the power to make health care decisions." Not a general power of attorney. One that includes that power. The three are illustrations. The line above them is the requirement.

The same guidance sets the ceiling: "Where the authority to act for the individual is limited or specific to particular health care decisions, the personal representative is to be treated as the individual only with respect to protected health information that is relevant to the representation." Its example is a limited health care power of attorney covering artificial life support. That agent is a personal representative for information about that decision, and not for everything else in the chart.

Which document in the folder carries health care decision authority, and which one only reaches money, is a separate sorting job covered in durable POA, healthcare proxy, living will. The point here is narrower. The clerk is not reading the whole document. They are looking for one grant of authority, and if it is absent, the refusal is what the rule requires of them.

Why the billing office said yes anyway

Nothing above explains the first phone call. That comes from 45 CFR 164.510(b)(1)(i):

A covered entity may, in accordance with paragraphs (b)(2), (b)(3), or (b)(5) of this section, disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person's involvement with the individual's health care or payment related to the individual's health care.

May, and only through one of the three cross-referenced paragraphs. If the parent is present and has capacity, (b)(2) wants their agreement, or an opportunity to object that goes unused, or a reasonable inference from the circumstances. If the parent is not present, or the chance to agree or object cannot practicably be given because of incapacity or an emergency, (b)(3) leaves it to a professional judgment about their best interest, and then only what is directly relevant. Paragraph (b)(5) carries a version of the permission past a death, for people who were involved in care or payment beforehand, unless the provider knows the parent preferred otherwise.

That is why the payment conversation moves and the chart does not. One is a discretionary permission with a narrow scope, and it can close on a Tuesday without anyone owing you a reason. The other is a right with a deadline attached. Treating them as the same thing is why families think the rules changed halfway through the week.

Three doors, and they do not cost the same

	1. You are a personal representative	2. Your parent signs an authorization	3. Your parent directs a copy to you
Rests on	164.502(g)(2) plus the access right at 164.524	164.508	164.524(c)(3)(ii)
You produce	the document granting health care decision authority, plus identification	a valid authorization signed and dated by your parent	a written access request signed by your parent naming you and where to send it
Deadline	30 days, one 30-day extension	none in the section itself	30 days, one 30-day extension
Fee	the 164.524(c)(4) cap applies to a copy for yourself	not governed by the access fee cap	see the court order below
Ends when	the authority ends	your parent revokes in writing, or the expiration date passes	that request is filled

Door three carries a wrinkle worth knowing before a quote arrives. OCR's access guidance now opens with a notice that it "remains in effect only to the extent that it is consistent with the court's order in Ciox Health, LLC v. Azar, No. 18-cv-0040 (D.D.C. January 23, 2020)." HHS describes what the order did:

On January 23, 2020, a federal court vacated the "third-party directive" within the individual right of access "insofar as it expands the HITECH Act's third-party directive beyond requests for a copy of an electronic health record with respect to [protected health information] of an individual . . . in an electronic format." Additionally, the fee limitation set forth at 45 C.F.R. § 164.524(c)(4) will apply only to an individual's request for access to their own records, and does not apply to an individual's request to transmit records to a third party.

The same notice adds that "the right of individuals to access their own records and the fee limitations that apply when exercising this right are undisturbed and remain in effect."

Read alongside the personal representative rule, that produces a practical result. A personal representative asking for a copy for themselves stands in the parent's shoes, and the fee cap follows them there. Ask the same department to send the file onward to a law office or a new facility and the capped-fee argument is on much weaker ground. When a quote comes back high, the first question is which of the three doors the department thinks you used.

What makes an authorization form defective

Door two is the one most families end up using, usually on a form the provider supplies. Section 164.508(c) lists what has to be on it. Six core elements:

a description of the information "that identifies the information in a specific and meaningful fashion"
who is authorised to make the disclosure
who may receive it
a description of each purpose — where the individual initiates the authorization and does not, or elects not to, state a purpose, "at the request of the individual" is enough
an expiration date, or an expiration event "that relates to the individual or the purpose of the use or disclosure"
signature of the individual and date

Then the sentence that catches people already acting for a parent: "If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided."

Three statements have to appear as well. First, the right to revoke in writing, together with the exceptions to that right and a description of how to revoke — or, if the provider's notice of privacy practices already carries that material, a reference to the notice. Second, whether treatment, payment, enrollment or eligibility for benefits can be conditioned on signing. Third, that the recipient may redisclose the information and it would then no longer be protected by the rule. The form must be in plain language, and where the provider is the one seeking the authorization, it has to hand the signer a copy of what they signed.

Paragraph (b)(2) then lists five defects that make an authorization invalid: the expiration date has passed or the expiration event is known to have occurred, it was not filled out completely, it is known to have been revoked, it breaks the compound or conditioning rules, or material information in it is known to be false. Incomplete is the common one. A blank expiration line, or the single word "records" as the description of the information, is not a technicality invented at the counter.

The clock, and what a denial has to contain

Thirty calendar days from receipt, under 164.524(b)(2)(i). One extension of no more than 30 additional days, allowed only if the entity sends, inside the original 30, a written statement of the reasons for the delay and the date it will complete its action. Only one such extension per request. OCR's guidance calls 30 days "an outer limit."

A provider may require the request in writing, and may require its own form, provided that does not become a barrier or an unreasonable delay. OCR gives three examples of measures that cross the line: making someone who asked for records by mail come in physically to prove identity, requiring a web portal "as not all individuals will have ready access to the portal," and requiring that the request itself be mailed, which only delays its receipt. Those are examples, not the whole boundary.

Denials are written, in plain language, and must contain the basis, any review rights and how to use them, and how to complain — including the name or title and telephone number of the entity's designated contact person, under 164.524(d)(2). If part of the file can be released, the rest still has to come.

One denial ground exists specifically for people in this position. Under 164.524(a)(3)(iii), access may be denied where "the request for access is made by the individual's personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person." That one is reviewable. A different licensed professional, not involved in the first decision, has to look again, and the entity must carry out what the reviewer determines.

There is a further exit, and quoting part of it would be misleading. Under 164.502(g)(5) a covered entity may elect not to treat a person as the personal representative at all, but only where the conditions at (g)(5)(i) and (ii) are both met, and the first of those is itself two things at once.

Paragraph (g)(5)(i) needs (A) a reasonable belief that the individual has been or may be subjected to domestic violence, abuse or neglect by that person, or that treating them as the representative could endanger the individual, and (B) a decision by the entity, in the exercise of professional judgment, that treating them as the representative is not in the individual's best interest. Paragraph (g)(5)(ii) then takes a basis away: the entity does not have a reasonable belief under (i)(A) "if the basis for their belief is the provision or facilitation of reproductive health care by such person for and at the request of the individual."

OCR illustrates the election with a physician who reasonably believes that giving an incompetent elderly individual's representative access would endanger that individual. That guidance page was last reviewed on 5 January 2024; the (g)(5)(ii) sentence arrived with the amendment at 89 FR 33063, 26 April 2024, and the page does not mention it. Read the regulation for the current shape. Either way the provision is narrow, it takes every part, and it is not a general licence to turn away a document someone finds inconvenient.

Where the state line moves the answer

HIPAA sets a floor. Under 45 CFR 160.203(b), a state privacy law that is more stringent is not preempted, and 160.202 says what more stringent means. One of its tests is a law that, on an individual's right of access, "permits greater rights of access." That is why a shorter state deadline or a lower page rate is the one that governs. Two states show how far the local rules travel from the federal text.

New York defines a "qualified person" for records access at Public Health Law 18(1)(g) — the subject, an Article 81 guardian, a parent or guardian of an infant, a distributee of a deceased subject for whom no personal representative has been appointed, or an attorney holding a power of attorney that explicitly authorises a written request for patient information. That list is not a state curiosity: the same paragraph closes by providing that a qualified person "shall be deemed a 'personal representative of the individual' for purposes of the federal health insurance portability and accountability act of 1996 and its implementing regulations."

A health care agent is not on that list. The agent's access comes from a different statute, PHL 2982(3): "the agent shall have the right to receive medical information and medical and clinical records necessary to make informed decisions regarding the principal's health care." And the proxy in the drawer does nothing by itself. PHL 2981(4) provides that the agent's authority "shall commence upon a determination" that the principal lacks capacity to make health care decisions — a determination the attending practitioner makes in writing, to a reasonable degree of medical certainty, entered in the medical record, and one the agent may ask for under PHL 2983(2).

New York also runs a ten-day clock for inspection, caps paper copies at 75 cents per page, and forbids any charge where copies are requested "for the purpose of supporting an application, claim or appeal for any government benefit or program."

California makes the same point in its definitions. A "patient's personal representative" at Health and Safety Code 123105(e) means a parent or guardian of a minor, the guardian or conservator of an adult patient, an agent as defined in Probate Code 4607 — the health care decisions side — "to the extent necessary for the agent to fulfill" those duties, or a beneficiary or personal representative of a deceased patient. Section 123110 then requires inspection within five working days, copies within 15 days, and caps the fee at 25 cents per page for paper copies, 50 cents where they are copied from microfilm.

Section 123110(d) is the one worth quoting when a Medicaid application is the reason the records are being gathered at all. It entitles the patient or the patient's personal representative to the relevant portion "at no charge" — on a written request, and on "proof that the records or supporting forms are needed to support a claim or appeal regarding eligibility for a public benefit program." The statute names Medi-Cal, In-Home Supportive Services, CalWORKs, SSDI, SSI/SSP, CalFresh and others. Two limits ride along with it: the free copy is one copy of any relevant portion, not an open tab, and the subdivision does not apply at all where a private attorney is paying the costs of the claim pending its outcome. The wider map of which payer covers which stretch of care is in who pays for long-term care.

One more rulebook sits underneath all of this. Records from a federally assisted substance use disorder program run on 42 CFR part 2 as well as HIPAA. Part 2 defines a personal representative in nearly the words HIPAA uses — "a person who has authority under applicable law to act on behalf of a patient who is an adult or an emancipated minor in making decisions related to health care," with authority "only with respect to patient records relevant to such personal representation" (42 CFR 2.11). So a health care agent is not shut out by definition.

The paragraph on consenting for an adult who cannot consent for themselves is narrower than that, though. Section 2.15(a)(1) lets the personal representative give the consent the part requires "in the case of a patient who has been adjudicated as lacking the capacity, for any reason other than insufficient age, to make their own health care decisions" — adjudicated, meaning a court. Where there has been no adjudication, 2.15(a)(2) opens a door that does not lead to the family: the program director may exercise the patient's right to consent, and only "for the sole purpose of obtaining payment for services from a third-party payer or health plan." Expect a part 2 program to ask what the proxy rests on and to move slower than a general hospital's records office.

What to have in hand before the next request goes in

Open the document to the page that grants health care decision authority and note the page number, because that page is the whole question at the window. If the state conditions an agent's authority on a capacity determination, ask whether one is in the chart and who would make it. Put the request in writing even where the provider does not insist on it, name the records and the date range rather than asking for "the file," say what form and format you want and where to send it, and keep a dated copy — the 30 days runs from receipt, not from the phone call that preceded it.

Ask which of the three doors the department is using, and get the fee basis in writing before the copying starts. If the answer is no, ask for the denial on paper and for the paragraph it rests on. And where a parent still has capacity, their own signature is the shortest route on any of these forms, which is a reason to raise it early rather than in the week after a hospital admission. How the underlying documents have to be executed varies by state too, which is covered in who can witness an advance directive. For a refusal you believe is wrong, the routes are the covered entity's own contact person and the HHS Office for Civil Rights under 45 CFR 160.306. For what a particular document authorises, an elder law attorney in your parent's state.

Sources

Everything below was opened and read on 5 September 2026.

HIPAA Privacy Rule through the eCFR, title 45 issue date 31 August 2026: 45 CFR 164.502(g) personal representatives and the abuse, neglect and endangerment election; 164.508 authorizations, core elements and defects; 164.510(b) disclosures to people involved in care or payment; 164.524 right of access, deadlines, denial grounds and fees; 160.202 and 160.203 preemption and the definition of more stringent. 42 CFR 2.15 and the part 2 definitions at 2.11, title 42 issue date 13 August 2026.
HHS Office for Civil Rights: Personal Representatives (content last reviewed 5 January 2024), Individuals' Right under HIPAA to Access their Health Information, and the notice on the Ciox Health court order (content last reviewed 28 January 2020). hhs.gov returned 403 Forbidden to every direct request on the day of reading, from a browser as well as a script, so these three were read through Internet Archive captures dated 15 July 2026, 27 March 2026 and 11 May 2026. Each was the most recent capture the archive held. The live links are above and should be preferred: anything HHS has changed on those pages since those capture dates does not appear here. OCR guidance is also not the regulation — where the two differ, the eCFR text governs.
New York Public Health Law 18 (page shows a last revision of 4 October 2024), 2981, 2982 and 2983.
California Health and Safety Code 123105 (amended by Stats. 2020, Ch. 101) and 123110 (amended by Stats. 2023, Ch. 294, effective 1 January 2024). New York and California appear here as two worked examples, not as a national rule; a parent's own state health department or medical board publishes its records statute.
Complaints: HHS OCR complaint portal.

This page is general information, not legal, medical, or financial advice. See the terms.