Medicare Authorization to Disclose: What CMS-10106 Covers

The person on the 1-800-MEDICARE line will not say no. She will say she is not able to discuss the account, offer to speak with your mother directly, and then wait. Your mother is two rooms away on day 19 of a skilled nursing stay, asleep, with Tuesday's hospital bracelet still on her wrist.

That call does not go differently until one piece of paper is on file. It is Form CMS-10106, "Authorization to Disclose Personal Health Information," and the current edition is stamped 03/2026. CMS's form page lists a revision date of 2026-03-01 under OMB control number 0938-0930, with an OMB expiration date of 2029-03-31 (page read 26 September 2026). CMS's own paperwork filing for the collection estimates one million responses a year, and names the legal basis without hedging: the authorization requirements of the HIPAA Privacy Rule at 45 CFR 164.508.

So this is a HIPAA authorization. Just one pointed at a single covered entity, which happens to be Medicare, and it goes to a post office box in Kansas.

The edition number is the part families get wrong

Search the form number and most of what comes back is not CMS. It is health plans, agent sites, and fill-in-the-blank form mills hosting copies they saved years ago. Those copies are not blank templates of the current form. They are earlier editions with different contents.

The immediate predecessor, stamped 05/23, ran six pages: a cover sheet, a three-page form, and two pages of step-by-step instructions. The 03/2026 edition runs three pages and folds the instructions into the form itself. An April 2014 version still sitting in the regulatory record at reginfo.gov has three name slots instead of two and addresses the envelope to "Medicare BCC, Written Authorization Dept." The post office box is the same one. The department name is not.

None of that is trivia, because two sentences dropped out along the way. The 05/23 edition told you plainly that the form was also how you "change or remove someone that 1-800-MEDICARE can share information with," and it printed this: "Whether you choose to share your personal health information or not has no effect on your enrollment, eligibility for benefits, or the amount Medicare pays for your health services." Neither sentence appears on the 03/2026 three-pager.

That is a difference between two documents, opened side by side on 26 September 2026, and it is worth being precise about what it is not. It is not a change in what you may do. The 03/2026 form still carries a section headed "How to cancel your Authorization to Disclose" that begins "You have the right to change or cancel ('revoke') your authorization at any time," so swapping one name out for another is still the same piece of paper — the sentence advertising that use is what went missing, not the use. Nor did anyone lose the protection the second sentence described: 45 CFR 164.508(b)(4) still prohibits a covered entity from conditioning "treatment, payment, enrollment in the health plan, or eligibility for benefits" on signing an authorization, and its only plan-side exception covers authorizations a plan asks for before enrollment for eligibility or underwriting decisions, which is not this form. What the shorter edition drops is the reassurance, which is the part a family hesitating over the form was most likely to need.

One more note from the same morning. CMS's form page offers a related link labelled "CMS-10106-HTML English." Following it returns the PDF, not an HTML form. There is no browser fill-in version at that address today, whatever the label says.

The address that will lose your form

The 03/2026 edition prints the mailing address twice, on page 1 and again at the foot of page 3:

1-800-MEDICARE Written Authorization Dept. PO Box 1270 Lawrence, KS 66044

That box is also where the 2027 handbook tells people to write to Medicare generally (page 111). Then, at the bottom of page 1, the Paperwork Reduction Act paragraph gives a second address — CMS, 7500 Security Boulevard, Attn.: PRA Reports Clearance Officer, Mail Stop C4-26-05, Baltimore, Maryland 21244-1850 — followed immediately by CMS shouting:

DO NOT MAIL YOUR COMPLETED FORM TO THIS ADDRESS. If you do, we won't be able to process your form, and your request to release your personal health information will be significantly delayed.

An agency does not put a sentence in capital letters on a form unless the mail keeps arriving at the wrong dock.

The faster route is the parent's own secure Medicare account, which both the form and the handbook recommend. Two things about that. First, the account belongs to the beneficiary, so somebody has to be able to log in as your mother, and logins have changed: the Medicare & You 2027 handbook (CMS Product No. 10050, page 14) says the account now accepts ID.me, CLEARme.com, or Login.gov, and warns that "once you connect your existing Medicare account with one of these identity verification services, you can't log in to your Medicare account using your existing Medicare username or password." A family sharing an old username can lose it by switching.

Second, filing is not the finish line. The handbook's page 111 box is exact about this: "Medicare must process the form before the authorization becomes effective." No published turnaround accompanies that sentence, and I could not find one on cms.gov or medicare.gov on 26 September 2026. Which means the honest instruction is: do not schedule a discharge-planning call around a form you mailed yesterday. Send it, then call 1-800-MEDICARE and ask whether the authorization shows as on file.

Two boxes decide whether the form is any use to you

The middle of the form is a scope question, and checking the wrong half of it produces an authorization that is technically on file and practically useless.

Choose the information you want 1-800-MEDICARE to share. Check only one box: [ ] Any information [ ] Limited information

Pick "Limited information" and four named categories appear, plus a write-in line: Medicare eligibility, Medicare claims, Health & drug plan enrollment, Premium payments, Other. For somebody reconciling a facility statement against what Medicare actually paid, or counting how many of the 100 skilled nursing days have been used, Medicare claims is the box that does the work. Plan enrollment answers which Advantage or drug plan a parent is in when nobody can find the card. Premium payments covers the Part B deduction and the income-related surcharge. Eligibility alone gets you a date and little else.

Below scope sits duration, and it is not the one-year default people expect:

[ ] Share my personal health information indefinitely. [ ] Share my personal health information only for this period of time: Start date End date

An asterisk hangs off that block: "Your state may have different limits on how long Medicare can share your personal health information." Then comes a purpose line, which exists because 45 CFR 164.508(c)(1)(iv) requires "a description of each purpose of the requested use or disclosure." CMS answers its own question for you in the prompt — "You can write 'At my request.'" — and the rule is what lets it: the same paragraph provides that "the statement 'at the request of the individual' is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose." The answer that looks too vague to be safe is the one the regulation names as sufficient.

Page 2 holds two names. "To share with more than 2 people or organizations, list their name and address on the back of this form." If one of those entries is an organization — an elder law office, a geriatric care manager's agency — the 05/23 instructions added a rule the 03/2026 form no longer repeats: "If you include an organization, you must also identify at least 1 person within that organization who can get your personal health information." Naming the individual costs nothing and removes the question.

Who may sign changes at every counter

The reason this form confuses families is that it is one of at least four separate permissions, and each agency wrote its own rules about who holds the pen.

The signature row is where people lose a week. Medicare's form has a personal representative block. Social Security's does not. The certification on Form SSA-3288 (04-2026 edition, OMB No. 0960-0566, read 26 September 2026) reads: "I am the individual, to whom the requested information or record applies, or the parent or legal guardian of a minor, or the legal guardian of a legally incompetent adult." It is signed under penalty of perjury, 28 U.S.C. § 1746, and the paragraph names a fine of up to $5,000 for seeking records about another person under false pretenses. An agent holding a durable power of attorney is not on that list. That same gap is what sends families toward representative payee, which has its own form and its own duties.

The last column matters more often than it sounds in eldercare. If a parent fell, and anyone is pursuing a liability or workers' compensation claim, the Benefits Coordination & Recovery Center runs a separate authorization system. Its Authorization Documentation page says the beneficiary side comes in two kinds — "Two types of beneficiary authorizations are Beneficiary Proof of Representation (POR) and Beneficiary Consent to Release (CTR)" — and that CMS will release a beneficiary's information "only if the Medicare beneficiary has provided this authorization to CMS in writing." Broadly, a Consent to Release lets a named person receive the correspondence on the case, while Proof of Representation lets them act on it; the portal keeps separate help pages for each definition, and those two pages refuse automated requests, so this page does not quote them.

What the retrievable page does pin down is the gate everyone trips over. Each submitted authorization carries a status that "can be Verified, Unverified, or Invalid," a start date and an end date, and the page states flatly: "You will not be able to receive correspondence until your authorization is in a Verified status." Filed is not the same as working here either (page read 26 September 2026).

If your parent cannot sign

Two routes exist, and only one of them is printed on the form.

The printed one is the personal representative block on page 3. Check the box, fill in name, address, phone number and relationship, and follow the second instruction: "Attach a copy of the paperwork that shows you can act for the person (like a Power of Attorney)." The form stops there. It does not distinguish a health care power of attorney from a financial one, which is a distinction that matters enormously at a hospital medical records window and is the subject of HIPAA authorization versus a power of attorney.

The unprinted route runs through the privacy notice the form points at. The Notice of Privacy Practices for Original Medicare, reproduced on page 107 of the 2027 handbook, lists who Medicare must give information to: "You, to someone you name ('designate'), or someone who has the legal right to act for you (your personal representative)." That tracks the HIPAA rule itself. 45 CFR 164.502(g)(1) requires a covered entity to "treat a personal representative as the individual," and (g)(2) is the paragraph that gets an adult child there: if under applicable law a person "has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care," the covered entity must treat that person as a personal representative for information relevant to that representation. Read together, a genuine personal representative should not need to authorize themselves. What documentation 1-800-MEDICARE will accept to establish that on a phone call is not published. Ask on an ordinary Tuesday, not on the day a notice arrives.

If the parent has already died, the form covers it and is unusually specific about proof. Include "a copy of the legal documentation that gives you the authority to get this information. (For example: Executor/Executrix papers, next of kin attested by court documents with a court stamp and a judge's signature, a Letter of Testamentary or Administration with a court stamp and judge's signature, or personal representative papers with a court stamp and judge's signature.)" Court stamp and judge's signature appear three times in one sentence. A photocopy of a will is not on the list.

New York gets its own block, and it moved

The current form carries a New York section between scope and duration. It cites New York State Public Health Law protection for information about alcohol and drug abuse, mental health treatment, and HIV, and asks a straight question with two answers: yes, share it, or no, do not.

The 05/23 edition handled the same law by routing New York residents through a detour. Its instructions told them to check "Limited Information" in section 2A even if they wanted everything shared, then tick boxes in 2B, then answer the New York question in 2C. If the copy in front of you came from a plan's website and runs six pages, that instruction is in it, and it does not match the three-page form CMS is publishing now. Work from the edition you actually intend to mail.

What this authorization does not reach

The Advantage plan or the drug plan. The notice behind this form is headed "for Original Medicare." An MA organization holds its own records and must, under 42 CFR 422.118, "establish procedures to" abide by confidentiality law, specify "to whom and for what purposes it will disclose the information outside the organization," and ensure "medical information is released only in accordance with applicable Federal or State law." Its authorization form is its own. For grievances and appeals the plans work from a different definition entirely, and Medicare Advantage and Part D do not even word it the same way. Under 42 CFR 422.561 a representative is "an individual appointed by an enrollee or other party, or authorized under State or other applicable law, to act on behalf of an enrollee or other party involved in the grievance or appeal." The Part D definition at 42 CFR 423.560 drops "other party" and names the acts instead: "an individual either appointed by an enrollee or authorized under State or other applicable law to act on behalf of the enrollee in filing a grievance, obtaining a coverage determination, or in dealing with any of the levels of the appeals process."

Social Security. Enrollment, the Part B premium and how it is withheld, the late enrollment penalty, benefit verification letters. Different agency, different form, different signature rule, as above.

The facility and the doctors. The chart, the nursing notes, the itemized statement behind the monthly bill. Those belong to the provider and are governed by 45 CFR 164.524 and by state records law.

Appeals need an appointment, not a disclosure

The moment a coverage denial arrives, the relevant form changes to CMS-1696, Appointment of Representative (OMB No. 0938-0950, expires 12/31/2028). It is not a permission to talk; it appoints somebody to act.

42 CFR 405.910(c) lists seven things a valid appointment must do. It has to be in writing, signed and dated by both the party and the person agreeing to represent them. It has to contain a statement appointing the representative and, for a beneficiary, "authorizing the adjudicator to release identifiable health information to the appointed representative." It needs a written explanation of the purpose and scope of the representation, both names with phone numbers and addresses, the beneficiary's Medicare number, the representative's professional status or relationship to the party, and it has to be "filed with the entity processing the party's initial determination or appeal."

Paragraph (d) says what happens when one of the seven is missing. The adjudicator "should contact the party and provide a description of the missing documentation or information," and until the defect is cured the prospective representative "lacks the authority to act on behalf of the party, and is not entitled to obtain or receive any information related to the appeal, including the appeal decision." Paragraph (e)(1) sets the life of a valid appointment at one year from the date it carries both signatures, and the form's instructions add that it can be reused for other appeals during that year.

Where it goes is deliberately unspecified: "Send this form to the same location you send your claim, appeal, grievance, or request." There is no central box for this one.

The timing argument for signing it early is the notice of non-coverage. A fast appeal of a skilled nursing discharge runs in hours, not days, and the deadline sits in the middle of a page most families read for the first time on a Friday afternoon — the mechanics are in the NOMNC deadline. Hunting for two signatures inside that window is a bad plan. Having a signed CMS-1696 in the binder before anything is denied costs one afternoon.

Cancelling it, and the part cancelling cannot reach

Revocation goes to the same post office box, in writing. The form's own sentence sets the limit: "Your letter will cancel your authorization form, and we'll no longer share your personal health information (except for any information we already released based on your original permission)."

Forward-only, in other words. If a relative was named in 2024 and has already been told what Medicare paid, cancelling in 2026 does not pull that back. It only closes the next call. The same is true across all four systems described above, and it is the strongest argument for the date-range option rather than the indefinite one when the person being named is anybody other than the adult child doing the paying.

Filing them in an order that does not waste a week

While a parent can still sign, in one sitting, with a pen:

1. CMS-10106, "Any information" or "Limited information" with the claims box ticked, indefinite duration if the named person is you, both copies made before it goes in the envelope. Online if the account works.
2. CMS-1696, signed by your parent and by you, left blank as to the claim. It becomes usable the day a denial appears and stays usable for one year.
3. SSA-3288, at the local Social Security office, with item 6 ticked for Medicare entitlement dates and item 9 used to name the specific notices you want, since SSA "will not honor a request for 'any and all records' or 'the entire file.'"
4. The plan's own form, requested from the member services number on the back of the Advantage or Part D card. Nothing above substitutes for it.

Then a phone call a few weeks later to confirm the authorization is showing, because processing is a step and not an assumption. Free help reading any of this is at your State Health Insurance Assistance Program, listed on pages 114 through 117 of the handbook or at shiphelp.org.

Sources

Forms and pages were opened and read on 26 September 2026. Regulations were pulled from the eCFR versioner API against an issue date of 1 September 2026, titles 42 and 45.

• Form CMS-10106, Authorization to Disclose Personal Health Information Release Form, 03/2026 edition, OMB No. 0938-0930, and its CMS form page giving revision date 2026-03-01 and OMB expiration 2029-03-31.
• OMB control number history for 0938-0930 and the ICR concluded 3 March 2026 (reference 202511-0938-006, "approved with change," 1,000,000 annual responses, 250,000 burden hours, abstract citing the HIPAA Privacy Rule at 164.508). An edition of the form stamped "Standard form 10106 (April 2014)" is attached to an earlier ICR in the same OMB record; it carries three name-and-address slots and directs the envelope to "Medicare BCC, Written Authorization Dept." at the same PO Box 1270.
• The 05/23 edition of CMS-10106, read from a copy still posted by a Medicare plan at medicare.peakhealth.org. Cited only for what that edition said, not as current guidance.
• Medicare & You 2027, CMS Product No. 10050: page 14 (Medicare account and identity verification), page 106 (right to access personal health information), pages 107 and 108 (Notice of Privacy Practices for Original Medicare, effective 23 September 2013), page 111 (the authorization box and the Lawrence, Kansas address), pages 114 through 117 (SHIP contacts).
• Form CMS-1696, Appointment of Representative, OMB No. 0938-0950, expiring 12/31/2028, and 42 CFR 405.910.
• 42 CFR 422.118 (confidentiality and accuracy of enrollee records), 42 CFR 422.561 and 42 CFR 423.560 (definitions of representative for Medicare Advantage and Part D).
• HIPAA Privacy Rule: 45 CFR 164.508 (authorization core elements at (c)(1), the "at the request of the individual" purpose provision at (c)(1)(iv), the conditioning prohibition at (b)(4)), 45 CFR 164.502(g)(1) and (g)(2) (personal representatives), 45 CFR 164.524 (individual access to records held by a provider).
• Form SSA-3288, Consent for Release of Information, 04-2026 edition, OMB No. 0960-0566.
• Medicare Secondary Payer Recovery Portal, Authorization Documentation help page. The portal's separate Consent to Release and Proof of Representation definition pages return HTTP 403 to automated requests, so nothing on this page is quoted from them.
• Medicare.gov's list of other forms, which describes CMS-10106 as "giving Medicare permission to talk to someone you choose about your claims and health records, if you can't."

Three statements above are observations about documents rather than statements of policy, and are dated for that reason. CMS publishes no processing time for this form that I could locate; the related link labelled "CMS-10106-HTML English" served a PDF when followed on 26 September 2026; and no CMS or Medicare page I could find sets out what documentation 1-800-MEDICARE accepts from a personal representative over the phone. None of the three means more than it says, and the last two are the reason this page tells you to call and ask rather than guess.

Nothing on this page addresses what a state's own privacy law adds on top, and the duration block on the form explicitly warns that states vary. Who may sign a document for an adult who can no longer sign for themselves is a question of state law and belongs to an elder law attorney licensed where your parent lives. What is above is the federal paperwork layer: which form, which box, which address, and which clock starts when.

This page is general information, not legal, medical, or financial advice. See the terms.