When a family shares the work of caring for someone, the hardest part usually isn't where the medical records live. It's who gets to see them. A spouse manages the daily medications. An adult child handles the appointments and talks to the doctor's office. A sibling deals with insurance paperwork. Someone has to make decisions if the person can't. Each of those roles needs a different slice of the same record, and most families only learn how the access rules actually work after they've hit a wall: a hospital that won't discuss a parent's condition over the phone, a patient portal that quietly locks a parent out of a teenager's account, a power of attorney that turns out not to cover what everyone assumed it covered.
None of that is really a filing problem. It's a permissions problem, and it's governed by real law that varies by state. This guide covers the three ways a family member can legally reach someone's record, how that differs for a spouse, an adult child, an aging parent, and a minor, what the 21st Century Cures Act changed (and didn't), and how to set shared access up before a health event, not during one.
This article explains general patterns in U.S. law and common health-system practice. It isn't legal or medical advice, and the specifics vary by state and by provider. Confirm details with your own providers and, where it matters, an attorney.
- Being someone's spouse, adult child, or sibling does not, by itself, give you access to their medical records. Access comes from one of three things: informal "involved in care" permission, a signed HIPAA authorization, or personal-representative status.
- A healthcare power of attorney makes you a personal representative for medical decisions and records. A financial power of attorney usually does not, unless it specifically says so.
- Parent access to a child's patient portal typically drops to a limited view around age 12 to 13 and ends at 18, because during adolescence a parent stops being the personal representative for confidential services. The exact age and rules vary by state and health system.
- The 21st Century Cures Act information-blocking rule secures your own access to your own records without delay. It does not give family members access to yours.
- Set it up before a health event: a healthcare POA for each adult, a HIPAA authorization on file with key providers, accepted portal proxy invitations, and an emergency-access plan. In a crisis, it's too late to start.
Why sharing one family record is its own problem
Filing systems solve where the records are. They don't solve who is allowed to see them, and in a family where care is a shared job, that second question is the real work.
Think about how caregiving actually splits across a household. A spouse often tracks daily medications and day-to-day changes. An adult child schedules appointments and is the person a provider calls back. A sibling handles insurance claims and billing. And someone, sometimes one of those same people, needs the authority to make a decision if the patient can't make it themselves. Each role genuinely needs a different slice of the record, not full access to everything by default.
Once you know who should see what, the practical work of gathering and filing the records themselves is a separate, more mechanical task, worth tackling once the permissions question is settled.
The records themselves are scattered, too. Every provider tends to run its own patient portal, and there is no national “family account” that pulls a person's health information into one place automatically. Families are already stitching this together at real scale. Nearly 63 million U.S. adults, roughly one in four, provided unpaid care to a family member in the past year, and 29% of them are “sandwich generation” caregivers raising kids and caring for an aging parent at the same time, according to AARP and the National Alliance for Caregiving's 2025 Caregiving in the U.S. report. That work carries a real cost in time and money, covered in our breakdown of the time and financial cost of caregiving. Fighting for basic access to information on top of that shouldn't be part of the job, but it often is.
The share of people accessing the portal of someone they help care for more than doubled in four years, from 24% in 2020 to 51% in 2024, according to a 2024 data brief from the Assistant Secretary for Technology Policy and the Office of the National Coordinator for Health IT (ONC/ASTP). That same data brief found that 59% of portal users have records spread across more than one portal, but only 7% use any app that pulls those separate portals into a single view. Portal access itself has grown too: 77% of people were offered access to a portal in 2024, up from 42% a decade earlier, and 65% of those offered access actually used it in the past year.
The coordination load on caregivers has grown along with it. In a separate 2020 AARP and National Alliance for Caregiving report on caregivers of adults 50 and older, 66% of caregivers said they communicate with a care recipient's health care providers, 72% monitor how severe or serious the condition is, and about 58% perform medical or nursing tasks like wound care or medication management. In the same report, 26% of caregivers said they found it difficult to coordinate care, up from 19% five years earlier. The record itself also carries information worth acting on beyond the immediate crisis; the same access that solves who-sees-what today is also what eventually lets a family put family health history to use for screening decisions, but only once the underlying information is complete and reachable by the people who need it.
The three ways a family member can legally reach a record
Under HIPAA, the federal law that controls who can see and share a person's health information, there are three distinct tiers of family access, and people mix them up constantly. There is informal “involved in care” permission, a signed HIPAA authorization, and personal-representative status. Each one unlocks a different amount of access, and confusing them is where most family access problems start.
Informal sharing happens when a provider discusses care with someone present during an appointment, someone the patient has agreed to include, or someone the patient hasn't objected to when given the chance. It also covers situations where the patient is incapacitated and the provider believes sharing is in the patient's best interest. No form is required for this, and the regulation governing it (45 CFR 164.510(b)) leaves the decision to the provider's professional judgment case by case. It gets you a conversation, not the chart.
A HIPAA authorization is a signed form in which the patient names who can receive their information and how much of it. It can be scoped narrowly, like immunization records only, or broadly, like the full chart, and it can cover a specific date range. It's revocable at any time, and because each provider keeps its own records, an adult acting on their own behalf generally needs to file one with every provider they want covered, not just one central form.
Personal-representative status is the strongest of the three. Under 45 CFR 164.502(g), a personal representative is treated as if they were the patient for the matters their authority covers, including the patient's full right of access under 164.524.
A healthcare power of attorney agent, a court-appointed guardian, the parent of a minor, and the executor of an estate can all count as personal representatives. But who actually qualifies, and how a provider verifies it, is decided by state law, not a single federal standard. According to HHS Office for Civil Rights guidance on personal representatives, a provider may also decline to treat someone as a personal representative, even with the right paperwork, in situations involving suspected abuse, neglect, or endangerment.
| Route | What it unlocks | Who grants it | How durable | Typical use |
|---|---|---|---|---|
| Involved-in-care sharing | A conversation about care in progress, not the record itself | The provider, case by case | Not durable; reassessed at every visit | Being present at an appointment or getting a status update |
| HIPAA authorization | Exactly the records and date range named in the signed form | The patient, in writing | Lasts until revoked, but usually must be filed with each provider separately | Getting a specific record or result to a specific person |
| Personal representative | Full access to the record for matters the representative status covers | State law, based on the underlying legal instrument | Lasts as long as the underlying authority lasts | Ongoing coordination of someone's care |
“Personal representative means durable, chart-level access. An authorization means exactly what the patient wrote down, and nothing more. Involved-in-care sharing means a hallway conversation, not the chart.”
Spouses and adult children: relationship isn't access
An adult patient's records aren't automatically open to a spouse or adult child. To get real access, you need one of the three routes above: a signed HIPAA authorization on file with each provider, portal proxy access the patient grants, or personal-representative status through a healthcare power of attorney or guardianship.
This surprises people constantly. An adult child calls a hospital to check on a parent, or a spouse calls about a spouse, and gets turned down flat, even when the relationship is obvious and the intentions are good. According to HIPAA Journal's explainer on spouses and HIPAA, marriage alone does not create a right of access under the law. For a competent adult, the fastest low-friction path is usually setting up portal proxy access with a spouse or adult child, plus a broad HIPAA authorization on file at the main providers, well before it's needed.
Incapacity changes the picture, and this is where state law does most of the work. Where state law gives someone default authority to make health care decisions for an incapacitated person, often naming a spouse first in the order of priority, a provider generally must recognize that person as a personal representative once incapacity is established. New York's Family Health Care Decisions Act works this way, giving a spouse (or, absent a spouse, other listed relatives) decision-making authority for an incapacitated patient without a prior POA, as Cona Elder Law explains for New York specifically. Other states structure default-surrogate authority differently, and some don't include a spouse automatically at all. So an incapacitated patient's spouse becomes a representative automatically in some states and not in others. Never assume either way. Check your own state's surrogate decision-making law, or ask an elder-law attorney, before you count on it.
Aging parents: healthcare POA, financial POA, and guardianship
For a parent, the instrument you actually want is a healthcare power of attorney (also called a healthcare proxy, or a durable power of attorney for health care), signed while your parent still has the mental capacity to sign it. It makes the named agent a personal representative for medical decisions and records. A financial power of attorney usually does not do the same thing, and guardianship is the slower, court-ordered fallback for when no POA exists and capacity has already been lost.
| Instrument | What it grants for medical records | When it activates | Notes |
|---|---|---|---|
| Healthcare power of attorney | Personal-representative access to records and decisions, within the scope the document grants | Immediate on signing, or “springing”, meaning it only takes effect after a documented finding of incapacity, often by one or two physicians | Sign it while your parent still has capacity; name a primary and a backup agent |
| Financial power of attorney | Typically none, unless the document separately adds a HIPAA/health-information authorization clause | Depends on the document; can be immediate or springing | Read the actual grant of authority; a broad-sounding financial POA still usually doesn't cover medical records |
| Guardianship (or conservatorship of the person) | Court-ordered personal-representative status once a judge finds the person incapacitated | Only after a court proceeding, which typically takes weeks to months | The fallback when there's no POA and capacity is already lost; more restrictive of a person's autonomy than a POA they chose themselves |
The terminology and activation rules in that table vary by state. Some states use “conservator” instead of “guardian,” the standards for what counts as a documented incapacity finding differ, and the default order of who can act as a surrogate decision-maker without any paperwork at all is set state by state, as covered by elder-law guidance like TCK Law's comparison of healthcare and financial powers of attorney. Say “healthcare POA, sometimes called a healthcare proxy,” and point your family to your own state's statute or an elder-law attorney for the activation specifics that actually apply to you.
Most people don't have this done. Roughly one in three U.S. adults, about 33%, has completed a healthcare power of attorney or other advance directive, based on 2011 to 2016 data published in Yadav et al., Health Affairs, 2017. Among a narrower, older population, adults age 50 to 80, 46% have completed at least one advance-care-planning document, according to the University of Michigan National Poll on Healthy Aging, 2024. Those are two different populations measured seven years apart, not one trend, and there isn't a current single figure covering all U.S. adults. Either way, the point stands: most families are starting this from zero, and it's far easier to do before a crisis than during one. For the fuller picture of supporting a parent day to day, not just the legal instruments, see the broader caregiver guide for aging parents.
Kids and teens: why portal access changes around age 12 to 13 and ends at 18
A parent is normally the personal representative for a minor child and can see their records without any extra paperwork. But during adolescence, that stops applying to confidential services the minor is legally allowed to consent to on their own, which is why patient portals step parent access down, commonly around age 12 to 13, and remove it entirely at 18.
HIPAA sets out three specific situations where a parent is not the personal representative for a piece of information: when a minor lawfully consents to care and no parental consent is required, when care is court-directed, and when a parent has agreed to let the minor and provider have a confidential relationship for that care. Outside those carve-outs, HIPAA defers to whatever state law says. In practice, a “limited” teen portal view still commonly shows things like immunizations, allergies, and growth charts, and allows some scheduling, while withholding sensitive visit notes; exactly what's shown varies by health system. A teen can often extend proxy access further, through their own consent, using a separate teen-proxy-consent form where the health system offers one.
The portal age threshold itself isn't a single fixed number. Different health systems and different states set it at 12, 13, or 14, and what “limited access” actually includes varies by organization, according to the American Academy of Pediatrics' guidance on parental access to medical records. Treat “around age 12 to 13” as a general pattern, not a guarantee for your own child's portal.
State law also decides which categories of care a minor can consent to without a parent, and this is one of the fastest-moving areas of health policy right now. According to Guttmacher Institute's tracking of minors' access to STI services, as of August 1, 2026, a minor may consent to STI testing and treatment in all 50 states and Washington, D.C., though 16 states have provisions allowing parental notification. For contraceptive services, tracked separately by Guttmacher, also as of August 1, 2026, 23 states and D.C. let all minors consent on their own, 16 states allow it only in defined circumstances (such as being a parent already, or being married), and 2 states require parental consent.
For outpatient mental health and substance-use treatment, the rules vary widely by state and don't reduce to a simple count; check Guttmacher's live overview of minors' consent law directly for your state, since this is an area where positions adopted by groups like the Society for Adolescent Health and Medicine and state statutes don't always align.
This is also actively changing: both Idaho and Tennessee enacted laws in 2024 that expand parental consent or access requirements for a minor's care, moving in the opposite direction from the states above. Date-stamp anything you read on this topic, and verify it against your own state before you rely on it.
Access questions start even earlier than adolescence. If your family is weighing prenatal genetic testing during a pregnancy, know that the results become part of the child's record once they're born, subject to the same parent-as-personal- representative rules described above, and the same step-down once adolescence starts.
What the Cures Act information-blocking rule did, and didn't do, for your family
Since April 2021, the 21st Century Cures Act's “information blocking” rule has barred providers, EHR (electronic health record) vendors, and health information networks from unreasonably interfering with your access to your own electronic health information. In practice, that means test results, clinical notes (often called “open notes”), and other records show up in your patient portal without unnecessary delay. This rule secures your own access. It does not give your spouse, your adult child, or any other family caregiver access to your records.
“Open notes” means a patient generally can't ask a provider to selectively hide specific notes from a family member they've already granted proxy access to; once someone has proxy access, they typically see what the patient sees. If you want to keep certain information more private, the better tool is scoping the proxy grant itself more narrowly in the first place, not asking a provider to filter notes after the fact.
Enforcement is where precision matters most, and where a lot of secondhand summaries get it wrong. Civil penalties of up to $1,000,000 per violation apply specifically to health IT developers and health information networks or exchanges, under an HHS Office of Inspector General final rule effective September 1, 2023. Health care providers themselves don't face that penalty. Instead, they face a separate “disincentives” framework finalized by HHS in 2024, tied to existing Medicare and other federal payment programs rather than a direct fine. It's not accurate to say providers can be fined $1 million for information blocking; that figure applies to a different set of actors entirely.
For deeper background on the rule generally, HealthIT.gov's information-blocking overview and OpenNotes' explanation of the federal rule are both useful starting points. A December 2025 ASTP/ONC deregulatory proposal could change parts of this framework; treat the description above as accurate as of research in September 2026, and check current status before relying on it for anything time-sensitive.
Setting up shared access, step by step
Most shared access is a one-time setup, not an ongoing chore. The core moves are: grant portal proxy access at every health system involved, put a HIPAA authorization on file with the main providers, and, if you want a combined view, connect a records app through the patient-access API.
Here's how a generic portal proxy flow typically works. Exact screens and labels vary by vendor and health system, so treat this as the general shape rather than a screenshot of any specific product.
Aggregation solves a different problem: seeing several providers' records in one place instead of logging into each portal separately. Apps like Apple Health Records, Android health apps, and various third-party apps connect to participating providers through the HL7 FHIR patient-access API, the standardized connection method the Cures Act requires certified health IT to support. Roughly nine in ten hospitals report enabling this kind of app-based access, according to an ONC/ASTP data brief on hospital use of APIs. It's still genuinely clunky in practice: coverage depends on each provider actually connecting its endpoint, historical records, imaging, and free-text notes often don't come through cleanly, and the resulting view is typically read-only and built for one patient at a time, with no native multi-person family view. That gap shows in the numbers, too; recall that only 7% of portal users use any app that consolidates multiple portals. A separate system, CMS's Patient Access API, covers insurance and claims data rather than clinical records, and is worth knowing about separately.
If your family is also comparing at-home testing and family health documentation options, the same access questions apply once results come back: who can see them, and where they end up living alongside everything else.
A crisis-ready setup: emergency and break-glass access
There's no consumer version of “break-glass” access to someone else's medical record in an emergency. “Break-glass” is an internal term for an audited override clinicians can use inside their own EHR system during a genuine emergency; it isn't a right a family member can invoke from outside the system. What a family can actually do is make the information reachable in advance, so a crisis doesn't depend on anyone gaining new access in the moment.
Start with what's already on the phone. iPhone's Medical ID (with “Show When Locked” turned on) and the equivalent Android emergency information feature let first responders see conditions, allergies, current medications, and emergency contacts directly from the lock screen, without unlocking the phone or needing any account access at all. Next, keep a shared secure document, reachable by more than one family member, with a current medication list, allergies, diagnoses, a provider directory, insurance ID numbers, and PDF copies of the healthcare POA and any HIPAA authorizations. And make sure portal proxy invitations are actually accepted, not just sent, and that a HIPAA authorization naming the crisis contact is already on file, before you need any of it.
It also helps to remember the incapacity provision from earlier: when a patient can't communicate, a provider may share information with an involved family member using their own professional judgment. An accessible, current medication list in that moment genuinely helps a clinician move faster, even without a formal instrument in hand.
The pre-event checklist and your family access map
Do this while everyone involved still has capacity to sign documents and make choices. It comes down to four things per adult, plus one shared artifact for the whole family.
- A healthcare POA signed by each adult, naming a primary and backup agent, with a clear understanding of whether it's immediate or springing and what would trigger it.
- A HIPAA authorization on file with each key provider for the designated coordinator or coordinators, scoped to what they actually need.
- Portal proxy invitations sent and accepted at every health system, for every person who needs a defined role.
- An emergency-access plan: phone Medical ID or lock-screen info, a shared secure document, and PDF copies of the POA and authorizations.
- A written access map: who has access to what, when it was granted, and a date to review it again.
This is also a natural time to work on documenting your family health history, since that context often shapes what a new provider needs to know, and it tends to get gathered alongside the access paperwork anyway.
A shared platform can hold this alongside the records themselves, instead of the map living in one person's head. Kaizen Health is built to keep a family's records and access roles in one place, so the spouse, the adult child, and the sibling each see the slice of the record their role actually needs.
Kaizen Health keeps a shared record and an access map in one place, with per-person roles so a spouse, an adult child, and a sibling each see what they need without digging through separate portals. Kai, the built-in AI assistant, helps translate terminology and build a question list for the next appointment; it doesn't make legal or medical decisions on your family's behalf.
Try it with a documentRecords after a family member dies
Access after death is handled almost entirely by state law rather than a federal standard. Generally, the executor or administrator of the deceased person's estate becomes the personal representative for HIPAA purposes and can request the records needed to settle the estate or handle related matters. If there's no will and no appointed executor, your state's next-of-kin rules decide who has that authority instead. Because this varies so much by state, it's worth checking your own state's probate rules, or asking an attorney, rather than assuming a specific family member is automatically in charge.
The bottom line
Being related to someone doesn't open their medical record. Access runs through one of three routes: a provider's informal judgment about who's involved in care, a signed HIPAA authorization, or personal-representative status. A healthcare power of attorney creates that representative status for medical decisions and records; a financial power of attorney usually doesn't, unless it says so explicitly. A parent's access to a child's portal steps down as the child reaches adolescence and ends at 18, because state law lets teens consent to some care on their own. The Cures Act secures your own access to your own records; it doesn't extend that access to your family. And all of this works far better set up in advance than assembled during a crisis.
Pick the one adult in your family who will coordinate this. Then, this week, send the portal proxy invitations at each health system involved and start the healthcare POA conversation with a parent or spouse while everyone still has the capacity to sign. Keep the record and the access map together in one shared place your whole family can reach, not scattered across whoever happened to answer the phone last.
References
[1] HHS Office for Civil Rights, “Personal Representatives” guidance. Accessed September 2026. Mirrored at Cornell Law School's Legal Information Institute, which independently confirms the adult, minor-exception, and deceased-patient rules described in this guide.
[2] eCFR, 45 CFR 164.510(b), uses and disclosures requiring an opportunity to agree or object. Accessed September 2026.
[3] eCFR, 45 CFR 164.502(g), personal representatives. Accessed September 2026.
[4] eCFR, 45 CFR 164.524, right of access to protected health information. Accessed September 2026.
[5] HIPAA Journal, “Does HIPAA Apply to Spouses?” Accessed September 2026.
[6] Cona Elder Law, on New York's Family Health Care Decisions Act. Accessed September 2026.
[7] AARP & National Alliance for Caregiving, “Caregiving in the U.S. 2025.” Accessed September 2026.
[8] ONC/ASTP, “Individuals' Access and Use of Patient Portals and Smartphone Health Apps, 2024” data brief. Accessed September 2026.
[9] AARP & National Alliance for Caregiving, “Caregiving in the U.S. 2020,” caregivers of adults 50+. Accessed September 2026.
[10] TCK Law, “Healthcare Power of Attorney vs. Financial Power of Attorney.” Accessed September 2026.
[11] Yadav et al., “Approximately One In Three US Adults Completes Any Type Of Advance Directive For End-Of-Life Care,” Health Affairs, 2017. Accessed September 2026.
[12] University of Michigan National Poll on Healthy Aging, advance care planning report, 2024. Accessed September 2026.
[13] American Academy of Pediatrics (HealthyChildren.org), “Parental Access to a Teen's Medical Records.” Accessed September 2026.
[14] Guttmacher Institute, “Minors' Access to STI Services.” As of Aug. 1, 2026. Accessed September 2026.
[15] Guttmacher Institute, “Minors' Access to Contraceptive Services.” As of Aug. 1, 2026. Accessed September 2026.
[16] Guttmacher Institute, “An Overview of Minors' Consent Law.” Accessed September 2026.
[17] Society for Adolescent Health and Medicine, confidential care resources. Accessed September 2026.
[18] HealthIT.gov (ONC/ASTP), “Information Blocking.” Accessed September 2026.
[19] HHS Office of Inspector General, information-blocking civil monetary penalty final rule, Federal Register, 2023. Accessed September 2026.
[20] OpenNotes, “The Federal Rule on Information Blocking.” Accessed September 2026.
[21] Johns Hopkins Medicine, “MyChart for Parents and Caregivers: Proxy Access.” Accessed September 2026.
[22] ONC/ASTP, “Hospital Use of APIs to Enable Data Sharing Between EHRs and Apps” data brief, 2023 data. Accessed September 2026.
[23] Apple, Health Records Directory Listing FAQ. Accessed September 2026.
[24] CMS, Patient Access API FAQ. Accessed September 2026.
[25] Apple, “Set up and view your Medical ID.” Accessed September 2026.
[26] AARP, “Health Information Privacy Tips for Caregivers.” Accessed September 2026.
Frequently Asked Questions
Not just because you're married. You need a signed HIPAA authorization on file, portal proxy access your spouse has granted, or personal-representative status, typically through a healthcare power of attorney. In some states, a spouse automatically becomes a personal representative if the patient is incapacitated and state law names a spouse as a default decision-maker. Confirm your state's rule rather than assuming either way.