Families often assume that being a close relative automatically gives them access to a loved one’s medical information in assisted living. HIPAA is more specific: it protects a resident’s health information while also allowing appropriate communication with people involved in the resident’s care.
What does HIPAA protect in assisted living?
HIPAA protects individually identifiable health information held or shared by certain health care providers, health plans, and health care clearinghouses. This may include diagnoses, medications, treatment plans, appointment information, test results, care notes, billing information, and details about a resident’s condition.
An assisted living residence may maintain health-related records, but HIPAA does not apply in exactly the same way to every organization or every record. A residence may have privacy obligations under federal law, Pennsylvania law, its contracts, and its own policies. Health care providers serving residents—such as physicians, pharmacies, laboratories, home health agencies, and hospitals—may also be separately subject to HIPAA.
Pennsylvania’s assisted living rules require resident records and health-related information to be maintained as part of the resident’s record. State resident-rights information also recognizes access, review, and correction rights for the resident, the resident’s designated person, and others approved in writing by the resident. ([pa.gov](https://www.pa.gov/agencies/dhs/resources/aging-physical-disabilities/personal-care-homes/personal-care-home-faq?utm_source=openai))
Does being a son, daughter, spouse, or sibling give someone automatic access?
No. Family relationship alone does not always create a right to receive a resident’s complete medical information.
A family member may receive information when the resident has authorized that person, when the person is legally recognized as the resident’s personal representative, or when the person is involved in the resident’s care and the information is directly relevant to that involvement. HIPAA generally looks to legal authority and the resident’s wishes rather than relying only on family status. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html?utm_source=openai))
For example, a daughter helping coordinate appointments may be allowed to discuss an upcoming visit, medication concerns, or transportation. That does not necessarily mean she can automatically obtain the entire medical record.
Can staff speak with family members about a resident’s condition?
Often, yes. HIPAA does not create a blanket rule that prevents staff or health care providers from speaking with family.
If a resident is present and has the capacity to make health care decisions, providers may communicate with family members, friends, or other people the resident has involved in care, as long as the resident does not object. The information shared should generally relate to that person’s involvement in care or payment.
Permission may be expressed directly, documented in writing, or inferred from the circumstances. For example, a resident may introduce a son as the person who helps manage medical appointments. Staff may then discuss information reasonably related to that responsibility. Providers are expected to use professional judgment and should avoid sharing more information than necessary. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/does-hipaa-allow-a-health-care-provider-to-communicate-with-a-patients-family-friends-or-other-persons-who-are-involved-in-the-patient-care.html?utm_source=openai))
A facility may still have a policy requiring written authorization, a release form, identity verification, or a designated contact list. Those procedures may be more restrictive than the minimum HIPAA standard.
What is a personal representative?
A personal representative is someone authorized under applicable law to act for the resident in health care matters. Depending on the circumstances, this may include a court-appointed guardian, an agent under a health care power of attorney, or another person with legally recognized authority.
A personal representative generally stands in the resident’s place for HIPAA purposes and may exercise relevant rights, such as requesting access to health information. The scope of access depends on the authority granted. A person with authority limited to one treatment decision may not have authority over every aspect of the resident’s medical information. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html?utm_source=openai))
A power of attorney for finances is not automatically the same as health care decision-making authority. Families should review the document’s wording rather than assuming that any power of attorney provides unrestricted medical access.
What if the resident has dementia or cannot make decisions?
A diagnosis of dementia, memory loss, or another cognitive condition does not automatically eliminate the resident’s privacy rights. The key questions are whether the resident has decision-making capacity for the specific issue and whether another person has legal authority to act on the resident’s behalf.
If a legally recognized personal representative exists, covered providers generally must treat that person as the resident for relevant HIPAA purposes, unless a specific exception applies. If no personal representative has been established, providers may still share appropriate information with people involved in care when permitted by HIPAA and consistent with professional judgment.
Capacity can also vary. A resident may be able to choose who receives routine updates even if the resident needs help with complex medical decisions.
Can a family member request the resident’s medical records?
The resident has a HIPAA right to request access to records held by a covered provider or health plan. A personal representative generally has a corresponding right for information relevant to that person’s authority.
A family member who is not a personal representative may still receive records if the resident directs the provider in writing to send them. The request should identify the person receiving the information and where it should be sent. Providers may deny or limit access in certain circumstances, such as when the information is not part of the designated record set or when a specific legal exception applies. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/under-hipaa-when-can-a-family-member/index.html?utm_source=openai))
Pennsylvania assisted living resident-rights guidance separately states that a resident and the resident’s designated person, along with individuals approved in writing by the resident, may access, review, and request corrections to the resident’s record. This state-law right should not be confused with an assumption that every relative automatically has full access. ([pa.gov](https://www.pa.gov/agencies/dhs/resources/aging-physical-disabilities/personal-care-homes/personal-care-home-faq?utm_source=openai))
What information may be shared during an emergency?
HIPAA allows information to be shared when needed to provide treatment, protect health or safety, or help notify a family member or other appropriate person about a resident’s location, general condition, or death.
During an emergency—such as a fall, sudden illness, severe winter-weather disruption, or transfer to a hospital—staff may need to communicate with family quickly. HIPAA does not require staff to wait for a lengthy written authorization when a permitted emergency disclosure is appropriate. The information should remain limited to what is reasonably necessary.
For families in the area, it is useful to confirm in advance:
- Who should receive routine updates
- Who should be contacted during an emergency
- Whether more than one contact may receive information
- The resident’s preferred communication method
- Whether the resident wants information withheld from a particular person
What should families discuss before a loved one moves in?
A practical conversation before move-in can prevent confusion later. The resident should be asked whom staff may contact, what information may be shared, and whether any person should not receive updates.
Families may also want to organize:
- A current medication and physician list
- Copies of health care power of attorney documents
- Advance directives and treatment preferences
- Written authorization forms
- Emergency contact information
- Instructions about phone calls, electronic messages, and shared family updates
Seasonal conditions in Schuylkill Haven can make prompt communication especially useful during winter storms, power interruptions, transportation problems, or urgent transfers for evaluation. A designated contact plan helps staff communicate efficiently without requiring several relatives to call separately for the same update.
What can a family member do if information is being withheld?
First, ask which organization holds the information and what authorization or legal document is missing. A residence may not hold the same records as a physician, hospital, pharmacy, or laboratory, so a request may need to be directed to the organization that created or maintains the record.
Ask whether the issue involves:
- Lack of written permission
- Unclear personal representative status
- A facility privacy policy
- A request for information unrelated to the family member’s role
- A concern about the resident’s capacity or objection
If the resident is able, the simplest solution may be for the resident to provide clear written permission. If legal authority is disputed, legal guidance may be necessary because HIPAA depends in part on applicable state law. Complaints about HIPAA privacy practices may be directed to the U.S. Department of Health and Human Services Office for Civil Rights, while Pennsylvania residents also retain rights under the state’s assisted living and personal care home rules. ([pa.gov](https://www.pa.gov/agencies/dhs/resources/aging-physical-disabilities/personal-care-homes/personal-care-home-faq?utm_source=openai))
The central principle is straightforward: a resident keeps control over personal health information, but HIPAA generally permits thoughtful, limited communication with family members who are genuinely involved in care.
