Families often assume that being a resident’s spouse, adult child, or closest relative automatically gives them access to medical information. In assisted living, that is not always true. HIPAA protects a resident’s health information, but it also allows appropriate communication with people involved in the resident’s care.
For families in North Versailles, PA, the key is understanding the difference between being a relative, being involved in care, having written permission, and having legal authority to make health care decisions.
What does HIPAA protect in assisted living?
HIPAA protects individually identifiable health information held by certain health care providers, health plans, and health care clearinghouses. This may include diagnoses, medication information, treatment plans, medical records, test results, appointment details, billing information, and other information connected to a resident’s health.
Assisted living residences may maintain health-related records, but HIPAA does not automatically apply to every record or every employee in the same way. A residence may have HIPAA responsibilities when it performs covered health care functions or transmits health information electronically. Separate federal and Pennsylvania privacy requirements may also apply.
Pennsylvania assisted living regulations require resident records to be kept confidential, protected from unauthorized access, and governed by policies covering access, storage, authorized use, and release. ([pa.gov](https://www.pa.gov/content/dam/copapwp-pagov/en/dhs/documents/licensing/bhsl-licensing/documents/Assisted_Living_Residences-2800_Regulatory_Compliance_Guide_RCG.pdf?utm_source=openai))
This means a family member may encounter privacy rules even when asking about information that seems routine, such as medication changes, falls, appointments, or changes in daily functioning.
Does being a family member automatically allow access?
No. HIPAA does not give every relative an automatic right to a resident’s complete health information.
A provider may share information with a family member, close friend, or another person identified by the resident when the information is directly relevant to that person’s involvement in care or payment. For example, staff may be able to discuss a medication question with a daughter who helps organize medical appointments, or explain discharge instructions to a spouse who is participating in the resident’s care. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/disclosures-to-family-and-friends/index.html?utm_source=openai))
However, permission to discuss one issue does not necessarily provide access to the entire medical record. A staff member may be allowed to confirm that a resident had a medical appointment without disclosing unrelated diagnoses, psychiatric information, or details about another condition.
The resident’s preferences matter. If the resident objects to sharing information, the provider generally must respect that objection unless another legal rule applies.
What is the difference between permission and legal authority?
Written authorization allows a resident to identify who may receive specified health information. The authorization may describe the information covered, the purpose of the disclosure, and the people or organizations allowed to receive it.
A personal representative has a different kind of authority. This is generally someone legally authorized to act for the resident in health care matters, such as a health care agent under a valid power of attorney or a court-appointed guardian with relevant authority. Under HIPAA, a personal representative is generally treated as the resident for purposes of accessing protected health information, subject to certain exceptions. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html?utm_source=openai))
Being named in a will does not necessarily make someone a personal representative for health care decisions while the resident is alive. Likewise, being the person who pays bills does not automatically create authority to receive all medical information.
Families should distinguish among:
- A contact person for emergencies
- A person authorized to receive selected information
- A health care agent or other personal representative
- A person responsible for financial matters
- A person designated to review the assisted living resident record under Pennsylvania rules
These roles may overlap, but they are not always identical.
Can a resident choose who receives information?
Yes. A resident who has decision-making capacity may generally direct a provider to share information with a chosen person. HHS explains that a resident may direct a covered entity, in writing and with a signed request, to send a copy of protected health information to a designated person, subject to limited exceptions. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2069/under-hipaa-when-can-a-family-member/index.html?utm_source=openai))
A resident may want information shared with an adult child, sibling, friend, partner, neighbor, or another trusted person. The person does not have to be a legal relative.
A practical authorization can address questions such as:
- May staff discuss medication changes?
- May the person receive updates after a fall or hospital visit?
- May the person review assessments and support plans?
- May the person discuss billing or payment matters?
- Should information be shared by phone, email, a patient portal, or in person?
- Should one family member receive information while another does not?
The residence or outside health care provider may use its own authorization form. Separate forms may be needed for the assisted living residence, physician, pharmacy, hospital, therapy provider, or laboratory.
What if the resident has dementia or cannot make decisions?
A diagnosis of dementia does not automatically eliminate a resident’s privacy rights or automatically give relatives access to records. The important question is whether the resident can make the particular decision and whether another person has legally recognized authority.
If a health care power of attorney has become effective, the named agent may generally act as the resident’s personal representative for health care matters. A guardian may also have authority, depending on the court order and applicable law.
Even when a personal representative is involved, HIPAA permits a provider to refuse access in limited circumstances, including when the provider reasonably believes that sharing information could contribute to abuse, neglect, domestic violence, or another serious risk. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html?utm_source=openai))
Families should not assume that a residence can resolve disputed authority based only on family relationships. Staff may need to review the relevant legal document, its scope, and whether it is currently effective.
What information can be shared during an emergency?
HIPAA does not prevent necessary communication during an emergency. Providers may share relevant information with family members or others involved in care when the resident agrees, does not object, or when professional judgment indicates that sharing is in the resident’s best interest.
A provider may also notify family or another responsible person about the resident’s location, general condition, or death when the HIPAA requirements for that disclosure are met. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?utm_source=openai))
This does not mean every detail must be released. In a winter power outage, transportation emergency, infectious disease concern, or sudden hospital transfer, staff may need to share practical information quickly while limiting disclosure to what is relevant.
What records can a family member review in Pennsylvania?
Pennsylvania’s assisted living resident-rights information states that a resident, the resident’s designated person, and other individuals approved in writing by the resident may access, review, and request corrections to the resident’s record. ([pa.gov](https://www.pa.gov/agencies/dhs/resources/aging-physical-disabilities/personal-care-homes/personal-care-home-faq?utm_source=openai))
The phrase “resident’s record” may include information maintained by the residence, such as assessments, support plans, medication documentation, incident reports, and related care records. It does not necessarily mean that the residence holds every medical record created by outside providers.
For example, a residence may have documentation that a hospital visit occurred, while the hospital maintains the detailed emergency department record. A family member may need separate authorization to obtain the hospital’s records.
What should families clarify before a crisis?
The easiest time to address privacy questions is before a fall, hospitalization, medication concern, or sudden change in decision-making ability.
Families can ask the resident and residence to clarify:
- Who is listed as the emergency contact?
- Who may receive routine care updates?
- Who may review the resident record?
- Is a health care power of attorney available and current?
- Does the authorization cover outside physicians, hospitals, pharmacies, and therapists?
- How should staff communicate during evenings, weekends, or severe weather?
- What information may be left in a voicemail or sent electronically?
Privacy rules are not intended to isolate residents from their families. They are designed to preserve the resident’s control over personal information while allowing appropriate communication with people who genuinely assist with care. Clear written preferences and current legal documents help families and staff understand where that boundary lies.
