Medical Power of Attorney vs HIPAA Authorization: What's the Difference?

What Is a Medical Power of Attorney?

A medical power of attorney (also called a healthcare proxy or healthcare agent) is a legal document that names someone to make healthcare decisions for you if you become unable to speak for yourself. This person, your agent, can consent to or refuse treatments, choose doctors, and make end-of-life decisions according to your wishes.

The authority granted is broad. It only takes effect when a doctor determines you lack capacity, which is why it is often called a 'springing' power. Without this document, doctors may have to seek court intervention or rely on state default rules, which may not match your values.

State rules vary, but most states require the document to be signed by you and witnessed or notarized. Some states have specific forms, while others accept a general durable power of attorney that includes healthcare provisions.

• Names a healthcare agent to make medical decisions
• Only activates upon incapacity
• Covers treatment choices, surgery, and end-of-life care
• Requires witnesses or notarization (state rules vary)

What Is a HIPAA Authorization?

The Health Insurance Portability and Accountability Act (HIPAA) protects your medical records from unauthorized disclosure. A HIPAA authorization is a separate document that gives specific people permission to access your protected health information (PHI) for a defined purpose or time.

Unlike a medical POA, a HIPAA authorization does not give anyone decision-making power. It simply allows your doctor to share your medical records, test results, and treatment details with the named person. This is critical because without it, healthcare providers may legally refuse to disclose even basic information to family members.

You can create a HIPAA authorization at any time, and it can be as broad or narrow as you choose. For example, you might allow your spouse to receive all records, but limit your adult child to appointment updates only. It can be revoked in writing at any time.

• Permits release of medical records to named individuals
• Does not grant decision-making authority
• Can be limited to specific information or time periods
• May be revoked in writing

Key Differences at a Glance

The core difference is that a medical POA grants decision-making power, while a HIPAA authorization only grants access to information. A medical POA is for incapacity; a HIPAA authorization is for ongoing communication, even when you are competent.

Another difference is activation. A medical POA typically springs into effect only when you are incapacitated. A HIPAA authorization is active immediately upon signing, unless you specify a future date or condition.

The legal requirements also differ. A medical POA generally needs to be witnessed and notarized to be valid. A HIPAA authorization does not require notarization, but must include specific elements like a description of the information to be disclosed and an expiration date.

• Medical POA: decision-making; HIPAA: information access
• Medical POA: activates on incapacity; HIPAA: active immediately
• Medical POA: requires witnesses/notary; HIPAA: no notary needed
• Medical POA: names an agent; HIPAA: names a recipient of records

Why You Need Both Documents

Many people assume a medical POA automatically gives your agent access to your medical records. It does not. Even if your agent has legal authority to make decisions, doctors may still refuse to share records without a HIPAA authorization. This can delay care and create frustration during a crisis.

Conversely, a HIPAA authorization alone does not let anyone make decisions. Your family might know your health status but have no legal standing to act on your behalf. To ensure both access and authority, you need both documents.

Consider this scenario: you are in a car accident and unconscious. Your spouse has a medical POA and can legally consent to surgery, but without a HIPAA authorization, the hospital may not release your MRI results to your spouse. With both, your spouse can get information and make informed decisions quickly.

How to Create Both Documents

Creating these documents is straightforward, but you must follow your state's rules. For a medical POA, you can use a state-specific form, an online template, or an attorney. The form must be signed in the presence of witnesses or a notary public, depending on your state.

For a HIPAA authorization, you can write your own or use a template. It should identify you, the person authorized to receive information, the type of information allowed, the purpose, and an expiration date. Some states have a combined form that includes both a medical POA and a HIPAA authorization, which can simplify the process.

After signing, give copies to your healthcare agent, your primary care doctor, and family members. Keep the originals in a safe but accessible place. Review them every few years or after major life changes like marriage, divorce, or a new diagnosis.

• Use state-specific forms or templates for validity
• Sign in front of witnesses or notary as required
• Consider a combined form if your state offers one
• Distribute copies to relevant parties
• Update after major life changes

Common Mistakes to Avoid

One common mistake is choosing a healthcare agent who lives far away or is not assertive enough to advocate for you in a hospital. Your agent should be someone who can handle stress and will follow your wishes even if they disagree.

Another mistake is forgetting to update your documents after a divorce. In many states, a former spouse is automatically disqualified from serving as your agent unless you specifically name them. Similarly, if you change your mind, you must revoke the old POA in writing.

Finally, do not leave your HIPAA authorization open-ended. An expiration date is required, but you can choose 'end of my lifetime' if you prefer. Setting a specific date or event (like 'upon discharge from this hospital') can help you remember to review it.