Who “Stands in the Shoes” of the Patient with Info Blocking?

State law often determines who has that authority. Review the relevant law, appointment documents, and any court order to establish what the person can do and when that authority takes effect. A health care power of attorney, for example, may apply only after incapacity or may limit the decisions the agent can make.

HHS explains that the representative’s HIPAA authority follows the scope of the underlying authority. Someone empowered to decide one treatment issue does not automatically control every use of the patient’s information. Within the proper scope, however, the representative can exercise the patient’s access rights. That right covers the patient’s designated record set, subject to HIPAA’s limited exclusions and grounds for denial. See § 164.524.

Different rules apply to parents of minors and representatives of deceased patients. Parents generally represent unemancipated children, but HIPAA has exceptions, including when a minor gives legally sufficient consent for particular care or a parent agrees to confidential care. State rules governing parental access must then be examined separately. After death, authority generally turns on the right to act for the decedent or estate. A former health care agent is not automatically the estate representative. See § 164.502(g)(3)–(4).

HIPAA also allows a covered entity to decline recognition in specified abuse, neglect, or endangerment situations when it has the required reasonable belief and determines, using professional judgment, that recognition is not in the patient’s best interest. § 164.502(g)(5).

State law can also impose additional confidentiality requirements or provide greater access rights. HIPAA’s preemption rules determine which law controls when HIPAA and state law conflict. They allow certain state protections to remain in effect, including stronger privacy protections and greater patient rights to access records. The review should identify which state rules apply to the particular records and request.

Who Can Receive Information?

HIPAA separately permits certain disclosures to family, friends, and others involved in care or payment for care under § 164.510(b). Where the patient is available and capable, agreement, no objection after an opportunity to object, or a reasonable professional inference of no objection can support disclosure. When the patient is unavailable or incapacitated, professional judgment about the patient’s best interests may support sharing.

The information disclosed under this provision must be directly relevant to the person’s involvement. A daughter helping manage medications may receive instructions needed for that role, even if she is not her mother’s personal representative. That involvement does not, by itself, give her a right to download her mother’s entire chart.

A patient can use a HIPAA authorization to permit disclosure of specified information to a lawyer, relative, or other recipient. The authorization does not, by itself, appoint that recipient to make health care decisions or exercise every HIPAA right. Under HIPAA alone, it generally permits the authorized disclosure; it is not automatically a right-of-access request.

A patient can also direct a covered entity to send records to someone else. Following Ciox Health v. Azar, the mandatory third-party transmission right under the HIPAA and HITECH framework is limited to an electronic copy of information in an electronic health record. The direction must be written, signed, and identify the recipient and destination. HHS’s notice explains the court-imposed limits. Other disclosures may still be permitted, or required by another law.

When reviewing these requests, determine whether the person is exercising the patient’s access rights or seeking information under a separate permission to disclose. That distinction affects the obligations that follow.

What Information Blocking Adds

Information blocking reaches beyond HIPAA’s individual access right. For an entity that qualifies as an actor, refusing otherwise lawful access, exchange, or use of electronic health information can raise a separate compliance issue even when HIPAA itself does not require that particular disclosure. ONC explained this interaction in the 2020 final rule, 85 Fed. Reg. 25,845–46.

Whether a refusal amounts to information blocking depends on the elements in § 171.103, including interference and an actor-specific knowledge standard. Practices required by law or covered by an information blocking exception are excluded. Being subject to HIPAA does not, by itself, make an organization an “actor” under the information blocking rules. The information at issue must also qualify as electronic health information (EHI) under § 171.102, a separate determination because EHI and HIPAA’s protected health information (PHI) overlap but are not identical.

Some information blocking exceptions use broader language for representatives than HIPAA. The Preventing Harm Exception refers to legal representatives, including but not limited to HIPAA personal representatives. The Privacy Exception defines “individual” for that exception to include HIPAA personal representatives, other legal representatives who can make health care decisions, and qualifying estate representatives. These provisions do not make everyone involved in care a legal representative.

ONC discussed these distinctions in the final-rule preamble. 85 Fed. Reg. 25,847. A requester does not have to qualify as a HIPAA personal representative for interference with a lawful request to raise an information blocking issue. The request still needs a valid legal basis.

A patient-directed request should not be denied solely because the recipient is not the patient’s personal representative. First, confirm whether the patient has validly authorized or directed the disclosure and whether applicable law permits it. The Privacy Exception’s precondition provision can protect a refusal when legally required conditions remain unmet, provided the exception’s requirements are satisfied. In specified circumstances, those requirements include reasonable assistance when a consent or authorization is defective. Organizations should identify what is missing and provide any assistance required by the exception.

Fees depend on the type of request. A personal representative properly exercising the patient’s access right generally receives the protections associated with that right. HHS’s Ciox notice says HIPAA’s patient-access fee limit does not apply to a patient’s request to transmit records to a third party. Information blocking rules may separately limit those fees.

The Fees Exception, § 171.302(b)(2), excludes fees based on defined electronic access by the patient, personal representative, or another person or entity designated by the patient. “Electronic access” here means an internet-based method that supplies EHI when requested without manual effort. That definition does not cover every electronic copy. ONC also confirms that paper, CD, and USB requests can implicate information blocking.

A fee outside the Fees Exception is not automatically unlawful. The analysis must consider the other elements of information blocking and any applicable exception, including the Manner Exception. An exception does not override an otherwise applicable HIPAA or state-law fee restriction.

Getting Access Right When No One Is Reviewing the Request

Reviewing intake forms and release procedures is still important, but this is no longer just about someone in HIM deciding whether to release a chart. Increasingly, access happens through patient portals, apps, and FHIR-based connections, without a person reviewing each request. ONC’s information blocking policies and OCR’s access guidance support patients obtaining their information electronically, including through apps they choose. ONC has also identified unnecessary delays in patient-authorized API access as practices that may implicate information blocking. That does not mean every request requires immediate, unrestricted access. It does mean the legal analysis needs to inform how the technology works, not just what the release policy says.

Organizations should bring privacy, legal, HIM, IT, and security teams together to address these questions:

• Identify whose access the system is enabling. Is this the patient, a personal representative, a patient-designated app or recipient, or someone involved in care? The workflow should distinguish these roles and capture the authority or permission supporting access.
• Verify identity and authority appropriately. A successful login establishes that credentials were accepted; it does not necessarily establish who is using them or the scope of that person’s authority. Use verification appropriate to the request, without creating unnecessary barriers. HHS guidance expressly addresses verifying representatives before granting electronic access.
• Make permissions match the legal basis. A care-related update, a limited authorization, and a personal representative’s access request should not automatically produce identical portal or API permissions. Account for the scope of authority, applicable state law, and federal protections.
• Review automated restrictions as carefully as manual denials. A default setting, release delay, or app restriction can affect access just as much as a staff decision. Assess HIPAA and information blocking separately where applicable, including fees, and document the basis for restrictions and any exception relied upon.
• Test what actually happens. Confirm what records users and connected apps can retrieve, whether the system records who accessed them, and how access changes when authority or permission expires, is revoked, or otherwise changes. Ending future access generally does not retrieve information already downloaded.

And soon, organizations may be dealing with AI agents logging into patient portals or retrieving records through APIs at a patient’s direction. Calling the software an “agent” does not, by itself, make it a HIPAA personal representative. The analysis will depend on what the patient instructed it to do, who operates it, and who receives or retains the information. When an AI agent arrives using the patient’s credentials, is that the patient exercising an access right through a tool, a disclosure to a third party, or both, and can the system tell the difference before the records leave?