HIPAA Authorizations vs. Advance Health Care Directives in California: Why You Usually Need Both

Short Answer

A HIPAA Authorization lets named people receive your protected health information, including medical records and updates from doctors. A California Advance Health Care Directive (AHCD) appoints a Health Care Agent to make medical decisions if you cannot make them yourself. Because access to medical information is different from the authority to make health care decisions, California adults usually need both.

Introduction: Information and Authority Are Different

During a medical emergency, families often assume one form gives them every necessary right. It usually does not. A HIPAA Authorization focuses on access to information. An Advance Health Care Directive focuses on decision-making authority. Therefore, these documents address two distinct legal and practical needs: who may talk with health care providers, and who may direct medical treatment when a patient lacks capacity.

For this reason, a complete California Estate Plan commonly includes both documents.

1. What a HIPAA Authorization Does

HIPAA protects Protected Health Information (PHI), such as medical records, diagnoses, treatment history, prescriptions, test results, and communications with a physician or hospital. Under 45 CFR 164.502, health care providers must generally protect that information from unauthorized disclosure.

A HIPAA Authorization, sometimes called a HIPAA Release or Authorization of Release, allows a patient to name individuals who may receive Medical Information. Those individuals may include a spouse, adult children, siblings, caregivers, a trusted friend, or a future Health Care Agent.

A HIPAA Authorization may allow the named person to:

• Speak with doctors, hospitals, and other health care providers

• Receive medical records, electronic records, and digital copies

• Obtain information through a patient portal, where permitted

• Learn about a medical diagnosis, injury, treatment plan, or medication

• Discuss medical evaluations, psychological evaluations, and health status

• Access information during an emergency, serious illness, or hospitalization

However, a HIPAA Authorization does not automatically authorize the person to consent to Medical Procedures, refuse treatment, approve Life-Sustaining Treatment, or make other Medical Decisions.

2. What an Advance Health Care Directive Does

A California Advance Health Care Directive, or AHCD, is an Advance Directive created under California Probate Code Sections 4600–4806. It allows a principal to appoint a Health Care Agent, Medical Agent, Health Care Proxy, or Proxy.

The appointed agent has Decision-Making Authority when the principal lacks Mental Capacity or Legal Capacity to make health care decisions. The agent may make choices about Medical Treatment, doctors, hospitals, medications, routine procedures, surgery, life support, pain relief, and End-of-Life Care.

An AHCD also allows the principal to state Health Care Instructions and Medical Wishes, including:

• Treatment Preferences for serious illness or injury

• Whether to use or withhold Life-Sustaining Treatment

• Decisions involving a ventilator, feeding tube, or other life support

• Pain relief and comfort care preferences

• Organ Donation and Tissue Donation

• Mental Health Preferences and Psychiatric Care

• Personal Values, cultural beliefs, and spiritual beliefs

• Funeral Wishes and cremation wishes

Unlike a HIPAA Release, an AHCD concerns medical authority. It does not merely allow someone to receive information.

3. The Key Difference at a Glance

Legal Question	HIPAA Authorization	Advance Health Care Directive
Main purpose	Allows Health Information Access	Gives authority for Health Care Decisions
What it covers	PHI, Medical Records, hospital updates, and provider communications	Medical Treatment, Medical Procedures, and Treatment Preferences
Who benefits	Anyone you specifically authorize	You're named Health Care Agent and Alternate Agent
When it helps	Often immediately, including while you still have capacity	Usually, when you cannot make or communicate your own decisions
Can it authorize treatment?	No	Yes, when the agent’s authority becomes effective
Can it provide record access?	Yes	It may, but a separate HIPAA Authorization adds clarity
Replaces the other document?	No	No

4. Why California Adults Usually Need Both

A Health Care Directive and HIPAA Authorization overlap in practice, but neither document fully replaces the other.

For example, imagine that a person is hospitalized after an accident but remains able to make Medical Decisions. Their Health Care Agent may not yet have authority to act. However, a HIPAA Authorization may allow the named spouse, children, or trusted person to speak with the hospital and obtain necessary Medical Information.

Later, if the patient loses capacity because of incapacitation, cognitive decline, serious illness, or injury, the AHCD allows the designated Health Care Agent to make informed decisions. The agent can then use the patient’s medical information and stated wishes to communicate with physicians and direct care.

Without both documents, family members may face a preventable gap:

• A HIPAA Release without an AHCD may allow information access but not treatment authority

• An AHCD without a clear HIPAA Release may lead to provider questions or delays about information disclosure

• Neither document may force agreement among Family Members, which makes clear Family Guidance and Family Communication especially valuable

5. HIPAA Authorization vs. Health Care Agent Authority

A HIPAA Authorization can name multiple people. For instance, a principal might authorize a spouse, two adult children, and a trusted friend to receive updates and copies of medical records.

By contrast, an AHCD should generally name one primary Health Care Agent and at least one Alternate Agent, Successor Agent, or Backup Agent. Naming Joint Agents can create delays if they disagree during a Medical Crisis.

A person named on a HIPAA Release is not automatically a Health Care Agent. Similarly, a person named as a Health Care Agent may need a HIPAA Authorization to avoid uncertainty about access to PHI, particularly before incapacity or when information must be shared with other family members.

6. How POLST and DNR Fit In

A Health Care Directive is also different from a POLST or DNR.

A POLST, meaning Physician Orders for Life-Sustaining Treatment, is a medical order for patients facing serious illness or significant frailty. A physician or qualified clinician completes it with the patient or authorized decision-maker. It provides immediate instructions about CPR, hospitalization, artificial nutrition, and other life-sustaining interventions.

A DNR, or Do Not Resuscitate order, is narrower. It instructs medical professionals not to attempt CPR under specified circumstances.

Neither a POLST nor a DNR replaces a HIPAA Authorization or an Advance Health Care Directive. Instead, these documents can work together as part of Medical Planning and Incapacity Planning.

7. Keep Documents Current and Accessible

Review your HIPAA Authorization and AHCD after major Life Changes, including marriage, divorce, a new medical diagnosis, changes in family relationships, or a change in your preferred Health Care Agent.

Complete the documents with the required Signing, witnesses, or Notarization procedures. Under California Probate Code Section 4673, an AHCD generally requires a signature and either qualified Adult Witnesses or a Notary.

Store accessible documents with your Estate Plan and provide copies to your Health Care Agent, Alternate Agent, primary doctor, and appropriate loved ones. Digital copies, scanned documents, and electronic records can be useful, but families should confirm that documents remain complete, legible, and legally recognized.

FAQ’s

Can my spouse make medical decisions without an AHCD?

A spouse may be consulted, but marriage alone does not provide the same clear, legally documented authority as an Advance Health Care Directive. If disputes arise, Conservatorship proceedings may become necessary.

Is a HIPAA Authorization enough for my adult child?

No. A HIPAA Release may allow your adult child to receive Medical Information, but it does not give authority to approve or decline Medical Treatment if you lack capacity.

Does my Health Care Agent automatically get all of my medical records?

A Health Care Agent can generally access information necessary to make health care decisions. Still, a separate HIPAA Authorization improves privacy compliance and allows you to designate additional people for communication.

Do young adults need both documents?

Yes. When children turn 18, parents no longer automatically control Health Care Decisions or receive Medical Records. College students and young adults should consider both documents as part of Emergency Planning.

Speak With a California Estate Planning Attorney

A HIPAA Authorization protects access to Medical Information. An Advance Health Care Directive protects your right to choose who makes Health Care Decisions. Together, they can reduce confusion, support Medical Autonomy, and give loved ones clearer direction during an emergency.

For assistance with California Estate Planning, Probate, Trusts & Wills, Trust Administration, Medi-Cal Planning, Pre and Post Nuptial Agreements, or Estate Tax matters, contact Moravec Varga & Mooney for a telephonic consultation. Call (626) 793-3210 or email LV@MoravecsLaw.com.

Moravec Varga & Mooney serves clients throughout California, including Los Angeles, Riverside, San Bernardino, Sacramento, Santa Cruz, and beyond.