HIPAA Authorization: Definition and How It Works in California

By Eric Ridley, attorney, Ridley Law. Updated September 2026.

A HIPAA authorization is a signed release that lets doctors and hospitals share a person’s medical information with the people it names, such as a healthcare agent or a successor trustee who needs proof of incapacity.

How it works in California

HIPAA is federal law. Under 45 C.F.R. § 164.508, a covered entity, meaning a doctor, hospital, or health plan, can’t use or disclose protected health information without a valid authorization. Without one on file, a doctor can legally refuse to discuss a person’s condition with anyone the person hasn’t named, even a spouse or adult child. For the different documents estate planning uses to cover this, see the HIPAA estate planning guide.

California also has its own medical information release under Civ. Code, § 56.11, which is a separate document from a HIPAA authorization and covers state-law confidentiality rules rather than the federal HIPAA scheme. Many estate plans include both so a request for records isn’t rejected on a technicality about which law it was made under.

A HIPAA authorization is also how a successor trustee often gets access to the information needed to confirm a settlor has become incapacitated, since many trusts condition a trustee’s takeover on a doctor’s written opinion.

Why it matters

For example, a successor trustee tries to confirm the settlor can no longer manage the trust and asks the settlor’s doctor for records. Without a signed HIPAA authorization naming the trustee, the doctor’s office has to say no, even though the trustee has every legal right to the underlying decision once incapacity is shown. The authorization is what lets the doctor actually talk to them.

Common mistakes

Signing an advance healthcare directive and assuming it also covers HIPAA access, when the directive and the authorization serve different purposes. Naming only a spouse on the authorization and leaving out the successor trustee or backup agent who may need the same access later. Treating California’s Civ. Code, § 56.11 release as interchangeable with a HIPAA authorization instead of keeping both.

Related terms

• Advance healthcare directive: names a healthcare agent and states treatment wishes; a HIPAA authorization is what lets that agent actually see the records.
• Durable power of attorney: often paired with a HIPAA authorization so the named agent can request medical information tied to a claim of incapacity.
• Living Will: a written statement of the medical treatment a person wants, usually part of an advance health care directive.

Part of the California estate planning glossary. For the full treatment, see HIPAA Estate Planning Guide 2026.