Key points
- In a 2024 survey of 7,278 US adults, 51% of those caring for someone had accessed that person's online record, up from 24% in 2020.1
- The patient's own consent is the first and simplest route, set up while they can give it.
- Under HIPAA, a person with legal authority to make health decisions for an adult must be treated as that adult for the relevant records.2
- In England and Wales, a health and welfare lasting power of attorney covers decisions about medical care, and it takes 8 to 10 weeks to register.45
- A wai Profile stays the patient's own record, with every permission explicit and revocable by the patient.7
Summary
A caregiver gets lawful access to a relative's health records in one of three ways. The patient consents and names them, the caregiver holds legal authority to make health decisions for the patient (such as a HIPAA personal representative or a health and welfare lasting power of attorney), or a clinician shares what is directly relevant to the care they give. Set it up early, while the patient can still decide.
Your relative chooses who helps, the clinic already knows your name when you call, and your time goes on their care. Consent and paperwork arranged before a hospital admission or a new diagnosis make that possible.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee how a wai Profile keeps a relative's results and letters on one timeline, with the patient deciding who can see them.
| Situation | Route | What to bring |
|---|---|---|
| Relative can decide and wants help | Patient's own consent | A written authority signed by the patient, naming you and what you may see |
| You are involved in day-to-day care | Clinician shares what is relevant to that care | Confirmation from the patient that you are involved |
| US, relative cannot make decisions | Personal representative under HIPAA | Health care power of attorney or guardianship order under state law |
| England or Wales, relative cannot make decisions | Health and welfare lasting power of attorney | The registered LPA from the Office of the Public Guardian |
| Relative has died | Executor or administrator of the estate | Proof of appointment, and the clinic's own process for deceased records |
| Child under 18 | Parent or guardian, with exceptions | Proof of parental responsibility, and the child's views where they are old enough |
Start with the patient's consent
In the UK, ICO guidance says a relative or friend can make a request for someone's information on their behalf, and should provide evidence of authority, such as a written authority signed by the person.6 Ask the clinic to note who the patient is happy for them to speak to.
In the US, a provider may share information directly relevant to a family member's or friend's involvement in the patient's care, where the patient has had the chance to agree or object.3 If the patient is incapacitated or in an emergency, the clinician may use professional judgement about what is in the patient's best interest.3
Consent can be narrow and can change. A parent may want a daughter to handle appointments and results and keep part of their history private, and can withdraw consent later, as covered in sharing a record with a care team.
Personal representatives under HIPAA
HIPAA's rule on personal representatives, 45 CFR 164.502(g), says a provider must treat a person who has legal authority to make health care decisions for an adult as that adult, for the information relevant to that authority.2 In practice that is a health care agent under a power of attorney for health care, or a court-appointed guardian, depending on state law.
Parents and guardians are generally the personal representatives of minors, with exceptions, for example where the minor lawfully consents to a service alone.2 After death, an executor or administrator with authority over the estate is treated as the personal representative.2
A provider may decline to treat someone as a personal representative where it reasonably believes the patient has been or may be subjected to abuse or neglect by that person, or that doing so could endanger the patient.2
Lasting power of attorney in England and Wales
A lasting power of attorney lets a person appoint one or more attorneys to make decisions for them. There are two types, health and welfare, and property and financial affairs, and a person can make either or both.4 An LPA is legally binding only in England and Wales, and Scotland and Northern Ireland have their own arrangements.4
The health and welfare LPA covers decisions about daily routine, medical care, moving into a care home and life-sustaining treatment, and it can only be used when the person cannot make their own decisions.4 The person must be 18 or over and have mental capacity when they make it.4 It must be registered with the Office of the Public Guardian, which takes 8 to 10 weeks if there are no mistakes.5
For copies of records, the ICO says an organisation should check the type and circumstances of the power of attorney, and that it is reasonable to assume an attorney managing someone's property and affairs can make a subject access request for them.6 Bring the registered LPA, and expect the clinic to check it.
What a caregiver sees
Access follows the authority. A family member involved in care sees what is relevant to that involvement, and a personal representative sees what is relevant to the decisions they are entitled to make.23 A capable adult who has named a helper for appointments keeps the rest of their record to themselves.
Write down which family members may know what, and the clinic can follow it exactly.
Caregiving with a wai Profile
Your relative's wai Profile holds their results, letters, prescriptions and wearable readings on one timeline, and it stays theirs.7 Every sharing permission is explicit and revocable, so the patient decides who helps and can change that at any time.7
Answers about results come with citations and a clear line to see a clinician, who stays the person to ask about any diagnosis or treatment.7 Anything urgent goes straight to your local emergency number. Patients set up a Profile on the profile set-up page, open to everyone today.
Where to start
Have the conversation while your relative can decide. Ask who they want involved and what they want kept private, and write it down with their signature.
Give each clinic that written authority and ask it to note who it may speak to. In England and Wales, consider a health and welfare LPA and register it early, given the 8 to 10 weeks it takes.5 In the US, ask about a health care power of attorney under your state's law. Review the arrangement each year, and see privacy and permissions for the rights that apply to the record itself.
Keep a relative's record together and in their own hands, with access they grant and can take back.
Frequently asked questions
Can I see my elderly parent's medical records?
Does a health and welfare LPA let me see medical records?
How long does it take to set up a lasting power of attorney?
Registration with the Office of the Public Guardian takes 8 to 10 weeks if the forms have no mistakes, so do it well before it is needed.5
Can a clinic refuse to deal with me even if I have authority?
In the US, a provider may decline to treat someone as a personal representative if it reasonably believes the patient is at risk of abuse or neglect by that person.2 The safeguard protects patients.
Can my parent keep some things private from me?
Yes. A capable adult decides what each helper can see and can change it at any time. Written wishes let the clinic follow them.
Who controls access to a relative's wai Profile?
The patient. Every permission is explicit and revocable, and the patient can export or remove the record at any time.7
Sources
- 1Office of the Assistant Secretary for Technology Policy, US Department of Health and Human Services, 2025Individuals' Access and Use of Patient Portals and Smartphone Health Apps, 2024 (ASTP Data Brief No. 77)Read 14 October 2026Read source
- 2Electronic Code of Federal Regulations, 202645 CFR 164.502, Uses and disclosures of protected health information, general rules (paragraph g, personal representatives)Read 14 October 2026Read source
- 3Electronic Code of Federal Regulations, 202645 CFR 164.510, Uses and disclosures requiring an opportunity for the individual to agree or to objectRead 14 October 2026Read source
- 4GOV.UKMake, register or end a lasting power of attorneyRead 14 October 2026Read source
- 5GOV.UKRegister a lasting power of attorneyRead 14 October 2026Read source
- 6Information Commissioner's OfficeHow do we recognise a subject access request (SAR)Read 14 October 2026Read source
- 7wai, 2026wai Profiles, a personal health record for every patientRead 14 October 2026Read source
Help with a relative's care, with their record in their own hands.
A wai Profile keeps results and letters together, and the patient decides who helps.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
Read how family and carer access works in a clinic