North Carolina Estate Planning: HIPAA Releases That Protect

What is a HIPAA Release?

A HIPAA release (also called a HIPAA authorization) is written permission for health care providers and health plans to disclose your protected health information (PHI) to specific people you name. It is governed by the HIPAA Privacy Rule’s authorization requirements at 45 C.F.R. § 164.508. Without a written authorization, even a spouse or close family member may encounter limits obtaining records or detailed updates. HIPAA does allow providers, in their professional judgment, to share limited information with family or friends involved in your care or payment for care, but this is discretionary and may not provide ongoing access to records. See 45 C.F.R. § 164.510(b).

Why It Matters in North Carolina Estate Plans

North Carolina estate plans often include a Health Care Power of Attorney (HCPOA) and an Advance Directive (living will) under N.C. Gen. Stat. ch. 90, art. 23. A HIPAA authorization complements these by ensuring your chosen health care agent, alternates, and any other trusted persons can actually receive information needed to carry out your wishes. While no North Carolina statute requires pairing a HIPAA authorization with your HCPOA or living will, doing so is a common and practical approach. Your financial power of attorney, governed by N.C. Gen. Stat. ch. 32C, is separate but can be coordinated with your health care documents.

Who Should You Authorize?

• Your named health care agent and any alternates.
• One or two close family members or caregivers who may assist or need updates.
• Professionals who help coordinate care (for example, your primary care physician, care manager, or attorney) for limited purposes.

Grant access only to those who genuinely need it. You can specify whether each authorized person may receive all medical information or only certain categories.

What Information Can Be Shared

Your authorization can be broad or narrow. You may allow disclosure of general medical and billing records, care coordination notes, and portal communications. For certain sensitive categories, you typically must state your intent expressly and be aware of additional protections:

• Substance use disorder treatment records from federally assisted programs are subject to 42 C.F.R. part 2, which has stricter consent and redisclosure limits.
• Mental health records have additional protections under N.C. Gen. Stat. § 122C-52 et seq.
• Communicable disease/HIV information is protected by N.C. Gen. Stat. § 130A-143.

Consider whether you want authorized recipients to receive copies of records, speak with providers, and access patient portals.

Timing and Duration

You can make your HIPAA authorization effective immediately or only upon your incapacity. It may last until revoked or expire on a certain date or event (for example, the end of a hospitalization). When you update directives, revisit your HIPAA authorization to keep it consistent.

Form and Execution in North Carolina

North Carolina accepts HIPAA-compliant authorizations that meet federal content requirements. Under 45 C.F.R. § 164.508(c), an authorization generally must include: a description of the information to be disclosed; who may disclose it; who may receive it; the purpose; an expiration date or event; your signature and date; and required statements about your right to revoke, the potential for redisclosure by recipients (where HIPAA may no longer apply), and whether signing is a condition of treatment, payment, enrollment, or eligibility (as applicable). Providers may have their own forms, but a clear, compliant written authorization helps ensure timely release of information.

How It Works with a Health Care Power of Attorney

Your HCPOA names an agent to make medical decisions if you cannot. A companion HIPAA authorization lets providers share your PHI with that agent and with any alternates or family members you designate. Some HCPOA forms include HIPAA language; others limit disclosures to the agent only. A separate authorization can extend access appropriately. See N.C. Gen. Stat. ch. 90, art. 23.

Privacy and Security Considerations

• List only people you trust, and tailor what each person may receive.
• Indicate whether recipients may redisclose information. Note that certain laws (for example, 42 C.F.R. part 2) restrict redisclosure regardless of your form language.
• Keep copies with your HCPOA and give copies to your agent and primary providers so they are available in an emergency.

Common Mistakes to Avoid

• Naming an agent but forgetting to authorize disclosure to alternates and key family members.
• Omitting sensitive-category disclosures you want shared, causing delays.
• Limiting the release to one facility or provider when you receive care across systems.
• Failing to update after changes in relationships, providers, or contact information.
• Storing the document where agents cannot access it quickly.

Updating and Revoking

You may revoke a HIPAA authorization in writing at any time, except to the extent a covered entity has already taken action in reliance on it. See 45 C.F.R. § 164.508(b)(5). Provide written notice of revocation to your providers and to anyone holding a copy.

FAQ

Is a HIPAA release required if I have a North Carolina Health Care Power of Attorney?

No. It is not required by statute, but it is common to include a HIPAA authorization so agents and designated persons can receive the information needed to act.

Can I limit what each authorized person can see?

Yes. You can restrict categories, time frames, or specific providers and allow broader access for your agent.

Does my HIPAA authorization work across different hospital systems?

Yes, if it meets HIPAA content requirements. Some systems prefer their own forms, so provide copies and upload to each portal.

Will sensitive mental health or substance use records be shared automatically?

No. Additional federal and state protections may apply. State clearly if you want these disclosed and follow any required language.

How often should I update my HIPAA authorization?

Review after major life changes and at least every 1–2 years to keep contacts and scope current.

Getting Started

Work with an attorney to align your HIPAA authorization with your HCPOA and living will, tailor sensitive-category disclosures, and coordinate how your providers will store and recognize the document.

Ready to protect your plan? Contact us to request a consultation.

North Carolina-specific notice: This post summarizes federal HIPAA rules and North Carolina law as of the date of publication. It is general information, not legal advice. Consult a licensed North Carolina attorney about your situation.