"Reasonably infers from the circumstances, based on the exercise of professional judgment, that the individual does not object to the disclosure." That is the real federal standard, in 45 CFR 164.510(b)(2)(iii), a nurse is supposed to apply before deciding whether to update you on a parent's condition. It is a judgment call a clinician makes in the moment, not a locked door, and it is far more permissive than the four words you are usually handed instead: "I can't tell you that."
This is not legal advice. No two hospitals read that standard the same way, policies vary by facility and by state, and a privacy officer or an elder-law attorney is the right person to sort through a real dispute. What follows is the plain mechanics of the rule, organized by what you have on hand right now.
Start with what's already true at the hospital your parent is in today.
A Signed Authorization Already on File
If you or your parent signed a HIPAA release or authorization at some point, check whether it is on file at the hospital your parent is in right now; a copy sitting at their regular doctor's office does not automatically travel with them. Next Step in Care's own guidance for family caregivers notes that "HIPAA does not require written consent for this purpose, but it may be part of the health care facility's procedures." In plain terms, the paperwork requirement is the hospital's own policy, and every hospital's policy differs.
That distinction matters because a form can exist and still be useless to you. Large hospital systems often route authorization forms to admissions or to the medical records department rather than to the nursing floor caring for your parent, so the bedside nurse may truthfully have never seen it. Ask specifically whether it was logged in the chart itself, rather than only scanned into a billing file somewhere else in the building.
Ask for the charge nurse or the hospital's patient relations office if the first person you reach has not heard of the form. Say this: "I have a HIPAA authorization on file here for [patient name]. Can you confirm it and update me on their condition?"
Naming the document moves the conversation faster than explaining your relationship twice.
Nothing Signed, and Your Parent Can Still Speak for Themselves
When your parent is on the phone or in the room and able to communicate, this is the fastest legitimate path, and it needs no form at all. The same regulation lets a provider ask the patient's permission outright, describe what they intend to share and give the patient a chance to object, or simply infer from the circumstances that the patient does not mind. Put your parent on with the nurse and have them say it directly: "It's fine, you can tell her what's going on." That single sentence, said by your parent to the clinician, satisfies the standard the regulation sets, with no paperwork and no advance notice required.
That's the whole mechanism, in one line from your parent.
Clinicians still default to refusal anyway, often for a reason that has nothing to do with your family. In December 2025 reporting from NHPR, an NPR member station, a HIPAA violation can carry "fines up to $1.5 million a year" alongside criminal exposure, and Jerri Clark of the Treatment Advocacy Center told the outlet there has been "a lot of misinformation about HIPAA and for training around HIPAA" among the staff who enforce it.
Here is a debatable read of that incentive, resting on the fine figure above: a nurse weighing an ambiguous case against a $1.5 million exposure will often pick the safer wrong answer, which is silence, even in a case the regulation would have let her speak on. If a staff member still hesitates after your parent has agreed, ask directly: "Has my parent agreed to you sharing this, or should I have them confirm it again right now?"
When Your Parent Can't Consent
If your parent is sedated, confused, or otherwise unable to say yes or no, the same regulation still has an answer. A provider may share information once they "determine whether the disclosure is in the best interests of the individual and, if so, disclose only the protected health information that is directly relevant," under 45 CFR 164.510(b)(3). That is a judgment the clinician makes without any input from your parent at all. Staff who do not realize this exists sometimes default to the wrong answer anyway: Better Health While Aging notes that some clinicians "will incorrectly claim that it's a HIPAA violation" to share anything, when the rule plainly allows it.
This is also where a durable power of attorney for health care, if one exists, does more work than any HIPAA form. Under HIPAA, a named health care agent is treated as the patient's "personal representative," defined on the same page as "a person authorized, under State or other applicable law, to act on behalf of the individual in making health care related decisions." A personal representative gets the same access the patient would have had, without asking a facility to reach for its own best-interest judgment at all. A signed HIPAA release and a health care proxy are two different documents, and only one keeps working once your parent can't speak.
Being the closest relative in the room is not the same thing as holding that legal role, and hospital staff cannot treat it as equivalent even when they sympathize with you. If no one has been named, a social worker or the hospital's ethics committee sometimes steps in for urgent decisions, but that is a fallback for a gap you would rather not discover for the first time in an ICU hallway.
If you hold the health care agent role, lead with it rather than your relationship: "I'm her health care agent under power of attorney, and I need to see her chart directly."
That line does the work.
Do This Before You Need It
None of this is something a passive monitoring app like CareBridge solves. It is a free Android app that watches for unusual silence on a parent's phone at home, and it has no connection to a hospital's chart or records system. If the immediate problem is getting someone at the hospital to talk to you, the privacy officer above is the right call to make, not a piece of software.
The better time to settle any of this is before a hospital is involved at all. Ask your parent's regular doctor's office for their own HIPAA authorization form, name everyone who might need to call on their parent's behalf, and keep a copy somewhere you can reach at 2 a.m., rather than filed away at their house. If a power of attorney for health care does not exist yet, that is a conversation to have with an elder-law attorney ahead of time, rather than improvising it from a waiting room. Our long-distance caregiving toolkit covers that logistics layer alongside the rest of what a long-distance caregiver needs.
Put a photo of both documents in your phone too, next to whatever else you keep for an emergency. A hospital intake desk will usually accept a clear photo of a signed form faster than a description of where the original is sitting.
A signed form and a short conversation now are worth more than any script above, because they mean the next hospital call starts with an answer instead of an argument.
All third-party product names and trademarks belong to their respective owners. Details verified against official sources on October 2, 2026; check the linked sites for current pricing.
CareBridge is not a medical device and is not a substitute for emergency services. If you believe someone is in immediate danger, call your local emergency number.