HIPAA Authorization for a Disabled Adult Child in Oregon

What Changes at 18

When your child turns 18 in Oregon, they become an independent adult for medical-consent and privacy purposes. Without an authorization or other legal authority, pediatricians, specialists, therapists, and hospitals generally cannot share medical information with you or accept your signature for treatment — even if your child has a significant cognitive disability and you've managed their care for their entire life.

This catches Oregon families off guard more than almost any other turning-18 transition. The school sends the transfer-of-rights notice, SSA schedules the age-18 redetermination, but nobody from the medical system warns you that your access evaporates overnight. Many parents discover the problem at the next doctor's visit when the front desk refuses to check them in.

HIPAA Release of Information vs Oregon Advance Directive

Two different documents solve two different problems, and most families need both.

A HIPAA authorization (Release of Information) lets you access medical records and communicate with providers. Your adult child signs a form — each provider typically has their own version — authorizing specific people to receive protected health information. This does not give you decision-making authority. You can see the records and talk to the doctor, but the doctor still takes instructions only from your child.

An Oregon Advance Directive under ORS 127.505–127.660 goes further. It appoints a healthcare representative who can make medical decisions when the young adult is temporarily or permanently unable to make or communicate healthcare decisions. The representative can consent to procedures, refuse treatment, and direct care during periods of documented incapacity.

The advance directive must be signed by the young adult and either witnessed by two qualified, disinterested adults or notarized. The named healthcare representative must also sign Part E of the form to formally accept the appointment. For the two-witness route, witnesses cannot be the appointed Health Care Representative or alternate, or the principal's attending physician or attending health care provider. If the principal is a patient in a long-term care facility when signed, one witness must be designated by the facility and meet applicable qualifications.

When Your Child Cannot Sign

A HIPAA authorization normally requires the patient's authorization, while an Oregon advance directive requires the principal's signature. If your child lacks the cognitive capacity to understand what they're signing, the advance directive will not work; a HIPAA authorization may need to be handled by a legally authorized personal representative. Do not forge or pressure a signature — those documents can be challenged and may create more problems than they solve.

In that situation, Oregon law provides two paths:

Limited guardianship over medical decisions. Under ORS Chapter 125, you petition the circuit court for authority specifically over healthcare decisions. The court can grant medical decision-making power while leaving other rights (voting, residency choice, financial management) intact. Filing fee is $124 statewide, plus county-specific court visitor fees (Lane County $300, Coos County $300–$350, Columbia County $400).

Educational surrogate for school-based health decisions. If the medical decisions are connected to the IEP — behavioral health services, therapy authorizations, medication administration at school — the school district can appoint you as an educational surrogate under OAR 581-015-2320 without court involvement. This doesn't cover outside medical care, but it handles the school health piece.

Getting the HIPAA Forms in Place

Start 2–3 months before the 18th birthday. Contact each provider your child sees — primary care, specialists, behavioral health, pharmacy — and request their HIPAA authorization form. Most Oregon health systems (OHSU, Providence, Kaiser Permanente, PeaceHealth) have their own versions.

Each form typically asks for:

• The patient's name and date of birth
• The names and relationships of authorized individuals
• What information can be shared (all records, specific categories, or specific dates)
• An expiration date or "until revoked" designation
• The patient's signature

Have your child sign all forms before or on their 18th birthday if they have the capacity to do so. File copies with each provider and keep originals at home.

For the Oregon Advance Directive, download the current form from the Oregon Health Authority. Complete it the same week you do the HIPAA authorizations — one signing session covers both, and you'll have the witnesses or notary already arranged.

How This Fits the Bigger Picture

HIPAA authorization is one piece of the turning-18 legal transition. Oregon families also face the SSI age-18 redetermination, the IEP transfer of rights, ODDS service enrollment, and the question of whether any form of guardianship is necessary. The Oregon Adult Guardianship & Alternatives Guide integrates all of these into a single timeline so nothing falls through the gap between your child's 17th and 18th birthdays.

See more Oregon guides →