Tennessee HIPAA Release for a Disabled Adult Turning 18

The Day You Lose Access to Your Child's Medical Records

On your child's 18th birthday, every doctor, hospital, therapist, and pharmacy in Tennessee is legally required to stop sharing medical information with you. It doesn't matter that you've managed their care for 18 years. It doesn't matter that you drive them to every appointment. Under federal HIPAA rules, your adult child's protected health information is now theirs alone.

This catches families off guard constantly. A parent calls the neurologist for test results and gets told, "We can't discuss that with you." They show up at the ER and the nurse says, "Your child is an adult — we need their consent before we can tell you anything." The panic sets in, and the next call is usually to an attorney asking about guardianship.

But here's what most families don't realize: a simple HIPAA authorization form can solve this problem without going anywhere near a courtroom.

What a HIPAA Release Actually Does

A HIPAA authorization is a written document signed by your adult child that gives specific healthcare providers permission to share protected health information with designated people — typically parents or other family caregivers. It's a targeted tool: it removes the confidentiality barrier so you can receive medical records, billing information, lab results, and treatment updates.

What it does not do: grant you authority to make medical decisions. A HIPAA release lets you receive information. A durable power of attorney for healthcare lets you make decisions. These are different documents serving different functions, and many families need both.

Requirements for a Valid HIPAA Authorization in Tennessee

Federal HIPAA regulations (45 C.F.R. § 164.508) set the baseline requirements. A valid authorization must include:

• A specific description of the information to be disclosed, such as defined categories of records or records from specified providers
• The name of the person or entity authorized to receive the information
• The purpose of the disclosure (which can be stated as "at the request of the individual")
• An expiration date or event (the authorization can be set to expire after a fixed period or to remain valid until revoked)
• The individual's signature and date
• A statement that the individual can revoke the authorization in writing at any time

Tennessee does not impose additional state-level execution requirements beyond the federal HIPAA standard — no notarization or witness signatures are required for a HIPAA authorization. However, some healthcare providers have their own internal forms and may prefer you use theirs. It's worth asking each provider for their preferred form, though a properly drafted standalone authorization that meets the federal requirements is legally valid regardless.

The Capacity Requirement

Your adult child must have the capacity to understand what they're signing. For a HIPAA release, the capacity threshold is relatively low compared to other legal documents — the individual needs to understand that they're giving permission for their medical information to be shared with the people listed on the form, and that they can take back that permission at any time.

Many young adults with intellectual or developmental disabilities can meet this threshold even if they couldn't manage more complex legal instruments. If your child can understand the concept of "I'm saying it's OK for the doctor to talk to my mom about my health," they likely have sufficient capacity to sign a HIPAA authorization.

If your adult child truly cannot understand the concept of authorizing disclosure — even with simplified explanation and communication supports — then a HIPAA release isn't an option, and you'll need to pursue either a healthcare power of attorney (if they have capacity for that more complex instrument) or a limited conservatorship granting access to medical information.

How to Set It Up

Step 1: Get the forms. Download a general HIPAA authorization template or contact your child's primary care provider, specialist offices, and hospital system to request their specific forms. Some Tennessee hospital systems — including Vanderbilt University Medical Center and CHI Memorial — have downloadable authorization forms on their patient portals.

Step 2: Complete one form per provider or use a broad authorization. You can either complete individual authorizations for each provider (which some offices prefer) or execute a single broad authorization that covers all providers. A broad form is more practical for families managing multiple specialists, but individual providers may still ask you to complete their internal form for their records.

Step 3: Have your adult child sign the form. They should sign on or shortly after their 18th birthday. No notarization is required, but having a witness present (even informally) can help if a provider later questions the authorization's validity.

Step 4: Distribute copies. Deliver signed copies to every healthcare provider — primary care, specialists, therapists, pharmacy, hospital, and dental. Keep the original and make additional copies for new providers as they're added.

Step 5: Store the form accessibly. Keep a digital scan on your phone. In an emergency, you may need to produce the authorization immediately when a new ER or hospital refuses to share information.

Combining HIPAA with Other Documents

A complete medical authority package for a disabled adult in Tennessee typically includes three documents:

1. HIPAA authorization — gives you access to information
2. Durable power of attorney for healthcare (governed by T.C.A. Title 34, Chapter 6, Part 2) — gives you authority to make medical decisions if your child cannot
3. Living will/advance directive — documents your child's own treatment preferences

All three require your child's capacity to sign. If your child has sufficient capacity, executing all three at once — ideally with help from an attorney who can confirm the documents meet Tennessee's execution requirements — provides comprehensive medical protection without any court involvement.

When a HIPAA Release Isn't Enough

If your adult child is already in a medical crisis and cannot sign any documents, and no advance directive or healthcare power of attorney exists, Tennessee law provides a fallback. Under the Uniform Health-Care Decisions Act (T.C.A. § 68-11-1801 et seq.), when a patient lacks capacity and has no designated healthcare agent, the treating physician can recognize a surrogate decision-maker from a statutory priority list: spouse first, then adult children, then parents, then siblings.

This surrogate authority is informal and provider-dependent — it works in many situations but can be challenged or refused. It's far less reliable than having a properly executed HIPAA authorization and healthcare POA already on file.

The Tennessee Adult Guardianship & Alternatives Guide includes templates and timelines for executing all of these documents before the 18th birthday, organized into a chronological workflow that ensures nothing is forgotten during the transition.

See more Tennessee guides →