Whether a husband can get his wife’s medical records under HIPAA depends on how he’s asking. If she signs a written authorization, the answer is yes. If she has named him as her healthcare agent, the answer is yes for records relevant to that role. If she is incapacitated and state law makes him her decision-maker, the answer is yes. Absent one of those pathways, a provider generally will not hand over her chart just because the two are married.
HIPAA is often described as a wall between spouses. That is not quite right. The Privacy Rule contains several provisions that recognize the role spouses play in each other’s care, from formal personal-representative status to informal conversations during an appointment. What HIPAA does not do is treat marriage, by itself, as a key to the other spouse’s medical history.
Written Authorization From Your Wife
The cleanest way to get access is for your wife to sign a HIPAA authorization directed to her providers. The regulation at 45 CFR 164.508 specifies what the form must contain to be valid:1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
- A specific, meaningful description of the information to be released.
- The name of the provider or entity authorized to disclose it.
- The name of the person who will receive it (the husband).
- The purpose of the disclosure. If your wife initiates the request herself, “at the request of the individual” is sufficient.
- An expiration date or event.
- Her signature and the date.
The form also has to tell her that she can revoke the authorization in writing at any time, that the provider generally cannot condition her treatment on signing it, and that once the information leaves the provider, the recipient may re-disclose it and lose HIPAA protection. Revocation is prospective only. Once she submits a written revocation, future disclosures stop, but anything already released cannot be pulled back.
An authorization can be as broad or narrow as she wants. She can limit it to a specific provider, a specific date range, or a specific condition, or she can grant sweeping access to her full record. The narrower she makes it, the less will come out.
Medical Power of Attorney and Healthcare Proxy
A medical power of attorney (MPOA) or healthcare proxy lets your wife formally name you as her agent for healthcare decisions. Because HIPAA ties personal-representative status to whoever holds decision-making authority under state law, an MPOA effectively gives you the same access rights as the patient herself for records relevant to your role.2eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules You can review the record, obtain copies, and authorize releases to third parties.3Health and Human Services (HHS). HIPAA and Marriage: Understanding Spouse, Family Member, Marriage, and Personal Representatives in the Privacy Rule
These documents come in two forms. A durable power of attorney takes effect the moment it is signed and continues if your wife later loses capacity. A “springing” power of attorney only activates when a specific event happens, usually incapacity certified by one or more physicians. The springing version means you have no authority at all until the trigger is satisfied, which can cause delays when things are moving fast.
State execution requirements vary. Most states require your wife’s signature, one or two witnesses, and sometimes notarization. A document that misses a state formality may be unenforceable at the moment you need it most, so these should be prepared while both spouses are healthy.
Even a valid MPOA has a limit. A provider can refuse access if a licensed healthcare professional decides that giving the personal representative access is reasonably likely to cause substantial harm to the patient or someone else.4eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information This is a narrow safety valve, meant for situations involving abuse or coercion, not a routine denial.
When Your Wife Is Incapacitated
If your wife loses the ability to make her own medical decisions and has no advance directive, state law may put you in the personal-representative role automatically. Roughly 44 states have surrogate consent laws that designate a spouse as the first-priority decision-maker in those circumstances. Where such a law applies, the HHS guidance confirms that a covered entity must recognize a lawful spouse as a personal representative for HIPAA purposes.3Health and Human Services (HHS). HIPAA and Marriage: Understanding Spouse, Family Member, Marriage, and Personal Representatives in the Privacy Rule
You do not need a power of attorney or any special paperwork for this to kick in. But the authority is dormant while your wife has capacity. You cannot walk into her clinic while she is conscious and competent and demand her records under a surrogate consent statute. It applies only during incapacity.
What a Doctor Can Share During an Appointment
Even without any authorization or MPOA, HIPAA gives providers room to share information with a spouse who is involved in the patient’s care or in paying for it. Under 45 CFR 164.510(b), a provider can disclose relevant information to a family member if the patient is present and one of three things is true: she agrees, she is given the chance to object and does not, or the provider reasonably infers from the situation that she does not object.5eCFR. 45 CFR 164.510 – Uses and Disclosures Requiring an Opportunity for the Individual to Agree or to Object
This is why a doctor can discuss test results with your wife’s husband sitting next to her in the exam room. Her presence and silence are treated as non-objection. If she speaks up and says she does not want you to hear, the provider has to stop.
When she is not present, the provider may still share limited information with you, but only if the provider exercises professional judgment that doing so is in her best interest, and only information directly relevant to your involvement in her care.6U.S. Department of Health & Human Services (HHS). If the Patient Is Not Present or Is Incapacitated, May a Health Care Provider Still Share the Patient’s Health Information The provider is never required to share in this situation.
This provision covers conversations and narrow information sharing tied to care. It does not entitle you to copies of her full chart or the ability to browse her records on your own.
Emergencies
When your wife faces a serious and imminent threat to her health or safety, a provider may share protected health information without prior authorization if the provider believes in good faith that the disclosure is necessary to prevent or reduce the threat, and the person receiving it is reasonably able to help.7eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required If she is unconscious in the emergency room, the treating physician can share what you need to know about the crisis at hand.
The exception is narrow. It opens the door to information about the emergency, not her full medical history. Once the crisis passes and she can make her own decisions again, the standard rules resume.
Records That Stay Protected Even With Authorization
Some categories of records get extra protection that a general authorization or MPOA does not automatically overcome.
Psychotherapy Notes
HIPAA treats psychotherapy notes separately because they are the therapist’s private notes analyzing counseling sessions, kept apart from the rest of the chart. A provider generally must obtain a specific patient authorization before disclosing them, even to another provider for treatment.8HHS.gov. HIPAA Privacy Rule and Sharing Information Related to Mental Health A general authorization covering “my medical records” does not include psychotherapy notes. The form has to name them specifically.
This definition is narrow. It does not cover medication records, session start and stop times, treatment frequency, diagnosis summaries, or treatment plans. Those items are part of the regular record and follow normal access rules.
Substance Use Disorder Treatment
Records from federally assisted substance use disorder programs fall under 42 CFR Part 2, which is stricter than HIPAA. They generally cannot be disclosed without specific written consent that meets Part 2’s requirements, or a qualifying court order.9eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records An MPOA or general HIPAA authorization does not automatically reach these records. A separate Part 2 consent is required.
State Mental Health Rules
Many states add their own consent requirements for mental health information. Some let a provider refuse or limit disclosure of mental health records even when the patient has signed a release, if the provider decides disclosure would be seriously detrimental to the patient. The specifics vary by state, so a valid HIPAA authorization does not guarantee access to your wife’s mental health records everywhere.
Insurance EOBs
You may already be seeing some of your wife’s medical information without asking for it. When spouses share a health plan and the husband is the primary policyholder, insurers typically mail Explanation of Benefits (EOB) statements to his address listing every service provided to anyone on the plan. An EOB shows what services were received and what they cost, which can reveal the type of care a spouse sought.
HIPAA gives patients a way to close that channel. Under 45 CFR 164.522(b), a patient can ask her insurer to send health information, including EOBs, to a different address or by a different method. If she states that disclosure to the usual address could endanger her, the insurer must accommodate the request and cannot demand an explanation.10U.S. Department of Health & Human Services (HHS). Disclosures to Family and Friends The request may need to be in writing and include an alternative mailing address. It only protects visits going forward, not statements the insurer has already sent.
Patient Portal Proxy Access
Most hospitals and health systems now offer online portals where patients view lab results, medication lists, and visit notes. Many portals allow a patient to grant “proxy access” to a spouse. Once set up, the proxy logs in with a separate account and can see the patient’s information.
The patient has to initiate this. HIPAA requires portals to authenticate that anyone gaining access is the patient or an authorized representative.11U.S. Department of Health & Human Services (HHS). Individuals’ Right Under HIPAA to Access Their Health Information You cannot call the hospital and ask for portal access to your wife’s account. Setup happens through her own portal, by phone with the provider, or in person at a visit. She can revoke it at any time. For an adult who lacks capacity, an authorized agent such as someone holding a valid MPOA typically has to set up proxy access in person at the facility rather than online.
Separation and Divorce
Once spouses become adversaries in a legal proceeding, the usual pathways narrow sharply. Any personal-representative authority set up by agreement, like an MPOA, is typically revoked, and surrogate consent statutes generally exclude separated or divorced spouses from the priority list.
A husband who wants his wife’s records for a divorce proceeding, perhaps to test a disability claim or a custody argument, has to go through formal legal channels. HIPAA permits disclosure in response to a court order, which compels the provider to produce the specified records.7eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required An attorney-issued subpoena without a court order carries extra requirements: the provider generally needs assurance that the patient was notified and given a chance to object, or that a qualified protective order is in place. Courts weigh relevance against privacy before granting access, and a broad request for the full medical history is usually denied.
After Your Wife’s Death
HIPAA continues to protect a deceased person’s medical records for 50 years after death.12U.S. Department of Health & Human Services (HHS). Health Information of Deceased Individuals During that time, the decedent’s personal representative, usually the executor or administrator of the estate, holds the same access rights the patient had while alive.
If you are named executor of your wife’s estate, you qualify as her personal representative and can request her records. If someone else is appointed executor or administrator, that person controls the records. A surviving husband who is not the executor would need authorization from whoever holds the role.
What Happens if You Get Records Without Permission
Trying to obtain your wife’s records outside the pathways above carries real risk. Federal law makes it a crime to knowingly obtain or disclose protected health information in violation of HIPAA. Basic violations can carry fines up to $50,000 and up to a year in prison. Obtaining records under false pretenses, such as by impersonating the patient, can carry fines up to $100,000 and up to five years in prison. Doing so with intent to sell the information or cause malicious harm can carry fines up to $250,000 and up to ten years in prison.13Office of the Law Revision Counsel. 42 U.S. Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
Beyond federal penalties, your wife may be able to bring a state civil claim for invasion of privacy or emotional distress if unauthorized access caused her harm. The safer route, in every sense, is to ask her directly or to have the paperwork in place before it is needed.