Managing health records for your family: kids, aging parents and caregivers

In most families, one person ends up holding everyone’s health history in their head. Which specialist said what. Whether the dose changed. Whether Dad’s cardiologist knows about the medication his primary care doctor started. Often they are doing it for their children and their own parents at once, from memory.

There is a thing nobody tells you until the moment you need it, and it is the reason this gets hard: caring for someone does not, by itself, give you a right to see their medical records. This article is about how access actually works in the US, and what to arrange before you need it.

Disclosure

I am a doctor, and I founded exora, which is a personal health record app that can hold records for several people. It appears near the end. The rest applies regardless of what software you use, and every legal claim is linked to its source.

The one idea that ties it together

Nearly everyone reading this is caring for children, for an adult who can still decide for themselves, or for someone who no longer can. They work differently, but the federal idea that ties these together is HIPAA’s personal representative. A doctor, hospital or health plan covered by HIPAA must treat a personal representative “as the individual”, which includes the right to see and get copies of their records (45 CFR 164.502(g)). Who counts as one is decided by “applicable law”, which mostly means state law. HIPAA does not make you anyone’s representative. It recognizes authority you already have.

Your own children, and the change around age 12

For a minor (under 18 in most states), a parent or guardian with authority under state law to make their health care decisions is their personal representative (45 CFR 164.502(g)(3)). For young children, that is usually the whole story.

Then there are the exceptions, and they matter more as children get older. Under the same rule, a parent is not the personal representative for a particular service when:

• the minor consents to that care themselves and no other consent is required by law;
• the minor can lawfully get that care without a parent’s consent, and the minor, a court or someone authorized by law consents to it; or
• the parent agrees that the doctor and the minor can keep that care confidential.

Which services a minor can consent to on their own is set by each state, so it varies. Even then, state law can still allow or forbid a provider from sharing that information with a parent, and where state law is silent, a licensed health professional decides (45 CFR 164.502(g)(3)(ii)). The rule also lets a provider decline to treat someone as a personal representative if they reasonably believe the patient has been or may be abused or endangered by that person (45 CFR 164.502(g)(5)).

Substance use treatment has its own federal rules. For records from treatment programs covered by 42 CFR Part 2, where state law lets a minor get that treatment alone, only the minor can consent to sharing the records, including with a parent (42 CFR 2.14). Part 2 was substantially updated by a 2024 final rule, with a compliance date of February 16, 2026 (Federal Register, 89 FR 12472).

What happens in the portal

This is where most parents notice it. Portals such as MyChart let a parent see a child’s record through proxy access, and that access usually changes as the child gets older. Epic’s own help page is careful not to give one rule: “Each organization determines the ages at which proxy access might become limited or be removed”, because organizations interpret adolescent privacy laws differently (MyChart help).

Twelve is a common turning point, but it is a health system’s policy, not a national law. Two real examples:

• MaineHealth gives a parent child proxy access until the 12th birthday, then switches to a more limited adolescent proxy until 18. A parent can still manage appointments and see immunizations, but not the teen’s health history, medications or most test results. At 18, it ends automatically (MaineHealth).
• Corewell Health in Michigan gives full access for ages 0 to 11 and “Standard Adolescent Access” for 12 to 17, covering appointments, messaging, allergies and immunizations. It explains that from 12, an adolescent “does not need parental consent to receive certain services”, such as care for pregnancy, sexually transmitted infections, substance use and behavioral health (Corewell Health).

Your child’s health system may draw the lines elsewhere. Check its own proxy page.

A narrower portal view is not always the end of your legal access: Corewell, for example, tells parents they can request other information, such as test results, from the provider’s office. At the age of majority, 18 in most states, though, your child is an adult and your status as their personal representative ends. From then on, any access is theirs to give.

Worth saying clearly: the confidentiality is a good thing. Teenagers need to see a doctor about contraception, mental health or drugs and alcohol and know the conversation is theirs. Silent parental access would deter exactly the teenagers who most need to walk into a clinic.

So the practical advice is a conversation before the change, not a surprise after it. Something like: your record becomes more yours this year, which is right, and I would still like to help with appointments and vaccines if you are happy for me to. Most teenagers say yes when asked. Fewer say yes when they discover you have been looking.

A parent or partner who can still make their own decisions

This is the most common situation and the one people most over-complicate. If your mother is capable and simply wants help, you do not need legal authority. She invites you.

There are three ways to do that, and they stack:

• Portal proxy access. In MyChart, the patient invites someone through the Sharing Hub, and that person sees her record from their own account. Some organizations instead require a signed paper form (MyChart help). An adult proxy at MaineHealth, for example, can see results, medications, allergies and history, and message the care team, until the patient removes the access (MaineHealth).
• A HIPAA authorization. A signed form letting a provider release records to you. A valid one has to say what information, to whom, why, and when it expires, and she can revoke it in writing (45 CFR 164.508). Most providers have their own form; ask for it.
• Telling her doctors you are involved. HIPAA already lets providers share information “directly relevant” to your involvement in her care with family, friends or anyone she identifies, if she agrees or does not object when given the chance (45 CFR 164.510(b)). Ask her to say so at her next visit, and to have it noted in her chart.

Note the word: providers may share. It permits them; it does not require them. That is why the written options smooth more phone calls.

The timing is what matters. Set this up on an ordinary Tuesday, not during a hospital admission. Every one of these needs her to be able to agree, and the conversation is much easier at the kitchen table than in a hospital corridor.

Partners

Marriage does not give you access to a spouse’s records while they can decide for themselves; the same invitation applies. Where it can matter is later. If someone has no advance directive and cannot decide, state law determines who makes medical decisions, typically a spouse, parents or adult children. The National Institute on Aging puts the risk plainly: “If you are unmarried and have not named your partner as your proxy, it’s possible they could be excluded from decision-making” (NIA).

Someone who can no longer make their own decisions

For an adult, HIPAA treats as personal representative anyone who has authority “under applicable law” to make health care decisions for them, for the information relevant to that role (45 CFR 164.502(g)(2)). In practice that authority usually comes from one of two places.

A durable power of attorney for health care. This is the document that names a health care proxy, “a person who can make health care decisions for you if you are unable to communicate these yourself”. The proxy may also be called a representative, surrogate or agent (NIA). Common responsibilities include overseeing information about the person’s health, “including medical and hospital records”, though this varies by state (NIA).

Two traps. First, the proxy usually acts only when the person cannot. NIA notes a proxy “can only make decisions for you if you are too sick to make them yourself”. While your parent is capable, it may give you nothing, so the steps above still matter. Second, the legal test is authority over health care decisions. A power of attorney that covers only money is a different document, and it may not get you through the door.

A court-appointed guardian. If nothing was signed while the person could sign it, families may end up asking a court. That is slower, and each state sets the process and the guardian’s powers. For your state’s rules, NIA suggests contacting your state legal aid office or state bar association.

So “I have power of attorney for Mom” may not mean what you think, depending on your state and which document she signed.

The single most useful thing in this whole article: arrange this while it is hypothetical. Advance directives are not only for the very old or very ill, and NIA recommends giving copies to the proxy, to the person’s doctors and to their lawyer.

Being a caregiver without legal standing

The hardest position is responsibility without authority: a friend, a neighbor, an adult child among siblings who disagree. You are doing the work with no standing.

What actually helps:

• Get named while you can. As a portal proxy, on a HIPAA authorization, as health care proxy, and to their doctors. All easy while they are well.
• Keep your own notes. A current medication list and copies of documents you are given. It is what clinicians want when they ask “what is she taking?”
• Ask for things in writing, at the time. The discharge summary, a copy of the referral, the specialist’s letter. Asking at the appointment is far easier than requesting it later.
• Know that the person themselves has full rights. They can request their records from every provider who has treated them, and you can help them do it. Here is how that works.

What actually helps day to day

Legal access is necessary, but what makes a Tuesday easier is smaller: a current medication list per person (names, doses, who prescribed it, when it changed), a one-page summary of conditions, allergies and current doctors, and the answer to “what changed since last time”. The medication list is the most valuable document in family care, and it is almost always out of date.

Portals stop short here. Even with proxy access, each one shows one health system, so caring for three people across a few systems means many logins, each showing a part. I compared portals and personal health records in this article. They are worth having; they will not assemble a family picture for you.

Where exora fits

exora is built for this shape of problem: one account, with a separate profile for each person you look after, such as yourself, a child and a parent you care for. You upload whatever documents you have for each person, such as PDFs, photos and scans, and exora reads them for you, with a reading system built for medical records. It pulls out the clinical details and builds one searchable record with a timeline, and every fact links back to the exact page and text of the document it came from, so you can check it. You can share a chosen part of a record by link, with a co-parent, a sibling or a doctor, with an expiry, and revoke it. Your health data is never used to train AI models. exora is free to start, with an optional membership.

Where it does not help, honestly:

• It is not legal authority. Creating a profile for your mother in an app does not make you her personal representative or her health care proxy, and exora does not check or verify who is. Those are arranged through the processes above, and nothing in software substitutes for them.
• You still need her agreement. Managing an adult’s health information without their knowledge is a problem no product should solve, and this one does not. The same goes for a teenager’s confidential care.
• No connection to MyChart or any portal. You download records from each portal and upload them. That works, and it is a manual step.
• Your data is stored in Sydney, Australia. exora is an Australian company, your record is not hosted in the US, and using it does not create a HIPAA relationship with anyone’s providers. The security page explains how your data is protected.
• It cannot get documents you do not have. You, or the person themselves, still have to request them.
• It can misread. The reading is automated, so check anything that matters against the original. That is why every fact links back to it.
• It is not medical advice. It organizes and presents information. It does not diagnose and it does not tell you what to do.

A short checklist

1. Young children: set up proxy access in each health system’s portal, and keep a copy of their immunization record.
2. Around 12, and again before 18: check your health system’s teen access policy, and have the conversation before the change. At adulthood (18 in most states), any access is theirs to give.
3. Capable adults you help: ask them to add you as a portal proxy, sign the provider’s HIPAA authorization, and tell their doctors you are involved.
4. Anyone aging, and any unmarried partner: complete a durable power of attorney for health care while it is hypothetical, check your state’s form, and give copies to their doctors.
5. Everyone: keep a medication list and a one-page summary per person. If you do nothing else on this list, do this one.

Claims about federal law are sourced to the Code of Federal Regulations and the Federal Register, claims about advance directives to the National Institute on Aging, and claims about portal access to Epic’s MyChart help pages and to MaineHealth and Corewell Health, all linked inline and checked on November 9, 2026. Health systems set their own proxy rules and change them; check yours. This article is general information, not legal or medical advice. Minor consent, health care proxies and guardianship are governed by state law and turn on the specific documents in place; for a real situation, contact your state legal aid office or bar association, or an attorney.