Launching soon  ·  Free 7-day trial
Family caregiving

Sharing your parent's health information with family: consent, privacy and who can see what

Why a clinic may not share your parent's health details with you, how a parent can name who may receive them, and what a power of attorney changes.

By Taranjit Singh, Founder, Cureva · October 20, 2026
Get the free checklist →

This is general information, not legal advice. Rules differ by country, province and state, and by the type of clinic. For your own situation, ask the clinic or its privacy officer.

You phone your mother's clinic to ask how her appointment went. The receptionist says they cannot discuss it. It feels cold when you are the one driving her to every visit. It is usually not coldness. It is privacy law doing what it was written to do.

The short version

  • Health information belongs to the patient, not to the family.
  • Clinics generally need the patient's consent before sharing it with someone else.
  • Your parent can say, in advance, who may receive information.
  • A power of attorney or similar document can change who acts for your parent, but usually only within its limits.
  • When unsure, ask the clinic what form they want on file.

Why a clinic may not share with an adult child

In Canada, the federal privacy commissioner explains that organizations generally need "meaningful consent" to collect, use and disclose personal information, and that people should understand what they are agreeing to. Sensitive information, which includes health details, generally calls for express consent.

In British Columbia, the Personal Information Protection Act says an organization must not collect, use or disclose personal information about an individual unless the individual consents (or another exception applies). The guide written for private physician practices (2017) says that, for direct care, implied consent usually covers the people providing care, such as specialists, referring physicians and lab staff, not relatives. Sharing outside that circle generally needs express consent, meaning the patient agrees verbally or in writing.

In Ontario, the Personal Health Information Protection Act (section 20) lets certain custodians assume implied consent to share information for health care, unless they know the person has withheld or withdrawn consent. The Information and Privacy Commissioner's example says a long-term care home may not assume that for a relative's spouse, because that person is not a custodian. Alberta's government says that, apart from limited circumstances in the Health Information Act, a custodian must get your written consent before releasing information to a third party such as a family member.

So an adult child is, by default, outside the circle.

Where family can still be told something

Rules usually leave room for common sense. In the United States, HHS says HIPAA does not require a provider to share with family or friends unless they are personal representatives, but lets it do so if they are involved in your care or payment and you agree, do not object, or the provider judges you would not object. Its example: if you do not object, your doctor could talk with the friend who goes with you to the hospital. The rule text (45 CFR 164.510(b)) limits sharing to what is directly relevant to that person's role. If the patient is absent or cannot be asked because of incapacity or an emergency, the provider may use professional judgment about the patient's best interests.

In Alberta, section 35(1) of the Health Information Act lets a custodian disclose without consent to family members, or someone believed to have a close personal relationship with the person, if the information is given in general terms (presence, location, condition, diagnosis, progress and prognosis on that day) and is not contrary to the person's express request. It also allows disclosure so family can be contacted when the person is injured, ill or deceased, again unless the person has asked otherwise.

In Ontario, section 38(1)(c) of the Act lets a custodian disclose to contact a relative, friend or potential substitute decision-maker if the person is injured, incapacitated or ill and unable to consent personally.

In Australia, the privacy regulator's guide says a health provider may use or disclose health information for another purpose with the patient's consent. It also describes a narrower path: when a patient cannot give or communicate consent, a provider may be able to share with a "responsible person" where it is necessary for appropriate care or for compassionate reasons. The disclosure should be limited to what is reasonably needed, and should not go against the patient's earlier wishes.

In Victoria, the Health Records Act 2001 sets Health Privacy Principles for public and private health providers, and the Department of Health says it defines "immediate family member" to include someone the person has nominated to receive their health information. Nationally, the Privacy Act 1988 has 13 Australian Privacy Principles, and the OAIC says APP 6 sets when information may be used or disclosed.

How a parent can name who may receive information

The practical fix is to ask your parent to put it on record, while they are well enough to decide. Ask the clinic what it uses. Common options are a signed consent or authorization form naming you, a note in the chart, or your parent saying so during a visit with you present.

In Canada, the federal privacy commissioner says people can generally withdraw or change consent by giving reasonable notice, so your parent stays in control. The Australian guide notes that good practice is to record a patient's wishes before capacity is lost. Your parent can name specific people and specific kinds of information.

What a power of attorney or representative does and does not change

A power of attorney, guardian or similar representative is a different route from simple consent. It is about someone having legal authority to act for your parent.

In British Columbia, the Personal Information Protection Act Regulation defines a "representative" to include an attorney under an enduring power of attorney and a representative under the Representation Agreement Act, who may give or refuse consent and make an access request for the individual.

In Ontario, section 26 of the Personal Health Information Protection Act says that if a person is found incapable of consenting, a substitute decision-maker may give, withhold or withdraw consent for them. The list starts with a guardian or an attorney for personal care or property (within that authority), then a spouse or partner, a child or parent, a brother or sister, and any other relative.

In Alberta, section 104 of the Health Information Act says an attorney under a power of attorney can exercise a person's rights under the Act only for matters within the powers of that document, and an agent named in a personal directive can do so if the directive allows it.

In the United States, a person with authority under applicable law to act for an adult on health care decisions is treated as a "personal representative," and is treated as the individual only for the health information relevant to that representation.

What this tells you:

  • Having the document is not the same as having access to everything. The authority has a scope.
  • The kind of document and its wording matter. Many documents cover money or property, and others cover health care. Which one you hold decides what a clinic will accept.
  • Rules differ by place, so ask which documents the clinic recognizes. Which laws apply can also depend on the province: the federal commissioner notes that Ontario has its own health privacy law, while Alberta and British Columbia have their own private-sector privacy laws.

We cover the document itself in our guide to power of attorney: /blog/power-of-attorney-for-a-parent.

Questions worth asking the clinic

  1. What form do you need so my parent can name me?
  2. What can I be told once it is signed?
  3. What do you need to see to accept a power of attorney?
  4. How does my parent change or cancel the permission?

How Cureva approaches this

Cureva is built on the same idea: the person stays in control. Cureva's published privacy page says caregiver access is always opt in and revocable, and that you choose exactly who sees what. Nobody gets access you did not give. You can read more on our data page (/your-data) and our trust page (/trust).

For a one page list to take to your parent's next appointment, use the free checklist: https://cureva.app/free?utm_source=seo_sharing-health-information

Sources

Free checklists for family caregivers

Medicine and doctor sheet, and money checklists for Canada, the US and Australia. Free.

Get the free checklists →

Read next

Power of attorney for a parent: what families should know

Caring for a parent from a distance: who to call and what to set up

Why an alarmis not the answer.

Medical Disclaimer: Cureva is a medication reminder and tracking tool, not a medical device. It does not provide medical advice, diagnosis, or treatment recommendations. Always follow your healthcare provider's instructions regarding your medications and health conditions. If you have concerns about your medication schedule, contact your doctor or pharmacist.

Eva supports, tracks, and informs. She does not diagnose or prescribe. Your doctor makes the decisions. Eva is an AI companion who can guide you, but she never gives medical advice.