- Family ties alone do not guarantee access to an adult patient's medical information.
- Permission to receive updates and authority to make medical decisions are separate matters.
- The correct documents depend on the country where the patient receives treatment.
- Online access to selected health data rarely replaces formal medical authorisation.
Medical authorisation is easy to overlook when an adult child leaves home for university. If they become ill or have an accident, their parents, partner or other relatives may have no automatic right to speak with the doctor or obtain medical records.
The rules depend on the country where treatment takes place. Every system covered here lets a patient authorise someone in advance, though the documents, scope and timing differ. A form completed in one country may carry no legal weight in another.
England and Wales: next of kin has no automatic authority
Hospitals and GP practices often ask patients to name a next of kin. The term is widely used, yet it does not give that person an automatic right to medical information, records or healthcare decisions.
A patient who has mental capacity decides what information may be shared and with whom. The simplest step is to tell the healthcare team and ask them to record the permission. The patient can define its scope, for example allowing a parent to receive general updates without giving them access to the full medical record.
People aged 16 or over can also ask their GP surgery to give someone family and carer access, also known as proxy access. Depending on the permission granted, a trusted person may be able to book appointments, order repeat prescriptions, view test results or access part of the GP record. The NHS guidance on family and carer access explains the available options.
A health and welfare Lasting Power of Attorney has a different purpose. It allows a chosen attorney to make healthcare and welfare decisions after the person loses the mental capacity to make the specific decision. It cannot normally be used while the patient can decide for themselves.
This arrangement applies to England and Wales. Scotland and Northern Ireland use different legal systems. Registration currently costs £92 and usually takes 8 to 10 weeks when the application contains no errors, according to GOV.UK guidance on Lasting Powers of Attorney.
- Who may receive information about your condition and treatment?
- Who may obtain copies of your medical records?
- Who may make healthcare decisions if you lose mental capacity?
- Where can your family find the signed documents?
United States: HIPAA allows some conversations with family
A healthcare provider covered by HIPAA may share information relevant to a relative's or close friend's involvement in the patient's care if the patient agrees or has an opportunity to object and does not do so.
When the patient cannot make a decision, the provider may share relevant information when professional judgement indicates that disclosure is in the patient's best interests. These provisions permit communication, though they do not require a provider to disclose everything.
Access to the full medical record usually needs stronger authority. A patient can sign a HIPAA authorisation or direct a provider to send records to a named person. Someone recognised under state law as the patient's personal representative generally exercises the patient's HIPAA rights within the scope of that authority.
This role often comes from a healthcare power of attorney. The details and the moment when the document becomes effective depend on state law. The US Department of Health and Human Services explains how HIPAA treats personal representatives.
University health records may fall under FERPA
Students in the United States face another complication. Health records kept by many campus clinics fall under FERPA rather than HIPAA. FERPA rights transfer to the student when they turn 18 or attend a postsecondary institution at any age.
A university may disclose records to parents in limited circumstances, including a health or safety emergency or when the student is a tax dependent. The parent cannot assume access. A FERPA release may be needed alongside a healthcare authorisation.
A student in the US may therefore need separate documents for a hospital, a regular healthcare provider and their university.
Start with your medical contacts, insurance details, medicines and the location of signed forms.
France: a trusted person may speak for you
An adult in France can designate a personne de confiance, or trusted person. This may be a relative, someone close to the patient or the patient's regular doctor.
The trusted person can accompany the patient to appointments and support them in understanding medical decisions. If the patient becomes unable to express their wishes, healthcare professionals consult the trusted person about those wishes.
The designation must be made in writing and signed by the person chosen. It can be changed or withdrawn at any time. French hospitals must offer patients the option to designate a trusted person when they are admitted.
The role does not automatically include access to the complete medical file. Separate, express authority may be required if the patient wants the trusted person to obtain the dossier médical. The role and appointment process are defined in Article L1111-6 of the French Public Health Code.
GDPR does not create one European rule
GDPR protects health data and gives people rights over their own personal information. It does not give relatives a general right to another adult's medical records.
European countries retain responsibility for their healthcare systems and the conditions governing access to medical information. A person who lives in one country, studies in another and has family in a third should prepare under the law of the country where treatment is likely to take place.
Digital health accounts can make selected records easier to share. Their coverage and legal effect remain country-specific.
What to arrange before your child moves abroad
Start with the healthcare system your child will actually use. Check the requirements of their local doctor, hospital, insurer and university clinic.
- Confirm who may receive information about their condition and treatment.
- Prepare the document required for access to medical records.
- Name the person who may make healthcare decisions after loss of capacity.
- Store copies where the chosen person can reach them.
Ask each provider whether it uses its own authorisation form. A student in the US should also check the campus FERPA release. In England and Wales, GP proxy access and a health and welfare LPA cover different situations. In France, a personne de confiance designation may need separate authority for access to the medical file.
Review these arrangements after moving, changing doctors or ending a relationship with the person previously selected.
Keeping the practical information together
Legal forms tell a healthcare provider whom they may speak to. Your family may also need information held elsewhere, such as a list of medicines, allergies, insurance details and the location of important documents.
LegacyApp lets you keep these notes on your phone with an AES-256 encrypted backup in your own Google Drive or iCloud. The contents are never stored on LegacyApp's servers. You choose who may receive the information and when.
LegacyApp does not replace a HIPAA authorisation, LPA, personne de confiance designation or any other medical document. It gives you one place to record what exists, whom you selected and where the relevant paperwork can be found.
Once your child becomes an adult, access to their medical information depends on their permission and the law of the country where they receive treatment. Arrange the documents before they leave home.
Questions & answers
The short version for families preparing for university abroad.
Does next of kin have access to medical records in the UK?
The status of next of kin does not give someone an automatic right to medical records in England and Wales. The patient can authorise access, grant GP proxy access or prepare an LPA for decisions made after loss of capacity.
Can a US doctor speak to a patient's family under HIPAA?
A provider may share information relevant to a family member's involvement in care if the patient agrees or does not object. When the patient cannot decide, the provider may disclose relevant information based on professional judgement and the patient's best interests.
Does a healthcare power of attorney give access to all records?
A person whose healthcare power of attorney is currently effective may qualify as the patient's personal representative under HIPAA. Their authority depends on the document and state law.
Can a personne de confiance obtain a medical file in France?
The designation alone does not automatically provide full access to the medical file. The patient may need to give the trusted person separate, express authority.
Does GDPR give parents access to an adult child's medical information?
GDPR gives individuals rights concerning their own personal data. Access by relatives depends on national medical law and authority granted by the patient.
Pawel Soproniuk - CEO of LegacyApp, a digital legacy app. Author and speaker at numerous events on digital inheritance, entrepreneur and lecturer. LinkedIn
