Under the HIPAA Privacy Rule, a spousal relationship alone confers no inherent right to access a patient's protected health information (PHI). A records request built on marital status gets rejected, and that rejection is the kind of delay that stalls chronology work before case preparation can begin.
What controls access is the authorization basis: a patient-signed authorization, recognized personal-representative status, or a permissive involvement-in-care disclosure. Each carries a different verification burden, and presenting the wrong one is the most common reason a third-party request fails.
Federal HIPAA rules set the baseline, while state law determines representative authority for living, incapacitated, or deceased patients. For the practitioner managing retrieval, the relationship is never the credential, and confirming which of these pathways applies up front is what keeps records moving within typical retrieval turnaround times.
Does a Spousal Relationship Grant HIPAA Access Rights?
The HIPAA Privacy Rule does not give a spouse automatic access to a patient's PHI. Representative status requires "authority under applicable law," and a spouse lacking a durable power of attorney for health care or other state-law-recognized authority does not meet the threshold under state-law authority.
Absent personal-representative status, disclosure depends on patient non-objection or patient-executed authorization.
- Written authorization under patient-signed disclosure: a valid, patient-signed authorization permitting disclosure to the spouse.
- Involvement in care under permissive care disclosure: a covered entity is permitted, not required, to share information with a person involved in an individual's care as long as the individual does not object.
Verification of state-law authority must precede treatment of a spouse as a personal representative.
How Is Personal-Representative Status Defined and Verified?
A personal representative receives the same rights to inspect and obtain copies of PHI as the patient, limited to PHI "relevant to such personal representation." Applicable law supplies the authority, and the distinction between a healthcare power of attorney and a general or financial power of attorney determines whether HIPAA rights attach.
A healthcare POA currently in effect makes the named person the patient's personal representative. A non-healthcare POA that authorizes only financial or other non-healthcare decisions does not authorize the holder to exercise HIPAA Privacy Rule rights. State surrogate or proxy decision-making statutes can also confer authority where the statute grants the spouse power to make health care decisions for the patient.
Before disclosure, a covered entity must verify the identity and authority of a person requesting PHI under verification requirements if that authority is not already known. The regulation does not mandate a specific document format; entities apply reasonable verification policies.
- Confirm authority derives from applicable law, not marriage itself.
- Scope-match the PHI released to the representative's authority and obtain the supporting instrument, such as an HCPOA document or an applicable court or guardianship order.
Under 45 CFR 164.502(g)(5), a covered entity may decline to treat a spouse as personal representative where it reasonably believes the patient has been subjected to domestic violence, abuse, or neglect by that spouse and recognition is not in the patient's best interest.
How Does State Law Vary in Spousal Surrogate Authority?
State default surrogate-consent statutes establish how a spouse, absent a designated healthcare POA, may acquire personal-representative authority under 45 CFR 164.502(g). Spousal priority varies by jurisdiction; some statutes place the spouse first, while others subordinate the spouse to a court-appointed guardian or designated agent.
Most of these surrogate statutes exclude a spouse who is legally separated or against whom dissolution proceedings are pending. The applicable statute for each covered entity's jurisdiction controls.
What Authorization Basis Applies Across Patient Scenarios?
HIPAA grants no automatic spousal access; the required authorization basis depends on whether the patient is living and competent, incapacitated, or deceased. Patient-directed right-of-access requests and established personal-representative status create enforceable access rights, while ordinary 45 CFR 164.508 authorizations permit disclosure and permissive pathways leave disclosure to provider discretion.
A living, competent patient retains the HIPAA right of access and may direct a covered entity in writing to transmit records to a named family member. For deceased patients, personal-representative status flows from state probate law through letters testamentary or letters of administration rather than marriage alone. Litigation materials depend on a reliable right of access, making permissive pathways insufficient foundations for building a defensible case chronology.
Which Special-Category Carve-Outs Apply to Third-Party Record Retrieval?
Psychotherapy notes and deceased-patient PHI impose special retrieval considerations even when a valid general authorization exists. As of June 19, 2026, the 2024 reproductive-health provisions are treated as largely vacated, except the Notice of Privacy Practices exception described below.
Psychotherapy notes generally require a standalone authorization under 45 CFR 164.508(a)(2), subject to limited exceptions for treatment by the originator, covered-entity training programs, and the entity's legal defense. A psychotherapy notes authorization cannot be combined with any other authorization type under 45 CFR 164.508(b)(3)(ii); a compound authorization is defective.
Psychotherapy notes do not include medication prescriptions, session times, treatment modalities, clinical test results, or diagnosis and treatment-plan summaries, all of which remain accessible under the standard right of access. A spouse or third party presenting only a general HIPAA release for psychotherapy notes must be rejected for third-party retrieval.
The 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy, published at 89 FR 32976, was largely vacated. The U.S. District Court for the Northern District of Texas vacated most of the rule on June 18, 2025 in Purl v. HHS, preserving only a limited Notice of Privacy Practices exception. The disclosure prohibition and attestation requirement are not in effect.
Deceased-patient PHI carries protection for a defined period under 45 CFR 164.502(f): HIPAA obligations apply for 50 years following death; after 50 years, the information is no longer PHI and HIPAA obligations cease. Some states fill the gap before an estate is opened; North Carolina (10A N.C. Admin. Code 13B .3904) and Pennsylvania (28 Pa. Code § 115.29) grant next-of-kin access where no executor exists.
How Do Response Windows and Defects Govern Retrieval?
Authorization validation and response-window tracking affect whether records arrive in time for case preparation. A covered entity must act on a request for access no later than 30 calendar days after receipt under 45 CFR 164.524, with one permitted 30-day extension requiring written notice and a completion date within the original window. The maximum federal outer limit is 60 calendar days.
State laws that are more stringent are not preempted under 45 CFR 160.203. Several jurisdictions impose shorter windows under their cited statutes: Florida requires production within 10 business days under Fla. Stat. § 766.204, New York within 10 days under N.Y. Public Health Law § 18(2)(a), and California within 15 days under Cal. Health & Safety Code § 123110(b)(1). These state deadlines control where they are shorter than the federal window.
Because a HIPAA right of access request directing records to counsel is mandatory on the provider and fee-capped, while an authorization-based request is permissive and not subject to the fee cap, the right-of-access pathway is more enforceable. Several defects under 45 CFR 164.508(b)(2) trigger automatic rejection.
- A spouse signs as if the patient without establishing personal-representative authority.
- A representative signs without attached supporting documentation, or relies on a non-healthcare POA.
- A psychotherapy notes request is bundled with a general medical-records authorization.
Key Takeaways for Spousal Records Requests
Access requires patient authorization or state-law personal-representative status. A permissive involvement-in-care disclosure may also apply. State surrogate statutes vary in spousal priority and frequently disqualify separated or divorcing spouses, while psychotherapy notes, deceased-patient protections, and authorization defects under 45 CFR 164.508 govern retrieval independent of the relationship. For the paralegal preparing the request, validating the authorization basis before submission is what prevents the rejected-request delays that stall a defensible treatment chronology.
Legal AI tools support medical record retrieval and documentation workflows across jurisdictions with differing authorization standards.
To learn more, request a demo.
