A husband does not automatically receive unrestricted access to his wife’s medical records merely because they are married. Access can depend on her authorization, a valid direction to send records, or his authority as her personal representative under applicable law. Permission to discuss care is also different from a right to obtain the complete chart. [1][2]
The patient can authorize or direct a disclosure
A patient may provide a valid written authorization allowing a covered provider or health plan to disclose specified information. HHS also describes a patient’s ability, under the applicable access rules, to direct transmission of records to another person. The request should identify the recipient and destination clearly. Use the provider’s current process and specify the records and dates needed. [1]
A patient portal proxy arrangement can provide another practical route, but it should be formally established. Using a spouse’s password without permission is not equivalent to being an authorized proxy or personal representative.
Personal-representative authority comes from law
HIPAA generally treats a valid personal representative as the patient for the rights within that representative’s authority. HHS explains that the authority usually depends on state or other applicable law governing health-care decisions. A health-care agent, guardian, or spouse authorized under that law may qualify, but marriage alone does not answer every case. [1][2]
Provide the operative power of attorney, guardianship order, or other evidence and identify whether it is currently effective. A document that authorizes only financial transactions may not establish authority to make health-care decisions or obtain the requested records.
Care discussions can be narrower than record access
Providers may share information directly relevant to a family member’s involvement in care or payment when the patient does not object. When the patient is incapacitated, disclosure can depend on professional judgment about the patient’s best interests. That permission does not automatically authorize release of every unrelated detail. [1]
After death, the personal representative may be an executor, administrator, or another person authorized under applicable law. The right to administer an estate and the status of surviving spouse should be checked separately. [1]
Make a focused request
- Explain whether the patient authorized disclosure or you claim representative authority.
- Identify the needed records and purpose.
- Supply the relevant signed documents.
- Ask for the reason and review process if access is denied.
For litigation, compare medical records and subpoenas. HIPAA issues during divorce explains why a family relationship does not remove privacy obligations.
Primary sources
- HHS: When family members can access health information
- HIPAA and Marriage: Understanding Spouse, Family Member, Marriage, and Personal Representatives in the Privacy Rule
Sources checked: October 31, 2026.