Sudden incapacity: POA, surrogates, and what you may accept

What is federal here, and what your state decides

When a patient suddenly cannot make their own decisions, there is no single national answer to who decides — and that is the first thing to understand, because getting it wrong exposes both the patient and you. HIPAA supplies the frame: it treats a patient's personal representative as the individual for records and decisions, and then defers to your state's law on who that representative actually is for an incapacitated adult 1Ref 1HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA treats a personal representative as the individual and defers to state law on who that representative is for an incapacitated adult.. So the federal rule points you at state law rather than answering the question itself.

That state-dependence is not a detail to bury. The order of who may decide, the documents that count, and the process for appointing someone all vary by state, so your state's health-care decisions or surrogate-consent statute is the authority that controls — not another state's rule and not a general summary. HIPAA also still governs what you may disclose while you sort this out, including talking to family involved in the patient's care, limited to what is relevant 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.The Privacy Rule's permitted disclosures and minimum-necessary standard, including disclosures to family involved in care and refusal where release could endanger the patient..

The documents that grant decision authority

The cleanest situation is one the patient set up in advance: a health-care power of attorney (sometimes called a health-care proxy or durable power of attorney for health care) naming an agent to decide when the patient cannot. If a valid, current document names an agent, that agent generally steps into the patient's shoes, and HIPAA treats them as the personal representative — meaning they can also exercise the patient's records rights, subject to the ordinary access rules 3Ref 3HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The right-of-access mechanics a verified representative exercises: inspection and copies, the thirty-day window, and the cost-based fee.. Ask for the document, read who it names and what powers it grants, and file a copy.

A few checks protect you before you accept it. Confirm the document is signed and appears valid on its face, that it actually covers health-care decisions (a financial power of attorney may not), and whether it takes effect only on a determination of incapacity — some do. When in doubt about a document's validity, that is a question for the patient's or family's attorney, not one you resolve alone.

No document, no obvious surrogate: the default hierarchy

When there is no health-care power of attorney, most states have a default surrogate-consent statute that names, in priority order, who may decide — commonly a spouse, then adult children, then parents, then siblings, and so on. The exact order, who is included, and how ties are broken differ by state, so you must look to your own state's statute rather than assume a national list. Do not simply defer to whoever is loudest or arrives first; identify the person the statute actually designates.

If no surrogate exists or the family is in conflict, decision authority may have to come from a court through guardianship or conservatorship, which places the question in front of a judge. That process produces a court order defining the guardian's powers. If a subpoena or a court order later reaches you for the patient's records, remember that a court order authorizes only what it specifies 4Ref 4HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That a court order authorizes only what it specifies if a guardianship proceeding or subpoena seeks the patient's records.. When you cannot identify a lawful decision-maker and a decision cannot wait, contact the hospital or facility involved, or the patient's or family's attorney, and document your efforts.

What a representative may access — and the minimum-necessary limit

Once you have identified the lawful decision-maker, they generally exercise the patient's rights, including the right of access: they may inspect and obtain copies of the record under the ordinary access rules, and the same thirty-day response window and cost-based fee apply 3Ref 3HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The right-of-access mechanics a verified representative exercises: inspection and copies, the thirty-day window, and the cost-based fee.. Treat a verified surrogate the way you would treat the patient for records purposes, while keeping the identity check that got you there.

Authority is not unlimited, though. Share only the minimum necessary for the decision at hand, and remember that HIPAA lets you decline to treat someone as a personal representative if you reasonably believe doing so could endanger the patient — relevant when the incapacity involves suspected abuse by the very person asking 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.The Privacy Rule's permitted disclosures and minimum-necessary standard, including disclosures to family involved in care and refusal where release could endanger the patient.. If you are ever unsure whether HIPAA even applies to your setup, that turns on the covered-entity test, but for most billing clinicians it plainly does. When authority is contested, disclose narrowly and document why.

Capacity fluctuates — and it is decision-specific

Incapacity is often treated as a switch, but clinically and legally it is neither permanent nor global. Capacity is specific to a decision and a moment: a patient may lack capacity to manage complex treatment choices while still being able to express preferences, and capacity can return as an acute condition resolves. A surrogate's authority is meant to fill a gap, not to erase the patient's voice while the gap lasts.

So keep involving the patient to the extent they can participate, document your basis for concluding they cannot make a given decision, and reassess rather than assuming the finding is fixed. If capacity is restored, decision-making returns to the patient, and the surrogate's role ends for decisions the patient can again make. This is a place where careful, dated documentation of your reasoning protects everyone, because the question of who decides can be revisited as the patient changes.

When incapacity becomes death — authority shifts again

If a patient dies, the surrogate's authority ends and a different rule takes over. A decedent's protected health information stays protected for fifty years after death, and it is the personal representative of the estate — the executor or court-appointed administrator — not the former health-care surrogate, who then exercises the patient's rights 5Ref 5HHS Office for Civil Rights (2026).Health Information of Deceased Individuals.That after death a decedent's PHI stays protected for fifty years and the estate's personal representative, not the former surrogate, exercises the rights.. The agent under a health-care power of attorney does not automatically become the estate's representative; those are different roles created by different documents.

In practice this means your verification restarts at the moment of death: the health-care proxy who was rightly making decisions last week may have no authority over the record now, and you look instead for the court document appointing the estate's representative. The transition mirrors what happens more broadly when a patient dies, and it is worth knowing the boundary before you are standing at it.

A sequence for the moment it happens

When incapacity is sudden, you will be making these calls under pressure, so decide the order now, and lean on your state's statute and, when needed, an attorney rather than guessing your way through a legal question in a stressful moment:

1. Stabilize and address any emergency — genuine emergencies carry their own consent rules; call 911 if the situation is acute. 2. Look for a health-care power of attorney and read who it names and what it covers. 3. If none, apply your state's surrogate-consent statute — identify the designated person, not the loudest. 4. If no surrogate or a dispute, look to guardianship through the court. 5. Verify identity and authority before you disclose or accept a decision. 6. Disclose the minimum necessary and keep the patient involved to the extent they can be. 7. Document the capacity finding, the authority you relied on, and your reasoning — and reassess as the patient changes.

The categories are general; your state's statute sets the actual order and the details, so treat the table as a map, not the territory.