5.3 Advocacy for Patients and Families

Help People Obtain Information Without Bypassing Controls

The current AHIMA outline lists advocacy for patients and families obtaining health information as a Domain 2 task. The wording is deliberate: the exam tests whether an HIM leader treats access as a patient-centered compliance function, not just a back-office release task. Advocacy is the active work of helping people understand what is needed, where the request stands, and how to clear barriers without weakening privacy controls.

Advocacy is not 'release to anyone who asks.' It is guiding the patient, family member, caregiver, personal representative, or other requestor through the correct pathway: verify identity, confirm authority, narrow scope, offer an approved delivery option, explain why a request is incomplete, or route to Privacy/legal review.

Personal Representatives and Family

Under 45 CFR 164.502(g), a personal representative — someone with authority under state law to make health decisions (e.g., a parent of a minor, a guardian, a health-care power of attorney, or an executor of a deceased patient's estate) — generally has the same access rights as the patient. Family status alone is not authority. Read the stem for the actual basis:

The 164.510 'persons involved in care' rule lets a provider share PHI directly relevant to a family member's involvement when the patient agrees, does not object, or in emergencies based on professional judgment. Special caution applies to minors (state law may give the minor sole control of certain services), abuse or neglect reports, and substance use records under 42 CFR Part 2.

Accessibility and Equity

Advocacy includes removing non-privacy barriers: language access, disability accommodations, technology gaps, and low health literacy. Use approved interpreters, plain-language instructions, alternate request channels, and escalation for complex cases. These supports help patients exercise rights without pushing staff into informal releases.

Advocacy Behaviors for RHIA Scenarios

1. Listen for the patient's objective before naming a form or department.
2. Explain the compliant pathway in plain language.
3. Verify identity and authority before sharing details.
4. Help narrow scope when a broad request is unnecessary.
5. Track the request so the next staff member sees status.
6. Escalate complaints, sensitive records, disputed authority, and unusual delays.
7. Use request trends to improve forms, portal prompts, staffing, and training.

Minors: A High-Yield Trap

Minors are the most-missed advocacy area because the answer depends on state law, not HIPAA alone. Generally a parent is the personal representative of an unemancipated minor and may access the record. But HIPAA defers to state law in three situations: when the minor consents to care and no other consent is required (e.g., certain reproductive, mental-health, or substance-use services in some states), when a court authorizes care without parental consent, and when the parent agrees to confidentiality between the minor and provider. In those cases the parent may not be the representative for that specific information.

On the exam, when a minor lawfully consented to a confidential service, the safe answer is to apply state law and route to the Privacy Officer rather than reflexively releasing to the parent.

Substance Use Records (42 CFR Part 2)

Records from a federally assisted substance use disorder program carry heightened protection under 42 CFR Part 2. A general HIPAA authorization is usually not enough; Part 2 requires its own patient consent specifying the recipient and purpose, and it limits redisclosure with a prohibition notice. A 2024 final rule aligned Part 2 more closely with HIPAA for TPO with a single consent, but the redisclosure protections and the heightened-consent expectation remain. Advocacy here means telling the requestor exactly what Part 2 consent is needed rather than releasing under a standard authorization.

Deceased Patients and Decedent Information

After death, a patient's PHI stays protected for 50 years (164.502(f)). The personal representative is the executor, administrator, or other person with authority to act for the estate. HIPAA also permits limited disclosures to family members or others involved in the decedent's care or payment before death, unless doing so is inconsistent with a prior expressed preference. Coroners, medical examiners, and funeral directors may receive PHI as needed to perform their duties (164.512(g)).

On the exam, a grieving relative with no estate authority is not automatically entitled to the full record — advocacy means explaining the executor pathway and the 'involved in care' limits.

The Administrator Lens

If many families submit incomplete forms, do not blame families — fix the form, website, portal prompts, call script, and training. If patients keep calling for status, improve status communication. If employees disagree on proxy, clarify policy and retrain. An RHIA also knows when advocacy means saying 'no' or 'not yet': a respectful, documented refusal that explains the reason and gives a valid next step is still advocacy when authority is missing, scope exceeds the authorization, special protections such as Part 2 apply, or legal review is required.