When a Nursing Home Invokes HIPAA, It May Be Hiding More Than Records

Key Takeaways:

The Health Insurance Portability and Accountability Act (HIPAA) gives nursing home residents and their authorized representatives the right to access medical records. It doesn’t permit a facility to withhold documentation simply because an injury or death is under scrutiny. When a nursing home cites privacy law to slow down or block your family's request, it may be using HIPAA as a shield rather than following it as a rule. At Gray & White Law, we know how to cut through those delays and obtain the records that reveal what actually happened to your loved one.

After something serious happens to a resident—a fall with no witnesses, a sudden infection, an unexplained death—families often hit the same wall. They ask for records, and the nursing home responds with some version of the same answer: “We can't share that due to HIPAA.”

It sounds authoritative, but it’s often wrong.

Understanding the difference between what HIPAA actually says and how nursing homes sometimes use it is one of the most important things your family can know before pursuing a Kentucky nursing home abuse and neglect claim.

What Does HIPAA Actually Say?

This act protects the privacy of a patient's health information. What it doesn’t do is give health care providers, including nursing homes, the right to hide records from the patients those records belong to—or from the people legally authorized to act on a patient's behalf.

Under HIPAA's Privacy Rule, a covered entity such as a nursing home must provide access to a resident's protected health information upon request. The right belongs to the resident and, in most circumstances, to:

• A personal representative, such as a health care power of attorney.
• A legal guardian.
• A family member who’s an authorized representative under state law.
• The executor or administrator of a deceased resident's estate.

If your loved one signed authorization paperwork when they were admitted—or if you have legal authority through a power of attorney or probate appointment—the facility's privacy obligations generally run toward you, not away from you. Kentucky state law also independently requires nursing homes to make resident records available for inspection on request.

When Might a Nursing Home Misuse HIPAA Privacy Rules?

There is a meaningful difference between a facility protecting a resident's privacy and one invoking privacy to protect itself. Here are some delay tactics families frequently encounter that have no basis in HIPAA. 

Claiming HIPAA Prohibits Disclosure to Family Members 

The law doesn’t categorically prohibit sharing information with family. It depends on the resident's authorization status and the family member's legal relationship to the resident.

Insisting Only Certain Records Exist

Incident reports, staffing records, wound care logs, and internal communications are not always labeled as "medical records", but they may be legally obtainable and highly relevant to what happened.

Stalling While Citing a "Review Process” 

Another common tactic is to delay producing HIPAA nursing home records while the facility conducts an internal investigation, creating time for late entries, revised notes, or previously undisclosed documents to appear.

Requiring Unusual Authorizations 

A facility that insists on blanket medical authorizations before releasing anything isn’t following HIPAA. It may be using those authorizations to build its own defense.

What Does Your Right to Access Medical Records Cover?

When a proper request is made by an authorized individual, a nursing home is generally required to produce:

• Nursing notes and daily care documentation.
• Medication administration records.
• Physician orders and progress notes.
• Wound care and skin integrity assessments.
• Fall risk assessments and incident reports.
• Vital signs flow sheets and lab results.
• Care plans and resident assessments.

HIPAA allows facilities to charge a reasonable cost-based fee and to take up to 30 days to respond, with one 30-day extension. What the law doesn’t allow is an indefinite refusal, a blanket claim that "privacy" bars disclosure to an authorized representative, or selective production that omits incident documentation.

What Should Your Family Do After a HIPAA Roadblock?

If a nursing home cites this act to delay or deny your request for medical records after a serious incident, take these steps:

1. Put your request in writing and send it by certified mail. Document every communication.
2. Identify your legal authority—such as power of attorney, guardianship, or estate appointment—and include a copy with your request.
3. File a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, which enforces HIPAA access rights, if the facility refuses a valid request.
4. Contact our skilled Kentucky nursing home abuse lawyers. Administrative remedies take time. Legal intervention is often faster and more comprehensive.

How Gray & White Fights for the HIPAA Records Facilities Try to Withhold

When your request hits a wall, the legal path forward expands considerably. Our attorneys have spent more than 25 years uncovering the truth in nursing home neglect and abuse cases. Our approach to keeping facilities from destroying or concealing evidence begins before litigation is filed.

A formal litigation hold letter puts the facility, its corporate parent, and its insurer on notice that all HIPAA nursing home records—paper, electronic, and metadata—must be preserved. Once that letter is received, routine destruction of records becomes spoliation, which carries serious legal consequences.

In litigation, formal discovery tools go well beyond what a family can request administratively. Subpoenas compel production of:

• Complete electronic health records, including audit trails showing when entries were created, edited, or deleted.
• Staffing schedules and payroll records that document who was actually on the floor.
• Internal communications, including emails and interdepartmental messages.
• State inspection and survey reports, which are also publicly available through the Centers for Medicare & Medicaid Services.

Our team includes a registered nurse who reviews medical records and translates clinical documentation into evidence that tells a clear story,  including when the story the chart tells doesn’t match what actually happened to your loved one. HIPAA is a patient protection law. When a nursing home turns it into an obstacle between a family and the truth about what happened to their loved one, that inversion is worth examining closely—and challenging with all our legal might.