Pillar guide · 15 min read

Caregiver Phone Checklist: HIPAA, PAs, and Holds

Clear the HIPAA firewall, run the eight recurring tasks, and decide what you pick up yourself — and what Pallie absorbs on hold.

The short answer

Clear the HIPAA firewall first.Every pharmacy, provider and insurer verifies separately. Personal Rep vs Designated Rep vs CMS-1696 — three different forms for three different powers.
There are only eight recurring jobs.Refills, PA chases, appointment lobbying, results chases, DME, eligibility, hospice/home-health coordination, NEMT. Every caregiver workload is a mix of these.
The hold time is the cost.Average pharmacy-PA hold is 40 minutes; Medicare eligibility often hours. DIY the clinical judgment. Hand the sitting-on- hold to Pallie.

Have Pallie handle the hold

Caregivers in the United States operate as project managers for someone else’s health — and the project is run over the phone. Unlike the UK or most EU systems, which centralise authorization and eligibility, the US healthcare estate is fragmented across pharmacies, pharmacy benefit managers, insurers, sub-contracted utilization-management vendors, and federal agency call centers. Each one verifies your right to speak independently. Each one has its own hold queue. This guide is the playbook: the HIPAA mechanics to clear the firewall, the eight-task taxonomy that covers most of the workload, and the shape of a clean hand-off when the sitting-on-hold stops being a good use of your time. If the problem upstream of all of this is picking up the phone at all, start with the phone-call anxiety pillar.

The stakes, in three numbers

53MMA PA requests / yrMedicare Advantage insurers received roughly 53 million prior authorization requests in 2024, per KFF — an average of 1.7 per enrollee.

12.5%Medicaid MCO denial rateMedicaid Managed Care Organizations deny PA requests at more than double the Medicare Advantage rate (HHS OIG).

40 minAvg pharmacy PA holdThe standard hold time for a pharmacy benefit inquiry without a dedicated call centre routinely stretches past 40 minutes.

Clear the HIPAA firewall before you dial

Call-centre representatives at every insurer, pharmacy, and hospital are legally required to verify authorization before disclosing Protected Health Information (PHI). The HIPAA Privacy Rule (45 CFR §164.502(g)) draws a bright line between who may make decisions and who may receive information, and insurers differentiate heavily between the two.

Three instruments cover nearly every caregiver scenario. They are not interchangeable.

Authorization type	Decision-making?	Information access	Documents required	Primary use case
Personal Representative (Healthcare Proxy / Durable POA)	Yes Steps into the patient’s legal shoes.	Full access to all PHI.	Durable Power of Attorney for Healthcare; Healthcare Proxy; state Advance Directive.	Comprehensive care management, authorising surgery, changing plans.
Designated Representative (HIPAA release)	No Cannot consent to treatment or change plans.	Limited to what the release lists (claims, records, specific conditions).	Signed HIPAA authorization / release form — one per institution.	Receiving clinical updates, gathering records, tracking claims.
Medicare Representative (CMS-1696)	Yes Restricted to Medicare administration.	Full access to Medicare claims and records.	Federal Form CMS-1696 (state POA is not sufficient).	Filing Medicare appeals, disputing federal denials, changing MA plans.

The practical reality most first-time caregivers miss: in a universal system like the UK’s, a Lasting Power of Attorney is logged centrally with the Office of the Public Guardian, and it’s visible to the NHS. In the US, there is no central registry. You file each authorization separately with everyhospital system, pharmacy, insurer, and sub- contracted utilization-management vendor. Keep scanned PDFs on your phone. Fax them again when the third-party call centre can’t find the first two copies.

When nothing is on file yet, you can still clear the wall by executing a verbal HIPAA releaseon the call. Conference your parent onto the line; the representative will verify identity (name, DOB, address, often last four of SSN) and ask the patient to state a sentence close to the one below. It’s call-scoped — good only for the current conversation.

“I authorize [Caregiver’s Name] to speak on my behalf for this call. Please note this verbal consent in my file and proceed with them.”

When a parent is suddenly incapacitated and nothing is on file

The hardest scenario is the one most families end up in: a stroke, an acute dementia event, or an unplanned hospital admission, with no durable POA executed. Verbal authorization is off the table because the patient can’t give it. Here’s the path, in order.

Check for any written instrument on file.Hospital EMRs often carry a healthcare proxy or advance directive uploaded from a prior admission, even if the family doesn’t have the paper copy. Ask the unit clerk to pull it.
Invoke the state statutory surrogate hierarchy.For clinicaldecisions, nearly every state defaults to a hierarchy — spouse, then adult children, then parents, then siblings. Providers rely on this for immediate treatment consent.
Ask the provider to use §164.510 best-interest disclosure.The HIPAA Privacy Rule explicitly permits a provider to disclose necessary PHI to a family member, using professional judgment, when the patient is incapacitated and it’s in their best interest. This gets you clinical updates but not insurance or financial access.
Petition for interim guardianship.For anything beyond clinical — fighting denials, transferring funds, dealing with the insurer — no one has automatic authority. File with the local Clerk of Superior Court (or state equivalent) for guardianship, and explicitly request interim guardianship if there is imminent risk to health or property. Many states expedite these petitions within days.

None of this is fast. Execute the POA paperwork with your parents while everyone is well — it is the single highest-leverage caregiver action you will ever take.

The caregiver task taxonomy — the eight recurring jobs

Almost every caregiver workload reduces to eight recurring task types. Each one has a distinct call shape, a different counter- party, and a different point where a hand-off makes sense. The scripts for the clinical/insurer calls live on the prior-authorization & appeal scripts page; the vetting-call script for placements lives on the eldercare facility vetting page.

Refills & cross-pharmacy transfers

Get the medication into your parent's hands when the local pharmacy is out of stock — verify inventory elsewhere, trigger a transfer from the prescribing clinic.

Hand-off: Pallie calls three pharmacies, confirms stock, initiates the transfer.

Pharmacy PA chase

Unstick the three-way bottleneck between pharmacy, clinic, and PBM. Get the rejection code, confirm the ePA is submitted, track the clock.

Hand-off: Pallie holds for the PBM, reads back the rejection code, reports back when the clinic fax lands.

Appointment & cancellation-list lobbying

Beat the month-long specialist wait by working the cancellation list — calling the scheduling desk at business-open for the day's vacated slots.

Hand-off: Pallie runs the 9 am cancellation-list sweep across a list of clinics.

Lab / imaging results chase

Move images from the radiology center to the specialist clinic. Call records, request secure transfer, confirm receipt on the receiving end.

Hand-off: Pallie calls both sides of the handoff and confirms receipt.

DME authorization

Coordinate between the prescribing doctor, the insurer for authorization, and the DME vendor for fulfillment of a wheelchair, CPAP, or hospital bed.

Hand-off: Pallie runs the three-way coordination call; you sign any paperwork.

Medicare / Medicaid eligibility

Verify active enrollment, fix lapsed coverage, sync dual-eligible records, confirm coverage start dates. Long holds are the norm.

Hand-off: Pallie is well-suited here — average federal hold times are measured in hours.

Hospice / home-health coordination

Book intake assessments with discharge planners, verify Medicare/Medicaid eligibility, confirm the agency has capacity to staff required hours.

Hand-off: Pallie schedules the intake; the social worker joins for clinical review.

NEMT scheduling

Book non-emergency medical transportation for dialysis or oncology visits through the plan's broker. Requires 48–72 hours advance notice.

Hand-off: Pallie books the ride, confirms the vendor, sends you the pickup time.

The compounding nature is what breaks people. A dropped call on refill transfer (task 1) delays a PA chase (task 2), which delays a specialist appointment (task 3), which delays the imaging (task 4). Every reset pushes clinical care back a week. Batching by task type — doing all of today’s pharmacy calls in one block, all of today’s insurer calls in another — compresses the friction.

State and document variations worth knowing

Three variations catch nearly every caregiver off guard. Handle them once and you won’t be surprised again.

California · AHCDCombined Advance DirectiveCalifornia uses a single Advance Health Care Directive that bundles the living will and the healthcare proxy. Other states usually require separate forms — you can’t assume cross-state parity.

46 states · POLST familyPortable medical orders, many names46 states plus DC use a POLST-style portable medical order — called MOLST, MOST, POST, or COLST depending on the state. They travel with the patient across facilities, unlike a standard DNR.

Federal · MedicareCMS-1696 is non-optionalYour state POA does not automatically authorize you for Medicare-specific actions. Always file CMS-1696 in parallel. Medicare call centres will refuse state POAs on Medicare matters.

How to interpret what you hear on the call

Three phrases repeat across pharmacy, insurer and provider lines. Each means something specific, and each sets a different clock.

Means “fix paperwork”

“We can’t discuss that.” The HIPAA firewall. Not a denial. Ask whether the block is on authorization or on clinical info; fix the paperwork or execute a verbal release and call back.
“We’re reviewing it.” The prior-auth clock is running. Get the expected decision date and the reference number. Calendar the day before the due date for your follow-up.

Starts the appeal clock

“That was denied.” Different animal. Request the denial letter in writing along with the specific policy citation, note the filing window (usually 60–180 days), and start the ladder. The full playbook is on the denial pillar.
“That’s experimental.” Also an appeal trigger. Capture the policy number cited, and ask whether the treatment has FDA approval for your indication — that single data point is the spine of the appeal.

Three places to stop doing this alone

Caregiving compounds until it breaks. Three concrete forks, ordered by how often they apply.

If you’re vetting a placement.Nursing homes, memory care, and SNFs all run their sales funnels over the phone. The specific questions that separate a safe facility from a marketing facade — overnight staffing ratios, agency-reliance, medication protocols, CMS deficiencies — live on the eldercare facility vetting page, with a printable rubric. Pallie can batch the first-round triage calls; the final vetting call stays with you.
If you’re fighting a specific denial.Denials are almost never the end. 80% of appealed Medicare Advantage denials are overturned, yet fewer than 12% are ever appealed. If you have a denial letter in hand, fight a denial by phone is the next page to read.
If the hold time is the problem.40-minute pharmacy PA queues, multi-hour Medicare eligibility holds, discharge-planner games of phone tag. Pallie is built for exactly this: you brief the job once, Pallie dials and waits, you get the outcome and any decisions back in writing.

Hand the next call to Pallie

Frequently Asked Questions

What's the difference between a personal representative and a designated representative under HIPAA?

A personal representative — created by a durable power of attorney for healthcare or a healthcare proxy — steps into the legal shoes of the patient. They can consent to treatment, change insurance plans, and access all PHI. A designated representative, created by a signed HIPAA authorization, can only receive information the patient has listed on the release. They cannot make decisions. Insurers and hospitals verify both separately, and every institution needs its own copy on file.

My parent is on Medicare. Is a state power of attorney enough?

No. Medicare call centers generally don't honor a state-level POA for Medicare-specific actions — filing appeals, switching plans, or disputing coverage decisions. You need to file the federal Appointment of Representative form, CMS-1696, with Medicare directly. File it once and Medicare will recognize you across inquiries. Keep a PDF on your phone for live call reference.

What if my parent is suddenly incapacitated and we have nothing on file?

For immediate clinical decisions, most states have a statutory health-care surrogate hierarchy — the provider defaults to spouse, then adult children, then parents, then siblings. Under HIPAA §164.510, a provider may also disclose necessary PHI to a family member using professional judgment if it's in the patient's best interest. For broader access — fighting denials, managing finances — no one automatically has authority. The only recourse is petitioning the local court for guardianship, and most states allow an "interim guardianship" request when there's imminent risk.

Can I get a verbal HIPAA release done on the phone?

Yes, if the patient is cognitively able to participate. Conference your parent onto the call. The representative will verify identity (name, DOB, address, often last four of SSN) and ask the patient to state: "I authorize [Caregiver Name] to speak on my behalf for this call." Verbal authorization is call-scoped — it doesn't persist. For anything recurring, file a written release.

How long does a pharmacy prior authorization actually take?

Standard prior authorizations run 1–5 business days. Specialty medications (biologics, oncology, high-cost infusions) run 5–14 days. Beginning in 2026, the CMS Interoperability and Prior Authorization final rule caps standard non-urgent PAs at 7 calendar days for impacted payers (Medicare Advantage, Medicaid Managed Care) and 72 hours for expedited requests. The rule also forces payers to publicly post their PA metrics — approval rates, denial rates, and average turnaround times.

Does California have different paperwork than other states?

Yes. California uses a single combined Advance Health Care Directive that bundles a living will and a healthcare proxy into one document. Most other states require separate forms. Portable medical orders also vary — 46 states plus DC use some version of POLST (called MOLST, MOST, POST, or COLST depending on the state). Your state's Department of Aging or state bar association publishes the exact form; bring it to the hospital before a procedure, don't wait until a crisis.

What do I actually say to cut through on a refill or PA call?

Lead with the identifiers, not the story. "Patient [Name], DOB [MM/DD/YYYY], member ID [X]. I'm the authorized representative, CMS-1696 on file since [date]. I'm calling about prescription [Drug], rejection code [if known], and I need the prior-authorization status." Representatives are trained to verify and route; a clean opener takes you from a triage line to the specialty desk in one step.

Can Pallie actually handle a medical call for me?

Yes — for the parts of the workload that are pure phone time: refill chases, prior-auth status follow-ups, eligibility verifications, transportation scheduling, cancellation-list lobbying, and discharge-planner coordination. You send a short brief and the HIPAA paperwork; Pallie dials, waits out the hold, and reports back. The one caveat: peer-to-peer clinical reviews are physician-to-physician by law — Pallie schedules those and absorbs the hold, but your doctor runs the clinical conversation.

What's a reasonable response when a call center says "we can't discuss that"?

That's the HIPAA firewall — not a denial. Ask precisely: "Is the block on verification of authorization, or on the clinical information?" If authorization: ask what form they need, where to fax it, and a reference number for the outstanding request. If clinical: offer a verbal authorization with the patient on the line. Never argue in-the-moment that you "should" have access — that flags the account. Clear the paperwork, call back.

How do I know whether I'm dealing with a denial I should appeal?

Three phrases to parse carefully. "We can't discuss that" — HIPAA wall, fix the paperwork. "We're reviewing it" — the PA clock is running, note the expected turnaround and set a calendar reminder to follow up the day it's due. "That was denied" — the appeal clock has started. Commercial plans typically allow up to 180 days (UnitedHealthcare is 65 days), Medicare Advantage is 60 days. The full playbook — and the peer-to-peer move that overturns 50–65% of denials — lives on the denial pillar.