Every August, Illinois parents send a student to campus with a folder of signed forms. A health care power of attorney, a financial power of attorney, maybe a Health Insurance Portability and Accountability Act (HIPAA) release pulled from a template site. The family signs everything at the kitchen table, scans it to a phone, and stops thinking about it.
Some of those documents fail at execution. Others are valid and still don't do what the family assumes they do, because at least five bodies of law govern what a parent can see and decide once a child turns eighteen: the Illinois Power of Attorney Act, the Illinois Health Care Surrogate Act, the Illinois Mental Health and Developmental Disabilities Confidentiality Act, HIPAA, and the Family Educational Rights and Privacy Act (FERPA). A downloaded form addresses a slice of one.
What Illinois law does without any documents
Start with the default, because it frames what the documents actually add.
A parent cannot direct care or demand records for a capable adult student. If the student loses decisional capacity and no health care agent is available, the Illinois Health Care Surrogate Act, 755 ILCS 40/25, directs providers to a surrogate in a fixed order: a guardian, then a spouse, then adult children, then parents. For a typical unmarried student, that puts a parent next in line after any guardian.
So the documents are not the difference between authority and nothing. They're the difference between authority the student chose and a default that arrives only after incapacity, excludes some decisions an agent could make, and can leave two parents at the same priority level, where the Act's tiebreakers may not resolve a dispute about an adult child. Neither document is legally required. Each is a choice the student can make about who acts and when.
Illinois treats these as two separate instruments
The Illinois Power of Attorney Act creates two. Article IV governs the health care power. Article III governs the property power. Everything below concerns the Illinois statutory short forms, which is what nearly every family signs.
The statutory health care form requires one witness and no notary. The property power requires both a witness and a notary, and the notary cannot also serve as the witness.
On litigation: a property power may authorize the agent to manage claims, retain attorneys, and settle matters under Section 3-4(j). It does not authorize a parent or any other nonlawyer agent to appear in court as the student's attorney or otherwise practice law.
The box most families leave blank
The current Illinois statutory health care form asks the student to select one of three options for when the agent's authority begins. If no box is checked, the first option applies.
Under the first option, the agent may make health care decisions only after the treating physician determines the student lacks decisional capacity. Unlike the second option, it grants no immediate record-access or provider-communication authority. HIPAA may still permit a provider to share limited information with family involved in the student's care in particular circumstances, but the parent has no enforceable right under that power of attorney while the student remains capable.
The second option keeps the incapacity trigger for treatment decisions and adds, effective immediately, complete access to medical and mental health records, authority to share them, and the ability to communicate directly with the student's physicians. The third option grants decision-making authority immediately while preserving the student's own right to decide.
For most college families, the second option is the one that matches what they think they signed up for. The difference between the first and second box is the difference between a document that activates during a catastrophe and one that works on a Tuesday afternoon.
The witness rules that catch kitchen-table signings
The statutory health care form requires the witness to certify, among other things, that they are not the agent or a successor agent and not related to the student, the agent, or any successor agent by blood, marriage, or adoption. The witness must be able to make every certification printed on the form truthfully. At a family signing, Mom is the agent, Dad is the successor, and the sibling is related to all three. Nobody at that table qualifies.
The property power reaches further. Under 755 ILCS 45/3-3.6, no parent, sibling, or descendant of either the student or any agent may witness, nor may the spouse of any of them, and the same disqualifications apply to the notary.
A defective property power may be ineffective, and a third party may properly refuse it. A statutory health care form with a disqualified witness may be invalid or rejected. Either way, the failure surfaces at the moment the document is needed, in front of a hospital or bank risk officer with every incentive toward caution.
A HIPAA release may not open the campus health center
Under joint guidance issued by the Department of Health and Human Services and the Department of Education in December 2019, records held by a FERPA-covered, college-run clinic are generally not protected health information at all. They're education records or treatment records under FERPA, which are excluded from the HIPAA Privacy Rule. A university hospital or another legally separate provider may instead operate under HIPAA, so the line runs between entities, not campuses.
For FERPA records, access requires FERPA-compliant consent: a signed, dated writing identifying the records, the purpose, and the recipient, under 34 C.F.R. § 99.30. The school's own portal release is the practical route, and most schools hand it out at orientation, but the regulation, not the school's form, sets the requirement.
FERPA rights transfer to the student at eighteen or upon postsecondary enrollment, whichever comes first. The dependency exception is permissive: a school may disclose to parents of a tax dependent, but it doesn't have to. FERPA also contains health-and-safety emergency exceptions, which are the school's call, not the parent's.
A HIPAA authorization matters for providers that are covered entities, like the hospital across town. Even there, an authorization ordinarily permits disclosure within its terms rather than compelling it. It's a key, not a subpoena.
Illinois mental health records follow their own statute
The Illinois Mental Health and Developmental Disabilities Confidentiality Act imposes requirements a generic HIPAA authorization may not satisfy. Under current 740 ILCS 110/5, a consent must be written and signed and must identify the person or agency receiving the disclosure, its purpose, the nature of the information, the right to inspect and copy it, any consequences of refusing, a calendar expiration date, and the right to revoke. If no expiration date is stated, disclosure is limited to the day the therapist receives the consent. Illinois removed the former witness requirement effective August 15, 2025. Blanket consent to unspecified information is generally invalid, and a recipient generally may not redisclose without specific consent.
A health care agent whose authority is active does receive mental health record access, under 740 ILCS 110/4(a)(6) and Sections 4-7(c) and 4-10(c)(4) of the Power of Attorney Act. That access is real, and it arrives on whatever schedule the activation box sets.
For a family with a specific mental health concern, Illinois also offers a Declaration for Mental Health Treatment under 755 ILCS 43. It's narrow, covering psychotropic medication, electroconvulsive therapy, and admission for up to seventeen days, and it generally runs for three years unless the student is incapacitated when it would expire. Worth discussing when the facts call for it.
If the school is out of state
If the student will receive care outside Illinois, the destination state's law and the provider's procedures control recognition. The Illinois statutory form expressly revokes all earlier health care powers of attorney, and a later out-of-state form may revoke or conflict with the Illinois document depending on its language and governing law. Before signing another state's form, coordinate the instruments so the student doesn't unintentionally revoke one or create conflicting directives. Additional witnesses or notarization may help with proof, but they don't guarantee recognition.
What a working package looks like
For an Illinois student: a statutory health care power with the activation option the student actually wants and a qualified witness. A property power, properly witnessed and notarized, with the Section 2-8 agent certification form kept on hand for the agent to complete when a bank requests it, not pre-signed. A HIPAA authorization for off-campus covered providers. A FERPA-compliant consent, most easily through the school's portal. And a conversation, because the documents carry the student's instructions, not the parents'.
The student signs all of it, and if a lawyer prepares the package, the student is the client. Parents can pay the fee, with the student's informed consent and the protections Illinois professional conduct rules require. That structure is what makes the documents hold up, because every one of them speaks in the student's voice.
If your student is headed to campus this fall, a Family Future Planning Session is the place to build the package correctly, before the forms are needed.
This article is general information about Illinois law and is not legal advice. Reading it does not create an attorney-client relationship. Statutes and federal privacy rules change, and the right approach depends on your family's facts. Mahou Law LLC represents clients throughout Illinois from its office in Oak Park.
