The HIPAA law provides privacy protections for the patient, not the friends and family members of the patient, and imposes strict disclosure limitations and penalties on health care providers who violate the medical record disclosure protections embodied in the law. A HIPAA qualified protective order is a mechanism that allows a person other than the patient to obtain access to the patient's private medical records and information which the medical care provider otherwise cannot disclose. It is not used to bar or prevent others from obtaining that same information--because without an order permitting it, the medical care provider cannot disclose it. Such an order is usually needed for litigation where the patient's medical information is relevant to the issues in the case, and parties not otherwise entitled to obtain and review that information need access to it to defend or pursue their case. the order sets forth restrictions, limitations and guidelines on how a party may obtain, use, disclose and then return or destroy the information at the end of the litigation so as not to violate the patient's privacy more than is absolutely necessary for the litigation. In most cases, however, the patient would grant somebody a medical power of attorney to handle their medical care and obtain information in the absence of their ability to do so. It sounds like the woman did not have such a document prepared. The alternative is for an interested family member to petition a court to be appointed the woman's personal guardian to make these medical care decisions and have access to the records. There is also a default statutory scheme that grants family members, in a strict order of priority, to make decision on behalf of a disabled person in the absence of a power of attorney or guardianship. It sounds as though the mother obtained a court order to have access, but the father did not. It may not have been necessary to do so under the Maryland law, but federal law (which HIPAA is) trumps any conflicting state law. It sounds as though the hospital is afraid to violate HIPAA by granting the father access without some legal protection, such as a court order. the father will have to either petition for his own order, or petition to be appointed guardian. He can also petition to modify the mother's order so as to allow him equal access. he will not get the hospital staff to violate a court order if it actually prohibits him from having access (a strange provision if indeed it is in the order). The father needs a lawyer who deals with guardianship matters.