HIPAA authorization
When you need a patient's written authorization to use or share their health information, what the form must contain to be valid, and how patients can revoke it.
HIPAA authorization at a glance
A HIPAA authorization is a patient's signed permission to use or disclose their protected health information for a purpose HIPAA does not otherwise allow — for example, often when an employer, lawyer or life insurer asks for records and no other HIPAA permission (such as a court order or a law requiring the disclosure) applies. Under 45 CFR 164.508 it must describe the information, who discloses it and who receives it, the purpose, an expiration date or event, and the patient's signature, plus required statements on revocation, conditioning and redisclosure.
| Rule | HIPAA Privacy Rule, 45 CFR 164.508 |
|---|---|
| Needed for | Uses and disclosures not otherwise permitted — not for treatment, payment or health care operations |
| Always needed for | Most uses of psychotherapy notes, marketing, sale of PHI |
| Core elements | Information, who discloses, who receives, purpose, expiration, signature and date |
| Patient rights | Revoke in writing at any time; receive a copy if you asked them to sign |
| Invalid if | Expired, incomplete, known to be revoked or false, or improperly combined with other documents |
Most of the time, a practice can use and share patient information without asking for permission: for treatment, payment and health care operations (45 CFR 164.506), and for a list of other purposes the Privacy Rule permits. An authorization is required for everything else (164.508(a)(1)) — and always for most uses of psychotherapy notes, for marketing, and for the sale of PHI.
What a valid authorization must contain
Under 164.508(c)(1), at least:
- What information will be used or disclosed, described specifically.
- Who is authorized to disclose it.
- To whom it may be disclosed.
- The purpose of each use or disclosure. “At the request of the individual” is enough when the patient initiates it.
- An expiration date or event.
- The patient’s signature and date, plus a description of authority if a personal representative signs.
And statements (164.508(c)(2)) telling the patient:
- they can revoke it in writing, with any exceptions and how to do it (or a reference to your Notice of Privacy Practices if it explains this);
- whether treatment, payment, enrollment or eligibility can or cannot be conditioned on signing;
- that information disclosed under it may be redisclosed by the recipient and no longer be protected by HIPAA.
It must be in plain language, and if you asked the patient to sign it, you must give them a copy (164.508(c)(3)–(4)).
When an authorization is not valid
A form is defective if it has expired, is missing a required element, is known to have been revoked, contains information known to be false, or was improperly combined with another document — a “compound authorization” (164.508(b)(2)–(3)).
Revocation
Patients can revoke an authorization at any time, in writing, except to the extent you have already acted on it (164.508(b)(5)).
Practical tips for a small practice
- Use one standard form and check every element before relying on a signed copy.
- Don’t fold the authorization into intake paperwork — keep it a separate document.
- Store signed authorizations and revocations; HIPAA documentation must be kept for six years.
- When a patient asks for their own records, that is a right-of-access request, not an authorization.
Guides
- HIPAA compliance checklist →A practical HIPAA checklist for small practices and business associates, with each item linked to the rule behind it — not a list of things to buy.
- HIPAA patient rights →The rights HIPAA gives patients over their health information, with deadlines, and what a practice must do to honor each one.
- HIPAA release form →What a HIPAA release form is, when a practice actually needs one, the fields it must contain to be valid, and the most common mistakes.
Related requirements
Frequently asked questions
Is a HIPAA authorization the same as a HIPAA release form?
Yes, in practice. "Release form" is the everyday name; "authorization" is the term in the regulation. Either way, the document has to contain the elements in 45 CFR 164.508(c).
Do patients need to sign an authorization for me to share records with another provider treating them?
No. Disclosures for treatment, payment and health care operations are permitted without an authorization. Authorizations are for purposes outside those and the other permissions in the rule — often disclosures to employers, lawyers or life insurers.
Can I refuse treatment if a patient won't sign an authorization?
Generally no. A covered entity may not condition treatment, payment, enrollment or eligibility for benefits on signing an authorization, with narrow exceptions such as research-related treatment.
How long is a HIPAA authorization valid?
Until the expiration date or event stated in it. HIPAA does not set a maximum period, but the authorization must include one, and the patient can revoke it in writing at any time.