HIPAA Authorization Form

A HIPAA Authorization Form in the United States grants documented consent to the action it describes, on the conditions it states.

HIPAA's Privacy Rule (45 CFR Parts 160 and 164) establishes that covered entities may not use or disclose PHI without patient authorization except in specifically enumerated circumstances — such as treatment coordination between providers, claims processing, public health reporting, and law enforcement requests supported by court orders. For all other uses and disclosures, including releasing records to attorneys, life insurance companies, employers (outside of workers' compensation), family members who are not personal representatives, and researchers, a valid HIPAA authorization is required.

The authorization differs from a general consent to treatment, which healthcare providers typically obtain at intake. While consent to treatment permits providers to use PHI for ongoing care, the HIPAA authorization is a separate, more specific document that addresses disclosures beyond the treatment relationship. Under 45 CFR Section 164.508(b)(1), covered entities may not condition treatment, payment, enrollment, or eligibility on the patient signing an authorization, except in limited circumstances involving research or pre-enrollment underwriting.

A HIPAA authorization is required whenever a patient wants medical records sent to a third party outside the treatment relationship. The most common scenario is personal injury litigation, where an attorney needs the client's medical records, imaging studies, and billing statements to support a claim. Insurance companies conducting pre-enrollment medical underwriting or processing life insurance applications also require HIPAA authorizations to obtain an applicant's health history from treating physicians.

Employers requesting medical information beyond what is permitted under the Americans with Disabilities Act (ADA) or the Family and Medical Leave Act (FMLA) need a HIPAA authorization — for instance, when an employee voluntarily participates in a workplace wellness program that requires access to medical records. Disability insurance carriers, both short-term and long-term, require authorizations to verify claimants' medical conditions with their healthcare providers.

Other frequent use cases include parents requesting records for adult children (who are no longer covered by the parental access exception after age 18), patients transferring care to a new provider in a different health system, researchers recruiting subjects for clinical trials (unless an IRB has granted a waiver of authorization under 45 CFR Section 164.512(i)), and patients seeking to release their own psychotherapy notes — which receive heightened protection under 45 CFR Section 164.508(a)(2) and require a separate, specific authorization even from the patient.

Under 45 CFR Section 164.508(c), a valid HIPAA authorization must contain specific core elements to be enforceable. The document must identify the patient by name, date of birth, and other identifying information, and must specify the covered entity (or class of entities) authorized to make the disclosure. The authorized recipient — the person or organization who will receive the PHI — must also be specifically identified rather than stated in general terms.

The authorization must include a specific and meaningful description of the information to be disclosed. Vague language such as "all medical records" may be acceptable in some contexts, but more specific descriptions — such as "office visit notes, lab results, and diagnostic imaging from January 2024 through present relating to treatment of lumbar spine condition" — are preferred and may be required by state laws that impose stricter standards than HIPAA's floor. The purpose of the disclosure must be stated (or may indicate "at the request of the individual").

The authorization must contain an expiration date or expiration event (such as "upon resolution of the legal claim"), a statement of the patient's right to revoke the authorization in writing at any time (with the caveat that revocation does not affect disclosures already made in reliance on the authorization), and a statement that information disclosed pursuant to the authorization may be subject to re-disclosure by the recipient and no longer protected by HIPAA. The document requires the patient's signature and date — or the signature of the patient's personal representative with a description of their authority (such as healthcare power of attorney or court-appointed guardian). Psychotherapy notes, HIV/AIDS records, substance abuse treatment records (42 CFR Part 2), and genetic information may require separate or additional authorization language under federal and state law.