HIPAA Patient Authorization Form

What a HIPAA Authorization Should Address

A valid HIPAA authorization generally includes required elements identifying what information may be used or disclosed, who may make the disclosure, who may receive the information, the purpose, an expiration date or event, and the individual’s signature and date.

• ✔ Description of the information to be used or disclosed
• ✔ Identification of the person or organization authorized to disclose it
• ✔ Identification of the intended recipient
• ✔ Purpose of the requested use or disclosure
• ✔ Expiration date or expiration event
• ✔ Signature and date
• ✔ Additional authorization statements required by HIPAA, as applicable

When May a HIPAA Authorization Be Required?

HIPAA authorization is generally required for uses or disclosures of PHI that are not otherwise permitted or required by the HIPAA Privacy Rule.

Depending on the circumstances, authorization may be relevant when:

• An individual authorizes disclosure of specified PHI to a specified third party
• A covered entity uses or discloses PHI for certain purposes outside treatment, payment, or healthcare operations
• Certain uses or disclosures involve psychotherapy notes, subject to HIPAA exceptions
• Certain marketing uses or disclosures require authorization

Authorization Is Not Required for Every Disclosure

HIPAA permits or requires some uses and disclosures of PHI without an individual authorization. Whether authorization is required depends on the purpose, the parties involved, and the applicable HIPAA provision.

For example, disclosures involving a business associate may be governed by applicable HIPAA requirements and a Business Associate Agreement rather than a patient authorization.

If you are unsure whether an authorization is required, review the applicable HIPAA Privacy Rule requirements or seek qualified legal or compliance guidance.

What This Template Includes

• ✔ Editable HIPAA Patient Authorization format
• ✔ Fields for the information being authorized
• ✔ Fields for the disclosing party and recipient
• ✔ Purpose and expiration fields
• ✔ Signature and date section
• ✔ Designed as a practical starting template for healthcare practices

Organizations should review and adapt the form to their specific circumstances and applicable legal requirements.

A Form Is Only One Part of HIPAA Compliance

HIPAA compliance may also involve Privacy and Security policies, risk analysis, access controls, devices, vendors, Business Associate Agreements, workforce training, incident procedures, and documentation.

Review the HIPAA Compliance Checklist for a broader overview.

Review Your HIPAA Practices

Use the guided HIPAA Compliance Assessment to review key requirements, identify potential gaps, and receive recommended next steps.

Legal and Compliance Disclaimer: This template and related content are provided for general informational and compliance-support purposes only. They do not provide legal advice, guarantee that a particular authorization is valid for every use case, certify HIPAA compliance, or constitute approval by HHS or OCR.