What options and disclosures are required in a HIPAA release?
A HIPAA release is generally a written authorization. It must contain specified core elements and disclosures required by 45 C.F.R. § 164.508(c) [1].
Required Information
| Requirement | What the release must identify |
|---|---|
| Information disclosed | A specific, meaningful description of the PHI—not merely “all records” unless sufficiently particularized |
| Disclosing party | The person or class of persons authorized to use or disclose the information |
| Recipient | The person or class of persons authorized to receive it |
| Purpose | Each purpose for the use or disclosure; “at the request of the individual” is sufficient where applicable |
| Expiration | An expiration date or event tied to the individual or purpose |
| Signature | The individual’s signature and date; a representative must describe authority to act |
45 C.F.R. § 164.508(c)(1) [1]
Required Notices or “Options”
The authorization must also state:
- Right to revoke. The individual may revoke the authorization in writing, subject to disclosures already made and any other applicable exceptions. The release must explain how to revoke it or refer to the covered entity’s notice of privacy practices.
- Whether treatment or benefits may be conditioned. It must state either that treatment, payment, enrollment, or eligibility will not be conditioned on signing, or explain the consequences of refusing where conditioning is legally permitted.
- Redisclosure risk. Information disclosed may be redisclosed by the recipient and may no longer be protected by HIPAA.
45 C.F.R. § 164.508(c)(2) [1]
The authorization must be written in plain language, and the covered entity must provide the individual a copy of the signed authorization. 45 C.F.R. § 164.508(c)(3)–(4) [1]
Special Disclosures
- Marketing: If the disclosure involves remuneration to the covered entity from a third party, the authorization must state that remuneration is involved. 45 C.F.R. § 164.508(a)(3), (c) [1]
- Sale of PHI: The authorization must state that the disclosure will result in remuneration to the covered entity. 45 C.F.R. § 164.508(a)(4)(ii) [1]
- Psychotherapy notes: A separate authorization is generally required, subject to limited regulatory exceptions. 45 C.F.R. § 164.508(a)(2) [2]
- Research: The authorization may use “none” or a similar expiration provision when appropriate for research, including creation or maintenance of a research database or repository. 45 C.F.R. § 164.508(c)(1)(v) [1]
A covered entity may not rely on an authorization that is incomplete, expired, revoked, or materially false. 45 C.F.R. § 164.508(b)(2) [1]