What is required for a valid HIPAA authorization form?

Under the Health Insurance Portability and Accountability Act (HIPAA), a valid authorization for the release of protected health information (PHI) must comply with the requirements set forth in 45 C.F.R. § 164.508. A covered entity may not release PHI for purposes not otherwise permitted by HIPAA unless such a written authorization is executed that satisfies each required element.

Issue

What specific components are required for an authorization for release of information form to be valid under HIPAA?

Rule

Pursuant to 45 C.F.R. § 164.508(c)(1), a valid authorization for the use or disclosure of PHI must contain all of the following core elements:

1. Description of the Information: A specific and meaningful description of the information to be used or disclosed.
2. Identifying Parties: The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.
3. Recipient Identification: The name or other specific identification of the person(s), or class of persons, to whom the covered entity may disclose the information.
4. Purpose: A description of each purpose of the requested use or disclosure. If the individual initiates the authorization, a statement such as “at the request of the individual” is sufficient.
5. Expiration: An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure.
6. Signature and Date: The individual’s signature and the date. If the authorization is signed by a personal representative, a description of that person’s authority to act for the individual must also be included.

Under 45 C.F.R. § 164.508(c)(2), additional required statements must accompany the core elements:

1. Right to Revoke: A statement of the individual’s right to revoke the authorization in writing and either (a) the exceptions to the right to revoke, or (b) a statement describing how the individual may revoke it.
2. Conditioning of Treatment: A statement about whether the covered entity may condition treatment, payment, or enrollment/eligibility for benefits on the authorization, and if so, the consequences.
3. Redisclosure Warning: A statement that the information disclosed under the authorization may be subject to redisclosure by the recipient and may not be protected by HIPAA privacy rules.

Analysis

The authorization must be written in plain language, and the covered entity must provide a copy of the signed form to the individual, as required by 45 C.F.R. § 164.508(c)(3). Certain disclosures, such as those involving marketing or the sale of PHI, require that the authorization specifically state the presence of financial remuneration to the entity from a third party (see 45 C.F.R. § 164.508(a)(3)(ii), (a)(4)(ii)).[1][2]

Failure to meet any of these requirements renders the authorization invalid, making any resulting disclosure a potential HIPAA violation.

Conclusion

A legally valid HIPAA authorization for release of PHI must include six core elements—description of information, identifying parties, purpose, expiration, signature/date, and representative authority (if applicable)—plus three required statements about revocation rights, treatment conditions, and redisclosure risks. Compliance with these detailed requirements ensures the authorization is valid under 45 C.F.R. § 164.508.