What Must a HIPAA Authorization Include?

A valid HIPAA authorization must describe the information to be used or disclosed, name who may make the requested use or disclosure and who may receive it, state the purpose, include an expiration date or event, and be signed and dated. It must also include required statements on revocation, conditioning of treatment, payment, enrollment or eligibility, and possible redisclosure.

When an authorization is needed. A covered entity needs a written authorization for uses and disclosures not otherwise permitted or required by the Privacy Rule (45 CFR 164.508(a)). Authorizations are specifically required for most uses of psychotherapy notes, for marketing, and for sales of PHI, with limited exceptions.

Core elements (45 CFR 164.508(c)(1)).

• A specific and meaningful description of the information to be used or disclosed.
• The name or other specific identification of the persons authorized to make the requested use or disclosure, and of the persons to whom the covered entity may make the requested use or disclosure.
• A description of each purpose. "At the request of the individual" is sufficient when the individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.
• An expiration date or an expiration event that relates to the individual or the purpose. Specified research authorizations may use "end of the research study" or "none" (164.508(c)(1)(v)).
• The individual's signature and date, or a representative's signature with a description of authority.

Required statements (45 CFR 164.508(c)(2)). The authorization must state the right to revoke in writing, with the exceptions to that right and how to revoke, or refer to the Notice of Privacy Practices if it contains that information. It must state the covered entity's inability to condition treatment, payment, enrollment or eligibility on signing, or the consequences of refusal where conditioning is permitted. It must state the potential that disclosed information may be redisclosed by the recipient and no longer be protected by the Privacy Rule.

Plain language and copy. It must be written in plain language, and the covered entity must give the individual a copy of the signed authorization when it seeks authorization from the individual.

More than a checklist. Additional requirements can apply, including remuneration statements for specified marketing or sale authorizations (164.508(a)(3)(ii), (a)(4)(ii)). Rules on defective authorizations, compound authorizations, and conditioning in 164.508(b) also govern validity; a checklist alone does not establish validity.

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."