HIPAA Authorization Form Generator
Authorize a doctor, hospital, or health plan to release your health information to a person or organization you choose. The form includes every core element and required statement listed in the HIPAA Privacy Rule at 45 CFR 164.508(c), and it will not produce a PDF until each one is filled in. Free, in English or Spanish, and it runs in your browser.
A self-help form, not legal advice.
An authorization permits a provider or plan to disclose; it does not require them to. Some will ask you to sign their own form instead. RecordingLaw.com is not a law firm.
Fill in every required item to download this form:
- Patient’s name
- Who has the records (164.508(c)(1)(ii))
- Who receives the records (164.508(c)(1)(iii))
- What information may be released (164.508(c)(1)(i))
- Expiration date or event (164.508(c)(1)(v))
Everything runs in your browser. Nothing you type is sent to or stored on our server.
Authorization for Use or Disclosure of Protected Health Information
This form is written under the HIPAA Privacy Rule, 45 CFR 164.508.
Patient
Name: [REQUIRED: patient’s name]
1. Who may disclose the information
I authorize [REQUIRED: name of the provider or plan that holds the records] to use or disclose the information described below.
2. Who may receive the information
The information may be disclosed to [REQUIRED: name of the person or organization to receive the records].
3. Information to be used or disclosed
[REQUIRED: describe the information to be disclosed]
4. Purpose
The information is to be used or disclosed for: at the request of the individual.
5. Expiration
[REQUIRED: expiration date or event]
6. My right to revoke this authorization
I may revoke this authorization at any time by giving written notice to [REQUIRED: name of the provider or plan that holds the records]. My revocation will not apply to information already used or disclosed in reliance on this authorization. If this authorization was obtained as a condition of obtaining insurance coverage, other law may give the insurer the right to contest a claim under the policy or the policy itself even after I revoke.
7. Treatment, payment, enrollment, and eligibility
The covered entity may not condition my treatment, payment, enrollment in a health plan, or eligibility for benefits on whether I sign this authorization.
8. Redisclosure
Information disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by the federal HIPAA Privacy Rule.
9. Signature
The patient or representative should keep a copy of this signed authorization.
Signature: ______________________________ Date: ____________
Printed name: [REQUIRED: patient’s name]
Before you sign
An authorization permits the provider or health plan to disclose the information; it does not require the disclosure (HHS). If you want copies of your own records, the right of access under 45 CFR 164.524 is a separate written request that, unlike an authorization, requires the provider or plan to act, generally no later than 30 days after receiving it (HHS).
Psychotherapy notes need their own authorization. HIPAA allows an authorization for psychotherapy notes to be combined only with another psychotherapy-notes authorization, so use a separate form for any other records (45 CFR 164.508(a)(2) and (b)(3)(ii)).
The Privacy Rule does not require an authorization to be notarized or witnessed (HHS). A provider may still ask you to sign its own form.
Among the defects listed in 45 CFR 164.508(b)(2), an authorization is not valid if its expiration date has passed, if a required element is left blank, or if the provider or plan knows it has been revoked. Fill in every field before signing.
Records from a federally assisted substance use disorder program are also governed by 42 CFR Part 2, which has its own consent requirements (42 CFR 2.31). State laws that give health information more privacy protection than HIPAA still apply (45 CFR 160.203(b)).
Treating providers may share information with each other for treatment without your authorization (HHS, citing 45 CFR 164.506). Psychotherapy notes are an exception: they need an authorization for most uses and disclosures (45 CFR 164.508(a)(2)).
What HIPAA Requires in an Authorization
Under 45 CFR 164.508(c)(1), an authorization must contain at least these core elements, and this generator includes each one:
- a description of the information to be used or disclosed that identifies it in a specific and meaningful way;
- the name or other specific identification of the person or class of persons authorized to make the disclosure;
- the name or other specific identification of the person or class of persons who may receive it;
- a description of each purpose ("at the request of the individual" is enough when you start the request and choose not to give a purpose);
- an expiration date or an expiration event that relates to you or to the purpose; and
- your signature and the date, and, if a personal representative signs, a description of their authority to act for you.
Section 164.508(c)(2) adds three statements the form must contain: your right to revoke the authorization in writing, with the exceptions and how to revoke; whether treatment, payment, enrollment, or eligibility for benefits can be conditioned on signing (and, if so, the consequences of refusing); and that information disclosed under the authorization may be redisclosed by the recipient and no longer protected by the Privacy Rule. The form must also be written in plain language.
Two further statements apply only in specific cases, and the generator adds the right one when you check the box: a marketing authorization must say when a third party is paying the covered entity, and an authorization for a sale of health information must say that the disclosure will result in payment to the covered entity.
A blank matters. Among the defects listed in section 164.508(b)(2), an authorization is not valid if it has not been filled out completely with respect to a required element, if its expiration date has passed, or if the provider or plan knows it has been revoked. That is why the download stays disabled until every required item is filled in and the expiration date is not in the past.
Psychotherapy Notes
Psychotherapy notes are a narrow category: notes a mental health professional records about the contents of a counseling session and keeps separate from the rest of the medical record. They do not include medication records, session times, test results, or summaries of diagnosis, treatment plan, symptoms, or progress (45 CFR 164.501). HIPAA requires an authorization for most uses and disclosures of psychotherapy notes (164.508(a)(2)), and an authorization for psychotherapy notes may be combined only with another psychotherapy-notes authorization (164.508(b)(3)(ii)). The generator's psychotherapy-notes option makes a form that covers those notes and nothing else.
What This Form Does Not Do
- It does not require anyone to release your records. HHS explains that an authorization permits, but does not require, a covered entity to disclose (HHS FAQ).
- It is not a records request for yourself. Your right of access under 45 CFR 164.524 is a separate written request, and HHS notes the provider must generally act on it no later than 30 days after receiving it.
- It does not satisfy extra rules for some records. Substance use disorder program records are also governed by 42 CFR Part 2 and its own consent requirements (42 CFR 2.31), and a state law that protects health information more strictly than HIPAA still applies (45 CFR 160.203(b)).
- It does not need a notary or witness, because HHS says the Privacy Rule does not require one (HHS FAQ 478), so the form has no notary block.
For more on how HIPAA works, see our HIPAA laws guide.
Disclaimer: General legal information, not legal advice. The provider or plan decides whether to act on an authorization.
Frequently Asked Questions
Does a HIPAA authorization need to be notarized or witnessed?
No. HHS says the Privacy Rule does not require that an authorization be notarized or witnessed. A provider or plan may still have its own form it prefers you to use.
Do I need this form to get my own medical records?
Not necessarily. Getting your own records is your right of access under 45 CFR 164.524, a separate written request that the provider must act on, generally within 30 days. An authorization is the tool for letting a provider or plan disclose your information to someone else for a purpose they are not otherwise permitted to.
Why do psychotherapy notes need a separate form?
HIPAA requires an authorization for most uses and disclosures of psychotherapy notes, and an authorization for psychotherapy notes may only be combined with another authorization for psychotherapy notes. Turn on the psychotherapy-notes option to make a form that covers those notes only, and use a second form for any other records.
Can I cancel the authorization later?
Yes. You can revoke it in writing at any time, except to the extent the provider or plan already acted in reliance on it, or, if it was a condition of getting insurance, where other law lets the insurer contest a claim. The form tells the reader where to send a revocation.
Is anything I type saved?
No. The form is built in your browser and the PDF is created on your device. Nothing you type, including any health details, is sent to or stored on our server.
Sources
- 45 CFR 164.508, Uses and disclosures for which an authorization is required (eCFR)
- 45 CFR 164.501, Definitions (psychotherapy notes) (eCFR)
- 45 CFR 160.203, Preemption: general rule and exceptions (eCFR)
- 42 CFR 2.31, Consent requirements (eCFR)
- HHS FAQ: Does the Privacy Rule require that an authorization be notarized or include a witness signature?
- HHS FAQ: Right of access compared with a HIPAA authorization
Know someone who could use this? Share this free tool: