What is a HIPAA authorization form and when is it needed?

A HIPAA authorization form is written permission from a patient allowing a healthcare provider to release their Protected Health Information (PHI) to a specified third party. It's required when releasing records to family members, attorneys, employers, insurance companies, or other entities not involved in the patient's treatment, payment, or healthcare operations.

What must a valid HIPAA authorization include?

Valid authorizations must include: description of information to be disclosed, who may disclose and receive the information, purpose of disclosure, expiration date or event, patient's signature and date, statement of right to revoke, and statement that information may be re-disclosed. The authorization must be written in plain language the patient can understand.

Can a patient revoke a HIPAA authorization?

Yes. Patients can revoke authorization at any time by submitting a written revocation to the provider. However, revocation does not apply to information already disclosed before the revocation was received. Providers should document the date revocation was received and cease any further disclosures.

What disclosures do NOT require patient authorization under HIPAA?

Authorization is not required for: treatment purposes between providers, payment activities, healthcare operations, disclosures required by law, public health activities, abuse/neglect reporting, health oversight activities, judicial/administrative proceedings, law enforcement purposes, and certain research activities with IRB approval.

How long is a HIPAA authorization valid?

The authorization must include an expiration date or expiration event. If no date is specified, many states default to one year. For authorizations related to research, the authorization may state 'end of the research study.' Providers should not honor authorizations that have expired or lack expiration information.

HIPAA Release Form Template | Free Download 2026

Quick-Use Checklist

Use this checklist before finalizing documentation.

Confirm visit context, chief concern, and date/time of service before note completion.

Capture required exam/findings and plan elements that support coding specificity.

Document medical decision making clearly to reduce denials and audit risk.

HIPAA AUTHORIZATION FOR RELEASE OF INFORMATION Patient Name: [Patient Name] Date of Birth: [Date of Birth] I. Authorization:

I hereby authorize [Practice Name] to release my Protected Health Information (PHI) as described below.

II. Recipient:

The information may be released to:
* Name: [Recipient Name]
* Relationship: [e.g., Spouse, Lawyer, New Doctor]
* Address/Phone: [Recipient Contact Info]

III. Information to be Released:

[ ] Complete Medical Record
[ ] Progress Notes from [Date] to [Date]
[ ] Lab Reports
[ ] Radiology Reports
[ ] Other: [Specify]

IV. Purpose:

The purpose of this release is: [e.g., At the request of the patient / Continuing Care / Legal]

V. Expiration:

This authorization will expire on [Date] or [Event]. If left blank, it will expire one year from the date of signature.

VI. Rights:

I understand that I have the right to revoke this authorization at any time by sending a written request. I understand that the revocation will not apply to information that has already been released.

Signature: __________________________ Date: _____________

[Patient Name]

Witness: __________________________ Date: _____________

Administrative — HIPAA Release Form

Quick-Use Checklist

Template

Related templates

Automate Your Documentation

Related resources