# HIPAA authorization for use or disclosure of protected health information (template)

> **Review with counsel before use.** This is a starting template, not legal advice. State law can add requirements (for example for mental health, substance use disorder, HIV or genetic records), and psychotherapy notes and marketing uses have extra rules. Have your attorney adapt it before you give it to a patient.
>
> Source: the required elements and statements in 45 CFR 164.508(c). Template from AccuSights, https://accusights.com/templates

---

**Practice or plan name:** ______________________________________

**Patient name:** ______________________________  **Date of birth:** ____________

**Medical record or member number (optional):** ______________________

## 1. Information to be used or disclosed

Describe the information specifically (for example "lab results from 1 March to 30 June 2026", not "all records"):

____________________________________________________________________

____________________________________________________________________

## 2. Who may disclose the information

Name or specific description of the person or organization authorized to disclose it:

____________________________________________________________________

## 3. Who may receive the information

Name or specific description of the person or organization that may receive it:

____________________________________________________________________

## 4. Purpose of the disclosure

Describe each purpose. If the patient is asking for the disclosure and does not want to state a reason, "at the request of the individual" is enough.

____________________________________________________________________

## 5. Expiration

This authorization expires on (date) ______________ or when this event happens: ______________________________

## 6. Your rights (required statements)

- **You may revoke this authorization** at any time by writing to: ______________________________ (name and address). Revoking it does not undo any use or disclosure already made in reliance on it. *(Alternatively, refer to the section of the notice of privacy practices that explains how to revoke.)*
- **Treatment, payment, enrollment or eligibility** *(keep the sentence that applies and delete the other)*:
  - We will not condition your treatment, payment, enrollment or eligibility for benefits on whether you sign this authorization.
  - *[Only where the rule allows conditioning, for example research-related treatment or pre-enrollment underwriting:]* We may condition ______________ on your signing this authorization because ______________________. The consequences of refusing to sign are: ______________________.
- **Redisclosure:** information disclosed under this authorization may be redisclosed by the person who receives it and may no longer be protected by federal privacy rules.
- **You will receive a copy** of this authorization once it is signed.

## 7. Signature

Signature of patient or personal representative: ______________________________

Date: ____________

If signed by a personal representative, print name and describe the authority to act for the patient (for example parent of a minor, court-appointed guardian, health care power of attorney):

____________________________________________________________________

---

## Checklist for the practice (remove before giving to the patient)

- [ ] Written in plain language (45 CFR 164.508(c)(3))
- [ ] All six core elements are filled in: information, who discloses, who receives, purpose, expiration, signature and date (164.508(c)(1))
- [ ] All three required statements are present: right to revoke, conditioning, redisclosure (164.508(c)(2))
- [ ] Not combined with another document unless the rule allows it (164.508(b)(3))
- [ ] A copy goes to the patient (164.508(c)(4))
- [ ] The signed form is kept for six years (164.316 and 164.530(j))
- [ ] Counsel has reviewed the form for your state

More HIPAA guides: https://accusights.com/frameworks/hipaa