Authorization to Release Patient Information: Elements and Statements

A valid authorization to release patient information must contain six specific elements and three required statements set out in the HIPAA Privacy Rule at 45 CFR § 164.508, plus a signature and date. If any one of them is missing, the provider holding your records is required to refuse the disclosure, so the form is worth checking carefully before you submit it.¹

The Six Core Elements

Every authorization has to include all six of these. Leave one out and the form is incomplete on its face.

A specific description of the information. Identify what is being released in a specific and meaningful way. “All medical records” is acceptable if that is what you want, but you can narrow it to a date range, a specific condition, or just billing records.
The person or organization authorized to disclose. Name the holder of the records: a specific doctor, a hospital, a health plan, or a class such as “all providers who treated me at XYZ Medical Center.”
The person or organization that will receive the information. Name the recipient or a class of recipients. The regulation does not require a mailing address or phone number, though providers often ask for contact details so they can actually route the records.
The purpose of each disclosure. Describe why the records are being released. If you are the one initiating the request and do not want to explain your reasons, the phrase “at the request of the individual” is expressly permitted.
An expiration date or event. The authorization needs an endpoint, either a calendar date or an event such as “when the insurance claim for my January 2026 surgery is resolved.” For research authorizations, “end of the research study” or “none” is acceptable.
Signature and date. You have to sign and date it. If someone signs on your behalf, the form must also describe that person’s authority to act for you.

These six come directly from the regulation and are non-negotiable.¹

The Three Required Statements

Beyond the six elements, the form must include three statements that make sure you understand what you are signing. A form missing any of them is defective.

Your Right to Revoke

The form must tell you that you can revoke the authorization in writing at any time. It must either spell out the exceptions and how to submit a revocation, or point you to the provider’s Notice of Privacy Practices where that information appears.¹ The main exception is that you cannot undo a disclosure the provider has already made in reliance on the authorization. Records that went out the door before your revocation arrived stay out.²

Whether Treatment Can Be Conditioned on Signing

The form must state whether the provider is conditioning your treatment, payment, enrollment, or benefits on your willingness to sign. Usually the answer is no. There are narrow exceptions: research-related treatment, a health plan’s enrollment or underwriting decisions made before you join, and visits whose entire purpose is to generate records for a third party, such as an employment physical ordered by your employer.¹

Redisclosure Warning

The form must warn you that once your information reaches the recipient, it may be redisclosed and may no longer be protected by HIPAA. That warning matters because many common recipients, such as employers and attorneys, are not HIPAA-covered entities. The privacy protections that applied at your doctor’s office do not follow the copy they receive.¹

Who Can Sign for the Patient

Usually you sign for yourself. When you cannot, a personal representative signs, and HIPAA treats that person as you for purposes of the authorization.

For adults and emancipated minors, a personal representative is anyone with legal authority to make health care decisions on your behalf, such as someone holding a health care power of attorney or a court-appointed guardian. For unemancipated minors, a parent, guardian, or person acting in loco parentis with legal authority over health care decisions generally serves in that role. For deceased individuals, the executor or administrator of the estate qualifies, and so does a next of kin if state law grants that authority.³

When a personal representative signs, the form must describe the basis for that authority. “Parent of minor patient” works. So does “health care power of attorney dated March 5, 2024.”¹

A provider can refuse to recognize someone as a minor’s personal representative if it reasonably believes the minor has been or may be subjected to abuse or neglect by that person, or that recognizing the representative could endanger the minor.⁴

Records That Need a Different or Additional Form

Two categories of records don’t fit under a standard general authorization.

Psychotherapy notes. These get extra protection. A provider must obtain a separate authorization before disclosing them, and it cannot be combined with an authorization for any other type of health information. The only thing a psychotherapy-notes authorization can be combined with is another psychotherapy-notes authorization.¹

Substance use disorder records. A separate federal rule, 42 CFR Part 2, adds consent requirements on top of HIPAA for records from federally assisted substance use treatment programs. A Part 2 consent must include your name, identification of who holds the records and who will receive them, a description of the information in specific and meaningful terms, and the purpose of each disclosure.⁵ If you are releasing both substance use records and general medical records at once, you may need two separate forms depending on how the provider structures its consent process.

Why Providers Reject Authorizations

The regulation lists five defects that make an authorization invalid, and a provider that spots any of them must refuse the disclosure:

The expiration date has passed, or the expiration event has already occurred.
Any required element or statement is missing.
The provider knows the authorization has been revoked.
The form improperly combines authorizations or improperly conditions treatment on signing.
Material information in the form is known to be false.

Incompleteness is the most common reason forms get bounced back in practice. A missing date, a missing signature, or a description of the information too vague to act on will stop the release. Check every field before you submit.¹

Your Copy and Your Right to a Readable Form

After you sign, the provider must give you a copy of the signed authorization. Keep it. If a dispute arises later about what you authorized, or if you decide to revoke, having the original terms in front of you makes the process far simpler.

The authorization also has to be written in plain language. The statements about revocation, conditioning, and redisclosure are meant to actually inform you, which means a non-lawyer should be able to read them. A form dense with jargon is a problem with the form, not with you.¹

1
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
2
HHS.gov. If a Research Subject Revokes His or Her Authorization Can a Researcher Continue Using Information Obtained
3
HHS.gov. Personal Representatives
4
HHS.gov. Personal Representatives and Minors
5
eCFR. 42 CFR 2.31 – Consent Requirements