A HIPAA waiver is one of two things, depending on who’s using the term. For most people, it means a signed authorization form that lets a doctor, hospital, or health plan share your protected health information with a specific person or organization outside the usual flow of treatment and billing. In the research world, it means something narrower: an Institutional Review Board or privacy board has formally waived the authorization requirement so a study can use patient records without each person signing off. You need the first kind whenever your information is going somewhere HIPAA doesn’t already permit on its own — a life insurer, an attorney, an employer, a family member. You almost never need the second kind unless you’re the one running a study.
The Everyday Meaning: A Signed Authorization
Your doctor doesn’t ask you to sign a release every time they send a referral or bill your insurance. HIPAA’s Privacy Rule already lets covered entities use and share your health information for treatment, payment, and health care operations without your written permission. Hospitals can send records to a nursing home you’re transferring to. Labs can share coverage details with a physician’s billing office. Health plans can use your data for quality improvement.
The law also allows certain disclosures without authorization for public health reporting, suspected child abuse, communicable disease exposure notifications, and good-faith efforts to prevent a serious and imminent threat to health or safety.
Anything outside those permitted uses requires your signed authorization. That’s the form people commonly call a HIPAA waiver or HIPAA release.
When You Need to Sign One
These are the situations where the question typically comes up:
- Life or disability insurance applications. Life insurers aren’t covered entities under HIPAA, so your provider needs your written authorization before releasing your medical history to them.
- Legal proceedings. Personal injury cases, workers’ compensation claims, and disability hearings all rely on medical records. Attorneys on either side usually need an authorization from you to obtain them.
- Family access to your records. Unless someone is your legal personal representative, your doctor generally can’t share your records with a spouse, adult child, or sibling without your written permission.
- Employer documentation. If your employer needs medical documentation, such as for a Family and Medical Leave Act request, your provider can’t share individually identifiable information without your authorization. You’re not required to sign, but refusing without providing a complete certification can cost you the FMLA leave.
- Research participation. Enrolling in a clinical trial normally means signing an authorization that spells out how your data will be used.
A short boundary worth knowing: HIPAA governs covered entities (health plans, health care clearinghouses, and providers who transmit claims electronically) and their business associates. Most employers, schools, life insurers, and law enforcement agencies aren’t covered entities, even though they sometimes hold health-related information. That’s precisely why the authorization exists — it’s the bridge for information moving from the covered world to the uncovered one.
What Makes an Authorization Valid
A HIPAA authorization has to contain specific elements. Miss one, and the form isn’t valid.
- A specific, meaningful description of the information being disclosed. “All medical records” is usually too broad; “cardiology records from January through June 2025” is the kind of specificity the rule expects.
- The name or description of the person or organization authorized to release the information.
- The name or description of who will receive it.
- The purpose of the disclosure. If you’re initiating the request yourself, “at the request of the individual” is sufficient.
- An expiration date or an event that ends the authorization, such as “resolution of the insurance claim.”
- Your signature and the date. Electronic signatures count where valid under applicable law.
- A statement that you can revoke the authorization in writing.
- A statement that your treatment, payment, enrollment, or eligibility for benefits generally can’t be conditioned on whether you sign.
The authorization stays in force until the stated expiration date or event unless you revoke it first. Some states set shorter limits on how long an authorization stays valid, and where state law is stricter, state law wins.
Psychotherapy Notes Need Their Own Form
Psychotherapy notes are a therapist’s private session notes, kept separately from your main medical record. A provider needs a separate, specific authorization to release them, with very few exceptions. A general authorization covering “all medical records” won’t reach these notes, even for treatment purposes with another provider.
Marketing and Sale of Health Data
A covered entity that wants to use your information for marketing, or sell it to a third party, has to get written authorization first. When a third party is paying the covered entity for the marketing use, the authorization form must say so explicitly. The only marketing communications that skip the requirement are face-to-face conversations and promotional gifts of nominal value.
Reproductive Health Care
A 2024 rule change bars covered entities and their business associates from using or disclosing health information to investigate, impose liability on, or identify someone for seeking, obtaining, providing, or facilitating reproductive health care that was lawful where it was provided or protected under federal law. When the care was provided by someone other than the entity holding the records, it’s presumed lawful unless the entity has actual knowledge otherwise. Before releasing information that could relate to reproductive care for purposes like health oversight or judicial proceedings, the requester now has to attest that the request isn’t for a prohibited purpose.
Signing on Behalf of Someone Else
HIPAA recognizes “personal representatives” who can sign in the patient’s place. Who qualifies depends on the situation:
- For adults and emancipated minors, a personal representative is someone with legal authority to make health care decisions, such as a health care power of attorney or a court-appointed guardian.
- For unemancipated minors, it’s usually a parent, guardian, or other person acting in a parental role with legal authority over the child’s health care.
- For someone who has died, it’s the executor, estate administrator, or a family member with legal authority to act on behalf of the decedent, and that authority isn’t limited to health care matters.
When a personal representative signs, the form must describe the representative’s authority to act for the individual.
Your Rights Around an Authorization
You can refuse to sign. A covered entity generally can’t condition your treatment, payment, enrollment, or eligibility for benefits on whether you authorize a disclosure. Narrow exceptions apply — for instance, a researcher running a study can condition research-related treatment on your authorization — but the baseline rule protects you from being pressured.
You can revoke an authorization at any time by submitting the revocation in writing to the covered entity. It takes effect when the entity receives it. What it doesn’t do is claw back information already shared. If your insurer received your records last month, revoking today doesn’t undo that release.
If you believe a covered entity disclosed your information without proper authorization, you can file a complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights through its online complaint portal.
The Research Waiver Is a Different Thing
The word “waiver” carries a second meaning in research. An IRB or privacy board can formally waive the authorization requirement so a study can use patient records without individual sign-off. This matters for large-scale record reviews where getting a signature from each patient would be impractical — studies of disease patterns across hospital systems, for example.
A board can approve this kind of waiver only when three conditions are met: the use of the information poses no more than minimal risk to patient privacy, the research couldn’t practicably be done if each patient had to authorize, and the research couldn’t be done without access to that particular information. The approval also has to document a plan to protect identifiers and destroy them at the earliest opportunity.
For a patient, this means your records might appear in a study without anyone contacting you. For a researcher, it means going through a formal board review, not simply skipping the authorization step.