HIPAA Release Authorization
Drafts a 45 CFR 164.508-compliant authorization allowing designated recipients to obtain PHI for healthcare decision-making.
Quick Start
- Gather patient info, recipients, disclosing parties, PHI scope, and purpose.
- Draft using the template below, ensuring all eight required elements are present.
- Add sensitive-category addenda and state-required execution blocks.
Prerequisites
- Patient legal name, DOB, and contact details.
- Authorized recipient(s) — full names, roles, contact details.
- Disclosing party(ies) — named provider(s) or broad covered-entity language.
- PHI scope and date range, including any specially protected categories.
- Purpose of disclosure aligned with healthcare agent duties.
- Expiration date or event.
- Personal representative authority documentation (if patient is not signer).
- State-specific execution requirements (witness, notary, special disclosures).
Required Elements (45 CFR 164.508)
| Element |
Content |
| Patient identification |
Full name, DOB; add contact details if used by providers |
| Disclosing parties |
Specific provider(s) or broad covered-entity class |
| Recipients |
Names and roles of agents/representatives |
| Description of PHI |
Record types and date range |
| Purpose |
Healthcare decision-making and agent duties |
| Expiration |
Date or event (e.g., revocation or death) |
| Signature |
Patient or personal representative with authority |
| Required statements |
Revocation rights; effect of revocation; no-conditioning notice; redisclosure warning; right to a copy |
Sensitive Information Addenda
Include explicit consent line for each applicable category:
| Category |
Notes |
| Mental health records |
State law may require separate consent |
| Substance use treatment (42 CFR Part 2) |
Separate Part 2-compliant consent likely required [VERIFY] |
| HIV/AIDS testing or treatment |
Many states require specific authorization language |
| Genetic information |
GINA and state restrictions may apply |
Template
AUTHORIZATION FOR RELEASE OF PROTECTED HEALTH INFORMATION (HIPAA)
Patient Information
Name: [PATIENT NAME]
Date of Birth: [DOB]
Address: [ADDRESS]
Phone: [PHONE]
Email: [EMAIL]
Person(s)/Entity(ies) Authorized to Disclose
[PROVIDER OR "Any health plan, physician, health care professional, hospital,
clinic, laboratory, pharmacy, medical facility, or other covered entity
that has provided treatment, payment, or services to me."]
Person(s)/Entity(ies) Authorized to Receive
[AGENT NAME], Healthcare Agent, [ADDRESS/PHONE/EMAIL]
[SUCCESSOR AGENT NAME], Successor Healthcare Agent, [ADDRESS/PHONE/EMAIL]
Description of Information to Be Disclosed
[ ] All of my protected health information, including my complete medical record.
[ ] Only the following records: [SPECIFY]
Date range: [FROM DATE] to [TO DATE]
Sensitive categories (if applicable):
[ ] Mental health records
[ ] Substance use treatment records (42 CFR Part 2) [VERIFY]
[ ] HIV/AIDS testing or treatment
[ ] Genetic information
Purpose of Disclosure
To enable my designated healthcare agent(s) to make informed healthcare
decisions, communicate with providers, and carry out duties under my
Healthcare Power of Attorney or Advance Directive.
Expiration
This authorization expires on [DATE] or upon [EVENT], unless revoked earlier
in writing by me.
Right to Revoke
I understand I may revoke this authorization at any time by written notice to
the disclosing provider. Revocation will not affect actions already taken in
reliance on this authorization.
No Conditioning
I understand that treatment, payment, enrollment, or eligibility for benefits
will not be conditioned on signing this authorization except as permitted by law.
Redisclosure Notice
I understand that information disclosed pursuant to this authorization may be
subject to redisclosure by the recipient and may no longer be protected by HIPAA.
Right to a Copy
I understand I am entitled to a copy of this signed authorization.
Signature
Patient Signature: __________________________ Date: ______________
Printed Name: _______________________________
Personal Representative (if applicable)
Representative Name: ________________________
Relationship/Authority: ______________________
Signature: __________________________ Date: ______________
Witness/Notary (if required by state law)
Witness/Notary: ______________________ Date: ______________
This document should be reviewed by qualified legal counsel before execution.
Guidelines
- Align recipients and purpose with the healthcare power of attorney or advance directive.
- Never issue a HIPAA authorization for a signer who lacks capacity unless valid representative authority is documented.
- Name specific recipients; avoid "to whom it may concern."
- Use a clear expiration date or event; avoid indefinite language where state law restricts it.
- If substance use disorder records are involved, confirm Part 2 consent requirements separately. [VERIFY]
- Add witness or notary blocks only when required by jurisdiction or provider policy.
1---2name: hipaa-release-form3description: Drafts HIPAA Release Authorization forms compliant with 45 CFR 164.508 for disclosure of protected health information. Typically used in estate planning or healthcare decision-making packets. Use when a client needs a HIPAA authorization, medical records release, PHI disclosure consent, healthcare agent access form, or advance directive bundle.4---5
6# HIPAA Release Authorization
7
8Drafts a 45 CFR 164.508-compliant authorization allowing designated recipients to obtain PHI for healthcare decision-making.
9
10## Quick Start
11
121. Gather patient info, recipients, disclosing parties, PHI scope, and purpose.
132. Draft using the template below, ensuring all eight required elements are present.
143. Add sensitive-category addenda and state-required execution blocks.
15
16## Prerequisites
17
181. Patient legal name, DOB, and contact details.
192. Authorized recipient(s) — full names, roles, contact details.
203. Disclosing party(ies) — named provider(s) or broad covered-entity language.
214. PHI scope and date range, including any specially protected categories.
225. Purpose of disclosure aligned with healthcare agent duties.
236. Expiration date or event.
247. Personal representative authority documentation (if patient is not signer).
258. State-specific execution requirements (witness, notary, special disclosures).
26
27## Required Elements (45 CFR 164.508)
28
29| Element | Content |
30| --- | --- |
31| Patient identification | Full name, DOB; add contact details if used by providers |
32| Disclosing parties | Specific provider(s) or broad covered-entity class |
33| Recipients | Names and roles of agents/representatives |
34| Description of PHI | Record types and date range |
35| Purpose | Healthcare decision-making and agent duties |
36| Expiration | Date or event (e.g., revocation or death) |
37| Signature | Patient or personal representative with authority |
38| Required statements | Revocation rights; effect of revocation; no-conditioning notice; redisclosure warning; right to a copy |
39
40## Sensitive Information Addenda
41
42Include explicit consent line for each applicable category:
43
44| Category | Notes |
45| --- | --- |
46| Mental health records | State law may require separate consent |
47| Substance use treatment (42 CFR Part 2) | Separate Part 2-compliant consent likely required [VERIFY] |
48| HIV/AIDS testing or treatment | Many states require specific authorization language |
49| Genetic information | GINA and state restrictions may apply |
50
51## Template
52
53AUTHORIZATION FOR RELEASE OF PROTECTED HEALTH INFORMATION (HIPAA)
54
551. Patient Information
56 Name: [PATIENT NAME]
57 Date of Birth: [DOB]
58 Address: [ADDRESS]
59 Phone: [PHONE]
60 Email: [EMAIL]
61
622. Person(s)/Entity(ies) Authorized to Disclose
63 [PROVIDER OR "Any health plan, physician, health care professional, hospital,
64 clinic, laboratory, pharmacy, medical facility, or other covered entity
65 that has provided treatment, payment, or services to me."]
66
673. Person(s)/Entity(ies) Authorized to Receive
68 [AGENT NAME], Healthcare Agent, [ADDRESS/PHONE/EMAIL]
69 [SUCCESSOR AGENT NAME], Successor Healthcare Agent, [ADDRESS/PHONE/EMAIL]
70
714. Description of Information to Be Disclosed
72 [ ] All of my protected health information, including my complete medical record.
73 [ ] Only the following records: [SPECIFY]
74 Date range: [FROM DATE] to [TO DATE]
75 Sensitive categories (if applicable):
76 [ ] Mental health records
77 [ ] Substance use treatment records (42 CFR Part 2) [VERIFY]
78 [ ] HIV/AIDS testing or treatment
79 [ ] Genetic information
80
815. Purpose of Disclosure
82 To enable my designated healthcare agent(s) to make informed healthcare
83 decisions, communicate with providers, and carry out duties under my
84 Healthcare Power of Attorney or Advance Directive.
85
866. Expiration
87 This authorization expires on [DATE] or upon [EVENT], unless revoked earlier
88 in writing by me.
89
907. Right to Revoke
91 I understand I may revoke this authorization at any time by written notice to
92 the disclosing provider. Revocation will not affect actions already taken in
93 reliance on this authorization.
94
958. No Conditioning
96 I understand that treatment, payment, enrollment, or eligibility for benefits
97 will not be conditioned on signing this authorization except as permitted by law.
98
999. Redisclosure Notice
100 I understand that information disclosed pursuant to this authorization may be
101 subject to redisclosure by the recipient and may no longer be protected by HIPAA.
102
10310. Right to a Copy
104 I understand I am entitled to a copy of this signed authorization.
105
10611. Signature
107 Patient Signature: __________________________ Date: ______________
108 Printed Name: _______________________________
109
11012. Personal Representative (if applicable)
111 Representative Name: ________________________
112 Relationship/Authority: ______________________
113 Signature: __________________________ Date: ______________
114
11513. Witness/Notary (if required by state law)
116 Witness/Notary: ______________________ Date: ______________
117
118This document should be reviewed by qualified legal counsel before execution.
119
120## Guidelines
121
122- Align recipients and purpose with the healthcare power of attorney or advance directive.
123- Never issue a HIPAA authorization for a signer who lacks capacity unless valid representative authority is documented.
124- Name specific recipients; avoid "to whom it may concern."
125- Use a clear expiration date or event; avoid indefinite language where state law restricts it.
126- If substance use disorder records are involved, confirm Part 2 consent requirements separately. [VERIFY]
127- Add witness or notary blocks only when required by jurisdiction or provider policy.
CaseMark