lev-os HIPAA Release Authorization
Generates a 45 CFR §164.508-compliant authorization permitting designated recipients to access a patient's protected health information (PHI) from covered entities, typically in an estate-planning context.
Quick Start
Gather before drafting:
- Jurisdiction — state governs signature and witness/notary formalities
- Patient identity — legal name, DOB, contact details
- Recipients — healthcare agent, successor agent(s), other representatives
- Disclosing entities — providers, hospitals, labs, pharmacies, health plans
- PHI scope — all records or limited categories
- Purpose and duration — expiration date, event, or condition
- Representative authority (if applicable) — POA, guardianship order, court appointment
- Related documents — healthcare proxy, advance directive for terminology alignment
Required Sections
Every authorization must include these elements per §164.508:
| Section | Key requirement |
|---|---|
| Patient identification | Name, DOB, contact |
| Authorization statement | Voluntary, specific written consent |
| Authorized recipients | Agent names, roles, relationships — no ambiguity |
| Disclosing entities | Covered entities / record holders |
| PHI scope | Explicit categories; do not mix "all records" with narrow limits |
| Purpose | Specific estate-planning healthcare decision-making purpose |
| Expiration | Explicit end date, event, or condition |
| Required notices | Re-disclosure warning, treatment non-conditioning, right to refuse |
| Revocation | How and where written revocation is sent; prospective-only effect |
| Execution block | Patient signature first, then representative if applicable |
| Witness/notary | Only where state law requires [VERIFY] |
Draft Workflow
- Confirm inputs against the Quick Start checklist; flag any gaps.
- Select PHI scope — if client wants full-record access, state it unambiguously; otherwise enumerate categories. Sensitive categories (substance use, mental health, genetic, HIV/AIDS) require explicit inclusion [VERIFY].
- Draft the form using this structure:
- Title citing 45 CFR §164.508
- Patient identification block
- Authorization statement
- Disclosers list
- Recipients list (match names/roles to healthcare POA document)
- PHI scope with checkbox-style selection
- Purpose statement tied to healthcare directives
- Duration clause (date, revocation, or death — whichever first)
- Patient rights / required statements (all six §164.508 notices)
- Execution block (patient, then representative if signing on behalf)
- Witness/notary block if state law applies
- Validate — all placeholders visible, recipients consistent across sections, terminology aligns with governing POA/directive.
- Add state-specific addendum only when confirmed for target jurisdiction.
Pitfalls
- Never authorize broader disclosure than needed unless client explicitly requests full-record access.
- Never leave recipient or discloser fields unidentified.
- Never leave representative signature fields blank without authority documentation.
- Federal law is not exclusive — state mandates may impose additional form requirements [VERIFY].
- Estate-planning variants must match healthcare POA terminology in the core delegation document [VERIFY].
- Include attorney-review language in cover memo if template is client-facing.