Home › Estate Planning Services › HIPAA Authorization Form

HIPAA Authorization Form

A HIPAA Authorization Form is used to select someone to talk to your physician about your health and medical needs. Due to federal laws regarding patient privacy, this form is required in many situations for your physician to release medical information about you. This document can help ensure your physician provides updates about your medical condition to the person(s) you select.

Who Can Get Information from Your Doctor About Your Medical Condition?

Under 45 C.F.R. 164.510(b), HIPAA allows the patient’s physician to use professional judgment in deciding whether to speak to the patient’s next of kin, even those without a HIPAA authorization form. You may have experienced this when you picked up a prescription at a pharmacy for your spouse or the emergency room physician updated you about your spouse’s medical condition. However, the physician will only share the minimum amount necessary, unless the person has the patient’s permission, such as that given by a HIPAA Authorization Form.

When Do You Need a HIPAA Authorization Form?

One reason you may want to execute a HIPAA Authorization form is because physicians are risk adverse, so they may not inform the person you want, such as a girlfriend/boyfriend or close acquaintance. Another reason is because some advance directives, such as a Medical Power of Attorney (“MPOA”), do not become effective unless the physician certifies you as being incapacitated and files it in your medical record. Therefore, an MPOA would not help your agent obtain information about your medical condition unless those circumstances arise. The person you name in the HIPAA Authorization Form does not have to be the same person you name as your agent in an MPOA.

Legal Requirements for HIPAA Authorization Forms

A HIPAA Authorization Form must meet specific requirements set forth in 45 C.F.R. 164.508(c). For example, it cannot be combined with any consent for treatment or release of psychotherapy notes. It must also contain specific elements:

A specific and meaningful description of the information to be disclosed.
The name of the person or class of persons authorized to disclose the information.
The name of the person or class of persons to whom the provider may make the disclosure.
The purpose for the disclosure, e.g. at the request of the individual.
The expiration date or event that ends the authorization for disclosure.

The HIPAA Authorization Form must also contain specific statements about the patient’s rights:

The patient or personal representative has the right to revoke the authorization at any time.
The provider generally may not condition its healthcare on whether the patient has signed a HIPAA Authorization Form, except for research-related treatment or if the purpose of the healthcare is to create information for disclosure, such as an employment physical. In such cases, the health care provider may refuse to provide the healthcare if the patient does not sign an authorization.
The information disclosed per the authorization may be subject to redisclosure by the recipient and no longer protected by HIPAA.

A HIPAA Authorization Form should be kept to one page, so your provider can quickly and easily read it. Your signature does not need to be notarized or witnessed.