Core elements
Under the HIPAA Privacy Rule (45 CFR 164.508), a valid authorization contains:
- A specific description of the information to be disclosed.
- The name or description of the person or organization allowed to disclose it.
- The name or description of the recipient.
- A description of each purpose. "At the request of the individual" is enough when the patient starts the request.
- An expiration date or expiration event.
- The patient's signature and the date.
- If a representative signs, a description of their authority to act for the patient.
Required statements
- The patient's right to revoke the authorization in writing, and how to do it.
- Whether treatment, payment, enrollment or eligibility can be conditioned on signing.
- That information disclosed may be redisclosed by the recipient and no longer protected by the Privacy Rule.
The form must be in plain language, and the patient must be given a copy.
Defects that get requests rejected
| Defect | Fix |
|---|---|
| No expiration date or event | Add a date or event, such as "end of litigation" |
| Expired, or older than the provider accepts | Get a freshly signed authorization |
| Provider name does not match | Use the provider's legal or practice name and location |
| Date range or record types too narrow | Match the authorization to what you are requesting |
| Missing a required statement | Use a form that includes all three |
| State form or wording requirement | Check the state: some require specific wording, type size or form (California is one example) |
| Representative signature without authority | Attach proof such as power of attorney or guardianship |
Records that need more than a standard authorization
- Psychotherapy notes (a therapist's separate process notes, kept apart from the chart) need their own authorization, which generally cannot be combined with another. Most other mental-health chart records are not psychotherapy notes, but may still need specific consent under state law.
- Substance use disorder records from federally assisted programs fall under 42 CFR Part 2: the consent has its own required content, and redisclosure is restricted more tightly than under HIPAA.
- State-protected records such as HIV status, mental health, genetic testing or reproductive health may need specific consent under state law.
When an authorization does not cover these records, the safe course is to leave them out of the request or obtain the specific consent first.
Before you send
Dynamix checks every authorization against this list before a request goes out, and tells you about any gap before it costs a week. See medical record retrieval for law firms.