HIPAA Authorization: What You Need to Know to Protect Your Medical Privacy
Learn about HIPAA Authorization forms, why they matter for your healthcare privacy, and how to use them effectively regardless of your family or financial situation.
Introduction
A HIPAA Authorization is a legal document that gives healthcare providers permission to share your protected health information with specific people or organizations. Unlike the basic HIPAA privacy notices you routinely sign at doctor's offices, a HIPAA Authorization provides you with control over who can access your medical information beyond your direct healthcare providers. Whether you're married with children, single, or have significant assets to protect, understanding how to use HIPAA Authorizations effectively is crucial for maintaining privacy while ensuring your loved ones can help during medical emergencies.
Key Things to Know
- 1
HIPAA Authorizations are revocable at any time—you can change your mind about who has access to your information.
- 2
Without a HIPAA Authorization, healthcare providers may be legally prohibited from sharing your medical information, even with close family members.
- 3
Consider updating your HIPAA Authorization after major life events such as marriage, divorce, or when children reach adulthood.
- 4
Be specific about what information can be shared—you can exclude sensitive information like mental health records or genetic testing if desired.
- 5
Keep copies of your signed HIPAA Authorization with your other important documents and provide copies to your designated representatives.
- 6
A HIPAA Authorization works best when paired with other healthcare documents like an advance directive and healthcare power of attorney.
- 7
Different healthcare systems may have their own HIPAA Authorization forms, so you may need to complete multiple forms for different providers.
Key Decisions
HIPAA Authorization Requirements
Full legal name, date of birth, address, phone number, and other identifying information of the individual whose protected health information will be disclosed.
Include the patient's medical record number or other healthcare identifier if available.
California Requirements for HIPAA Authorization
The authorization must be written in plain language and contain specific elements including a description of the information to be disclosed, the person authorized to make the disclosure, the person to whom the disclosure may be made, an expiration date, and a statement of the individual's right to revoke the authorization.
The authorization must include a description of the information to be used or disclosed, identification of persons authorized to make the requested use or disclosure, identification of persons to whom the covered entity may make the requested use or disclosure, description of each purpose of the requested use or disclosure, expiration date or event, and signature of the individual with date.
The authorization must include statements about the individual's right to revoke the authorization in writing, the ability or inability to condition treatment on the authorization, and the potential for information to be redisclosed by the recipient and no longer protected by the Privacy Rule.
An authorization for use or disclosure of protected health information may not be combined with any other document to create a compound authorization, except in specific circumstances outlined in the regulation.
A covered entity may not condition treatment, payment, enrollment, or eligibility for benefits on whether an individual signs an authorization, except in limited circumstances.
An individual may revoke an authorization at any time, provided that the revocation is in writing, except to the extent that the covered entity has taken action in reliance on the authorization.
A covered entity must document and retain any signed authorization as required by 45 CFR § 164.530(j).
California's CMIA provides additional protections for medical information and requires specific authorization for the release of medical information, which must be in a separate document from other legal instruments.
Under California law, an authorization for release of medical information must be handwritten by the person signing it or in at least 14-point type, clearly separate from any other language on the same page, and signed and dated by the patient or the patient's legal representative.
California law requires specific content in authorizations including the name of the provider, the name of the person or entity authorized to receive the information, specific types of information to be disclosed, limitations on the use of information, the signature of the patient, and the date of signing.
In California, an authorization for release of medical information is valid for no more than one year after the date it was signed by the patient, unless otherwise specified in the authorization.
Special requirements apply to the disclosure of mental health information in California, requiring specific authorization for the release of psychotherapy notes and information related to mental health services.
California law provides enhanced protections for HIV test results, requiring specific written authorization for disclosure that states 'HIV test' or 'HIV test results' and specifies to whom the disclosure would be made.
California law provides additional protections for information related to substance use disorder treatment, requiring specific authorization for disclosure.
California law provides specific protections for genetic information and requires explicit authorization for the disclosure of genetic test results.
California has specific laws regarding minors' ability to consent to certain types of healthcare and the disclosure of related information, which must be reflected in authorizations involving minors' protected health information.
California law recognizes electronic signatures for HIPAA authorizations, but they must comply with both federal ESIGN Act and California's Uniform Electronic Transactions Act requirements.
Federal law requires a separate authorization for the use or disclosure of psychotherapy notes, which cannot be combined with an authorization for any other type of protected health information.
If the authorization is for marketing purposes that involve financial remuneration, the authorization must state that such remuneration is involved.
An authorization for the sale of protected health information must state that the disclosure will result in remuneration to the covered entity.