Anthem HIPAA Authorization Form: Filing, Signing, and Canceling

The Anthem HIPAA authorization form is how you give Anthem written permission to share your protected health information with someone who would not otherwise have access to it, such as an attorney, a family member, or another insurer. Download it from Anthem’s “Submit Authorization to Release PHI” page, fill in your member details and the recipient, specify what records and why, set an expiration, sign it, and send it back through the portal, by mail to the address on your ID card, or by fax.¹

Where to Get the Form

The most direct route is the “Submit Authorization to Release PHI” page on anthem.com, which lets you download a PDF and, in some states, upload the completed form back through the site.¹ You can also log into your secure member account and look under forms or privacy. If you can’t get online, call the Member Services number on the back of your ID card and ask to be transferred to the Member Privacy Unit. Members without an ID card can reach Anthem at 317-488-6000.²

The layout varies slightly by state and plan, but the required fields are the same everywhere because federal law dictates what a valid authorization must contain.³

What You Need to Fill In

Your Information

Print your full legal name, date of birth, and complete address.⁴ Enter your Anthem member ID number exactly as it appears on your card. This is how Anthem matches the form to your account, so a transposed digit means the request goes nowhere.¹

Who Receives the Records

Write the full name and contact information of the person or organization you want Anthem to share with. Federal law requires you to identify the recipient specifically. “My lawyer” is not enough; you need a name, firm, and address.

What Information to Release

The form asks you to describe or select the types of records to release. Options typically include medical records, claims history, billing statements, pharmacy records, dental records, and vision history. Be specific. If your attorney only needs claims from a particular date range, say so. A narrower scope means less of your private data in someone else’s hands.

Purpose

You need to state why you want the information released. If you are initiating the authorization yourself and prefer not to explain, writing “at the request of the member” is legally sufficient.³ Common reasons include legal proceedings, insurance coordination, and personal recordkeeping.

Expiration

Every valid authorization needs either a specific expiration date or a triggering event, such as “conclusion of my legal case.” If you leave this blank on Anthem’s form, the authorization automatically expires 12 months from the date you sign it.¹ Pick a date or event that matches the actual need. A shorter window limits your exposure if you forget about the authorization later.

Sensitive Records Need Separate Consent

Certain categories of health information carry extra legal protection, and Anthem’s form includes separate checkboxes or initial lines for them. Leaving those blank means those records stay out of the disclosure even if you described them in the general section.

Treatment records for drug or alcohol use disorders are governed by 42 CFR Part 2, which imposes stricter consent requirements than HIPAA alone. The consent must specifically name the recipient, describe the information, and state the purpose; broad language does not satisfy this regulation.⁵
Psychotherapy notes receive heightened protection under HIPAA, and Anthem cannot release them under a general authorization unless you separately indicate consent for that category.
Many states layer their own restrictions on top of federal rules for HIV-related information, so Anthem’s form typically requires a distinct acknowledgment before releasing those records.

If you need any of these records disclosed, check the corresponding box or initial the designated line. Missing this step is one of the most common reasons a disclosure comes back incomplete, with the most relevant pieces stripped out.

Signing the Form

Sign and date the form in the designated section. Your signature and printed name must match the member information at the top.⁶ Anthem accepts electronic signatures where they are valid under applicable law. The Department of Health and Human Services has confirmed that HIPAA authorizations can be obtained electronically as long as the electronic signature is valid under the ESIGN Act or relevant state law.⁷ If you upload through Anthem’s portal, the site may handle this for you. If you use a third-party e-signature tool, make sure it produces an audit trail and verifies your identity.

Signing for Someone Else

A parent, guardian, executor, or person holding power of attorney can sign on behalf of the member. Federal law treats these individuals as “personal representatives” for HIPAA purposes, meaning Anthem must give them the same access rights as the member. If you are signing for someone else, complete the representative section on the form and attach a copy of your legal documentation, such as a power of attorney, court order, or guardianship papers.¹ Submitting the form without that documentation will result in Anthem rejecting it.

Parents are generally treated as personal representatives for minor children, but access can be limited when state law allows the minor to consent to certain care on their own, such as reproductive health services or substance use treatment, or when a court has restricted parental access.

How to Submit the Completed Form

You have three ways to get the form back to Anthem.

Online upload. Some state versions of the Anthem portal let you upload the signed PDF or a photo of the signed form (up to 7 MB) directly through the “Submit Authorization to Release PHI” page.¹
Mail. Send the completed form to the address printed on the back of your Anthem member ID card, which routes to the processing center for your region. If you don’t have your card, call 317-488-6000 for the correct mailing address.²
Fax. Some Anthem plans accept faxed authorizations. The fax number is typically listed on the form itself or available through Member Services. Anthem does not publish a single national fax number for this purpose.

Whichever method you choose, keep a copy. If you mail the form, consider certified mail or a tracking service so you can prove when it arrived.

How Long Anthem Has to Act

Anthem staff review the form for completeness and compliance with federal requirements. Common reasons a form gets kicked back: a missing signature, no expiration date or event, an illegible member ID, or missing legal documentation when a representative signs. If anything is incomplete, Anthem will contact you to correct it, and the clock restarts when you resubmit.

Under HIPAA, a covered entity must act on a records access request within 30 calendar days of receiving it. If Anthem cannot meet that deadline, it may take an additional 30 days as long as it sends you a written explanation of the delay within the initial 30-day window.⁸ Straightforward authorizations often process faster, but plan for the full 30 days if you’re working on a legal deadline.

How to Cancel an Authorization

You can cancel at any time by submitting a written revocation to Anthem. The revocation does not undo any disclosures Anthem already made while the authorization was active, but it stops future sharing.³ Send the revocation to the same address you used for the original form. There is no special form. A signed letter identifying yourself and stating that you revoke the authorization is sufficient.

What Anthem Can and Cannot Require

Anthem generally cannot refuse to treat you, deny payment, or drop your enrollment because you decline to sign an authorization. Federal law prohibits covered entities from conditioning treatment, payment, or eligibility for benefits on whether you sign.³ Narrow exceptions apply: a health plan can require an authorization for underwriting or enrollment determinations before you join the plan, and a provider can condition research-related treatment on an authorization. Outside of those situations, signing is voluntary.

The form itself must include a notice that information disclosed under the authorization could be redisclosed by the recipient and may no longer be protected by HIPAA once it leaves Anthem’s hands. Keep that in mind when choosing recipients. Once your attorney’s office or a family member has your records, HIPAA no longer governs what they do with them.

1
Anthem. Submit Authorization to Release PHI
2
Anthem. Privacy
3
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
4
Anthem Blue Cross and Blue Shield. Anthem HIPAA Authorization Form
5
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
6
Empire BlueCross. Anthem HIPAA Authorization Form
7
U.S. Department of Health and Human Services. How Do HIPAA Authorizations Apply to Electronic Health Information
8
U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals Requests for Access to Their PHI