Valid HIPAA Authorization Form: Elements, Statements, and Defects

A HIPAA authorization form is legally valid only when it contains six core content elements, three required statements, a signature, and no disqualifying defects. The requirements for a valid HIPAA authorization form come from 45 CFR 164.508, and a form missing any one of them cannot be lawfully relied on by a doctor, hospital, health plan, or other covered entity to release your protected health information.¹

The Six Core Elements

Every valid authorization must contain all six of the following:¹

A specific and meaningful description of the health information to be used or disclosed.
The name or other identification of the person or group authorized to make the disclosure.
The name or other identification of the person or group who will receive the information.
A description of the purpose. If you initiated the authorization yourself and prefer not to explain, “at the request of the individual” is a sufficient statement of purpose.
An expiration date or an expiration event that relates to you or to the purpose of the disclosure. HIPAA sets no maximum length, but some states cap how far out that date can go, and the shorter state limit controls.
Your signature and the date. If a personal representative signs for you, the form must also describe that person’s authority to act on your behalf.

The expiration field has some flexibility. A calendar date works. So does an event tied to the purpose, such as “when my disability claim is resolved.” Research authorizations may use “end of the research study,” and one used to create or maintain a research database or repository may state “none.”¹

The Three Required Statements

Beyond the six elements, the form must put you on notice of three things in writing:¹

Your right to revoke the authorization in writing, along with either the exceptions to that right or a reference to the covered entity’s notice of privacy practices describing them.
Whether the covered entity can condition treatment, payment, enrollment, or eligibility for benefits on your signing, and the consequences of refusing when it can.
The potential for the information to be redisclosed by the recipient and no longer protected by HIPAA once it leaves the covered entity’s hands.

If any of these statements is missing, the authorization is defective in the same way it would be if a core element were absent.

What Makes an Authorization Defective

An authorization is not valid, and cannot be relied on, if any of the following are true:¹

The expiration date has passed or the expiration event has occurred.
The form has not been filled out completely with respect to any required element.
You have already revoked it in writing.
The authorization is combined with another document in a way HIPAA prohibits (see the psychotherapy notes rule below).
The covered entity knows that material information on the form is false.

The form also has to be written in plain language, and the covered entity must give you a copy once you sign it.

Authorizations That Must Stand Alone

Psychotherapy Notes

Psychotherapy notes, meaning a therapist’s private counseling-session notes kept separate from the regular medical record, require their own dedicated authorization.² An authorization for psychotherapy notes cannot be combined with an authorization for any other type of health information.¹ A single form covering both your general records and your therapist’s notes is defective as to the notes.

Substance Use Disorder Records

Substance use disorder treatment records have long been governed by a separate, stricter consent framework at 42 CFR Part 2. A final rule with a compliance deadline of February 16, 2026, brings Part 2 closer to HIPAA.³ Under the updated rule, a single consent covers all future uses and disclosures for treatment, payment, and healthcare operations, and records disclosed under that consent can be redisclosed under HIPAA’s standard rules. If you signed a Part 2 consent before this change, ask the provider whether it needs to be updated.

When a Provider Cannot Require You to Sign

A covered entity generally cannot condition treatment, payment, enrollment, or eligibility for benefits on whether you sign an authorization.¹ A doctor’s office cannot refuse to treat you because you decline to release records to a third party. Three narrow exceptions exist:

Research-related treatment. If you are participating in a clinical trial, the provider can require authorization for research-related disclosures as a condition of receiving the experimental treatment.
Health plan enrollment. A health plan can require authorization before you enroll if the authorization is for eligibility, enrollment, underwriting, or risk-rating purposes. This exception does not cover psychotherapy notes.
Exams solely for a third party. When the entire purpose of the visit is to create information for someone else, such as an independent medical exam ordered by an insurer, the provider can require authorization for that disclosure.

Where an exception does not apply and a provider refuses service over an unsigned form, the form itself is compromised: consent obtained under improper conditioning is not truly voluntary, and the authorization can be challenged.

How the Authorization Ends

Even a fully valid authorization does not have to run its full term. You can revoke any HIPAA authorization at any time by putting the revocation in writing and submitting it to the covered entity.¹ Once they receive your written request, they must stop using or disclosing your information under that authorization.

Revocation only works going forward. Any disclosures the covered entity already made in reliance on the authorization remain lawful.¹ One narrow carve-out: if the authorization was a condition of obtaining insurance coverage, the insurer may retain the right to contest claims or the policy itself after your revocation, if other law permits it.

What Happens When a Covered Entity Uses a Defective Form

Disclosing health information based on a defective, expired, or revoked authorization exposes the covered entity to civil penalties under HIPAA’s enforcement framework. Penalties are tiered by culpability, running from cases where the entity did not know of the violation up through willful neglect. At the lowest tier, fines start at around $140 per violation. At the highest tier, for willful neglect that goes uncorrected, penalties can exceed $2 million per violation, with annual caps in the same range. Knowing violations can carry criminal penalties, including imprisonment.

If a provider releases your records based on a form that was missing an element, past its expiration, or already revoked, you can file a complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights.

1
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
2
U.S. Department of Health and Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health
3
U.S. Department of Health and Human Services. Fact Sheet 42 CFR Part 2 Final Rule