If you decline a HIPAA authorization, the provider, health plan, or other covered entity that asked for it cannot use or share your protected health information for the purpose written on that form. Federal privacy rules give you that right, and in most situations a provider cannot refuse to treat you and a health plan cannot refuse to cover you just because you would not sign. The refusal does have consequences in specific settings, though, and knowing where those consequences bite is the difference between a confident no and a costly one.
What Refusing Actually Stops
An authorization is the written permission a covered entity needs before it uses or discloses your health information for something outside routine treatment, payment, and day-to-day operations. Marketing, fundraising, sending records to an attorney, releasing a chart to a life insurer, giving detailed information to a family member for a non-care purpose: these all require your signed authorization. When you decline, the entity is barred from making that particular disclosure. The information stays where it is.
The form itself has to tell you that you can refuse. It also has to identify the specific information involved, who would send it, who would receive it, why, and when the permission expires. If any of those elements is missing, the authorization is defective and the entity cannot rely on it even if you did sign.
When Providers Can Still Share Without Your Signature
Refusing an authorization does not lock down every flow of your information, and it is important to understand the boundary before you assume a no covers everything.
Your doctor’s office, hospital, pharmacy, and health plan can use and disclose your information for their own treatment, payment, and healthcare operations without asking you to sign anything beyond the initial notice of privacy practices. Your primary care doctor can send records to another provider involved in your treatment. Your hospital can bill your insurer. Your plan can run customer service.
The Privacy Rule also permits or requires disclosure without authorization in a long list of public-interest situations: reporting communicable diseases, births, deaths, and suspected child abuse; responding to court orders and certain subpoenas; complying with law enforcement requests within defined limits; and any disclosure another law independently requires. Hospitals can list your name, location, and general condition in a facility directory unless you object, and providers can share information relevant to a family member’s involvement in your care unless you tell them not to. None of this depends on a signed authorization, so declining one does not shut any of it off.
Can They Deny You Care or Coverage?
Generally, no. A covered entity cannot refuse to treat you, refuse to process your payment, refuse to enroll you in a health plan, or refuse to determine your eligibility for benefits simply because you would not sign an authorization. The authorization form is required to tell you, in writing, whether your care or enrollment can be conditioned on your signature.
Three narrow exceptions exist, and they are the situations where a signature can be made a condition:
- Research-only treatment. If the treatment you are getting exists solely as part of a clinical trial, the researcher can require your authorization for the study’s use of your information as a condition of enrolling you.
- Health plan underwriting. A health plan can require an authorization before you enroll if it needs the information for eligibility, enrollment, underwriting, or risk-rating. Even then, the plan cannot demand authorization for psychotherapy notes.
- Exams generated for someone else. Pre-employment physicals, fitness-for-duty exams ordered by your employer, and medical exams for a life or disability insurance application exist to produce information for a third party. The provider conducting one can require your authorization to release the results.
Outside those three, a provider who threatens to withhold care unless you sign is violating the Privacy Rule.
Where Saying No Really Costs You
The rule that a covered entity cannot punish your refusal does not extend to entities that were not going to give you anything in the first place. Life insurers, disability insurers, and long-term care insurers routinely require applicants to authorize the release of medical records so they can underwrite the policy. Nothing in HIPAA obligates them to issue you coverage. Decline the authorization and the application will almost certainly be denied or set aside, because the insurer has no way to assess the risk.
FMLA leave runs into similar friction. Your employer can require a medical certification from your provider to support a leave request. If you will not authorize the exchange, your leave can be jeopardized. Workers’ compensation claims often involve authorizing the release of records related to a workplace injury. The Privacy Rule allows some workers’ comp disclosures without authorization, but where an authorization is asked for and refused, the practical result can be a delayed or denied claim.
Referrals to specialists outside your current treatment team can also stall. Once a specialist is part of your care, your records can flow without an authorization; before that, some offices will not schedule or evaluate a referral until the paperwork is signed.
Psychotherapy Notes Are Different
Psychotherapy notes get stronger protection than the rest of your record. These are the personal notes a mental health professional keeps separate from the main chart, distinct from diagnoses, medications, treatment plans, and session times. With very few exceptions, a covered entity needs a specific authorization from you before disclosing psychotherapy notes for any purpose, including sharing them with another treating provider. A general authorization covering your medical records does not automatically reach these notes. If you decline authorization for them, they stay locked down, and no third party, including a health plan doing underwriting, can compel their release.
Getting Your Own Records Doesn’t Require One
You do not need to sign a HIPAA authorization to see or get a copy of your own medical records. Your right of access is a separate right, and it operates differently: an authorization permits a disclosure, while the right of access requires the entity to give you your records within 30 days, with narrow exceptions. HHS has warned providers that making patients complete an authorization form for their own records creates an impermissible barrier to that right. If a front desk hands you an authorization form when you simply asked for your chart, you can push back. The right of access also lets you direct a copy of your records to a third party of your choosing without an authorization form.
Changing Your Mind After Signing
If you signed an authorization and want it stopped, you can revoke it at any time in writing. The revocation takes effect when the covered entity receives it. Every authorization form has to explain how to revoke, or point you to the notice of privacy practices that does.
Revocation is not retroactive. Anything already shared while the authorization was in force stays shared. Information already collected can continue to be used to the extent necessary, which in a research setting means data gathered before you withdrew can still be used to preserve the study’s integrity, account for your withdrawal, or report adverse events. New disclosures stop once the revocation is received. One exception: if the authorization was a condition of obtaining insurance coverage, the insurer may retain rights, under other law, to contest a claim or the policy itself.
If a Provider Pressures You Anyway
If a covered entity conditions your treatment on an authorization it has no right to require, retaliates because you refused, or otherwise violates the Privacy Rule, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Complaints go through the OCR Complaint Portal or in writing, and you have 180 days from when you knew or should have known about the violation, with extensions available for good cause. OCR investigates and can require voluntary compliance or impose civil monetary penalties depending on severity. Filing costs nothing and does not require a lawyer.