HIPAA Authorization Form: Required Elements

A HIPAA authorization form is the signed document that lets a covered entity use or disclose protected health information (PHI) in a way the Privacy Rule would not otherwise allow. Its content is not a matter of house style: 45 CFR 164.508 lists the elements it must contain, the statements it must make, and the defects that void it. This guide maps each of those requirements to its paragraph, so any form, whether a hospital template, a sample, or a research authorization, can be audited line by line. It follows the text of the regulation in the 2024 edition of the Code of Federal Regulations (revised as of October 1, 2024), checked on 2026-10-29.

What the form is for and when HIPAA requires it

Under 164.508(a)(1), a covered entity may not use or disclose PHI without an authorization that is valid under the section, except where the Privacy Rule otherwise permits or requires the use or disclosure. When a covered entity holds a valid authorization, the use or disclosure must be consistent with it.

The regulation names three situations where an authorization is expressly required:

Psychotherapy notes (164.508(a)(2)), with listed exceptions such as use by the originator for treatment and use by the covered entity to defend itself in a legal action brought by the individual.
Marketing (164.508(a)(3)), except face-to-face communication and promotional gifts of nominal value. If a third party pays the covered entity for the marketing, the authorization must say so.
Sale of PHI (164.508(a)(4)), where the authorization must state that the disclosure will result in remuneration to the covered entity.

Authorization is one pathway among several for research use of PHI. If a study cannot obtain individual authorizations, the alternative is a waiver or alteration, covered in HIPAA waiver or alteration of authorization for research. For how the authorization differs from the consent a participant signs, see HIPAA authorization vs informed consent.

The six core elements in 164.508(c)(1)

A valid authorization must contain at least these six elements. Use them as the first pass when checking a form.

Paragraph	Element	What the regulation says
(c)(1)(i)	Information	A description of the information to be used or disclosed that identifies it “in a specific and meaningful fashion.”
(c)(1)(ii)	Who discloses	The name or other specific identification of the person(s), or class of persons, authorized to make the use or disclosure.
(c)(1)(iii)	Who receives	The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the use or disclosure.
(c)(1)(iv)	Purpose	A description of each purpose. “At the request of the individual” is sufficient when the individual initiates the authorization and does not, or elects not to, give a purpose.
(c)(1)(v)	Expiration	An expiration date or an expiration event that relates to the individual or the purpose.
(c)(1)(vi)	Signature and date	The individual’s signature and date. If a personal representative signs, a description of that representative’s authority to act for the individual.

Expiration for research authorizations

For an authorization covering PHI used or disclosed for research, including creating and maintaining a research database or repository, the statements “end of the research study,” “none,” or similar language satisfy the expiration element (164.508(c)(1)(v)). That shortcut is written for research only; a non-research authorization needs a real date or an event tied to the individual or the purpose.

The three required statements in 164.508(c)(2)

Beyond the core elements, the form must contain statements adequate to put the individual on notice of each of the following.

Right to revoke (c)(2)(i). The individual’s right to revoke in writing, plus either the exceptions to that right and how to revoke, or a reference to the covered entity’s notice of privacy practices (164.520) where that information appears.
Conditioning (c)(2)(ii). Either that the covered entity may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs, or, where conditioning is permitted, the consequences of refusing to sign.
Redisclosure (c)(2)(iii). The potential for information disclosed under the authorization to be redisclosed by the recipient and no longer protected by the Privacy Rule.

Two further requirements apply to every form: it must be written in plain language (c)(3), and when the covered entity seeks the authorization it must give the individual a copy of the signed form (c)(4). The covered entity must also document and retain the signed authorization (164.508(b)(6)).

Defects that make an authorization invalid

Section 164.508(b)(2) states that an authorization is not valid if the document submitted has any of these defects. They work as a check before relying on a signed form.

The expiration date has passed, or the covered entity knows the expiration event has occurred.
It has not been filled out completely for an element in paragraph (c).
The covered entity knows it has been revoked.
It violates the compound-authorization or conditioning rules in (b)(3) or (b)(4).
The covered entity knows that material information in it is false.

A valid authorization may include extra information, provided it is not inconsistent with the required elements (164.508(b)(1)(ii)).

Compound authorizations and conditioning

The general rule in 164.508(b)(3) is that an authorization may not be combined with any other document. The exceptions matter most for research:

Research. An authorization for a research study may be combined with any other written permission for the same or another study. The regulation names combining it with another authorization for the same study, with an authorization for a research database or repository, or with a consent to participate in research.
Conditioned research treatment. Where a provider has conditioned research-related treatment on an authorization, as 164.508(b)(4)(i) permits, any compound authorization must clearly differentiate the conditioned and unconditioned components and give the individual an opportunity to opt in to the research activities described in the unconditioned authorization.
Psychotherapy notes. An authorization for psychotherapy notes may be combined only with another authorization for psychotherapy notes.
Other authorizations. Other authorizations may be combined with each other, except where the covered entity has conditioned treatment, payment, health plan enrollment or eligibility on one of them.

The general rule in 164.508(b)(4) is that a covered entity may not condition treatment, payment, enrollment or eligibility for benefits on an authorization. The three exceptions are: a provider may condition research-related treatment on a research authorization; a health plan may condition enrollment or eligibility on an authorization requested before enrollment for eligibility, enrollment, underwriting or risk-rating determinations (never for psychotherapy notes); and a covered entity may condition care provided solely to create PHI for a third party on an authorization to disclose it to that party.

Revocation

An individual may revoke an authorization at any time if the revocation is in writing (164.508(b)(5)). Revocation does not reach actions the covered entity has already taken in reliance on the authorization. Where the authorization was obtained as a condition of obtaining insurance coverage, it also does not override other law that gives the insurer the right to contest a claim or the policy itself.

Sample field layout: forms, examples and templates

Searches for a sample, example or template of a HIPAA authorization form all lead to the same structure, because the regulation fixes the content. A form that satisfies 164.508 has, in order, fields or sections for the following. This is a layout of what the regulation requires, not a template to copy.

Description of the information to be used or disclosed, specific enough to identify it (c)(1)(i).
Who may make the disclosure (c)(1)(ii) and who may receive it (c)(1)(iii).
Purpose of each use or disclosure, or the “at the request of the individual” statement (c)(1)(iv).
Expiration date or event (c)(1)(v).
Statements on the right to revoke, on conditioning, and on redisclosure (c)(2).
Additional statements where they apply: remuneration for marketing or sale of PHI (a)(3)(ii), (a)(4)(ii).
Signature, date, and, for a personal representative, a description of that person’s authority (c)(1)(vi).
A copy handed to the individual (c)(4), written in plain language throughout (c)(3).

Authorization, consent and waiver compared

Question	Where to look
How does an authorization differ from informed consent?	HIPAA authorization vs informed consent
What if individual authorization is not practicable for a study?	HIPAA waiver or alteration of authorization
Where does authorization sit among research pathways?	HIPAA in clinical research
How much PHI may a request cover?	HIPAA minimum necessary standard

FAQ

What must a HIPAA authorization form contain?

Six core elements (information, discloser, recipient, purpose, expiration, signature and date) and three statements (revocation, conditioning, redisclosure), as set out in 164.508(c)(1) and (c)(2), written in plain language.

Can a HIPAA authorization form be combined with another document?

Generally no. The main exception is research, where an authorization may be combined with other written permission for the same or another study, including a consent to participate, provided any conditioned and unconditioned components are clearly differentiated.

Does a HIPAA authorization have to have an expiration date?

It must have an expiration date or event. For research, “end of the research study” or “none” is sufficient.

Can someone cancel a HIPAA authorization?

Yes, at any time, in writing, except to the extent the covered entity has already acted in reliance on it.

Does the individual get a copy?

Yes. When the covered entity seeks the authorization, it must provide a copy of the signed form.

Sources

eCFR, 45 CFR 164.508, Uses and disclosures for which an authorization is required: ecfr.gov, checked 2026-10-29.
Code of Federal Regulations, Title 45, 2024 edition (revised as of October 1, 2024), section 164.508: govinfo.gov, checked 2026-10-29.

HIPAA Authorization Form: Required Elements Under 45 CFR 164.508