HIPAA Authorization to Disclose Protected Health Information
Full HIPAA-compliant authorization (45 CFR 164.508) for use or disclosure of PHI — including marketing, research, and psychotherapy notes when applicable.
Live preview
AUTHORIZATION FOR USE OR DISCLOSURE OF
PROTECTED HEALTH INFORMATION
(45 CFR § 164.508)
═══════════════════════════════════════════════════════════════════════
SECTION 1 — PATIENT (INDIVIDUAL WHOSE PHI WILL BE DISCLOSED)
═══════════════════════════════════════════════════════════════════════
Name: Jordan Alex Taylor
Date of birth: June 12, 1985
Address: 482 Elm Street, Apt 3B, Portland, OR 97214
Phone: +1 503 555 0118
Medical record #: MRN-PNW-44218
═══════════════════════════════════════════════════════════════════════
SECTION 2 — COVERED ENTITY AUTHORIZED TO DISCLOSE
═══════════════════════════════════════════════════════════════════════
Name: Pacific NW Family Medicine, PLLC
Address: 925 NW 19th Ave, Portland, OR 97209
═══════════════════════════════════════════════════════════════════════
SECTION 3 — RECIPIENT(S) AUTHORIZED TO RECEIVE PHI
═══════════════════════════════════════════════════════════════════════
Name: Acme Clinical Research, Inc.
Address: 1500 Research Blvd, Bethesda, MD 20892
Relationship: Research sponsor (no prior treatment relationship)
═══════════════════════════════════════════════════════════════════════
SECTION 4 — DESCRIPTION OF PHI
═══════════════════════════════════════════════════════════════════════
The following information is authorized for use or disclosure:
Complete medical record from January 1, 2023 through the date of this authorization, including: (a) physician progress notes; (b) laboratory results; (c) imaging reports; (d) medication history; (e) immunization records; (f) discharge summaries from any inpatient stays.
(Strike or modify any category you do NOT wish to authorize.)
Sensitive categories — only those initialed below are authorized:
____ HIV/AIDS testing and treatment records.
____ Mental health diagnosis and treatment records (other than psychotherapy notes — see separate authorization).
____ Substance use disorder treatment records (42 CFR Part 2 — see separate authorization required).
____ Genetic testing results.
____ Reproductive and sexual health records.
NOTE: Substance use disorder records protected by 42 CFR Part 2 require
a separate Part 2-compliant consent. Psychotherapy notes (45 CFR
164.508(a)(2)) require a separate authorization that may not be
combined with any other authorization.
═══════════════════════════════════════════════════════════════════════
SECTION 5 — PURPOSE OF USE OR DISCLOSURE
═══════════════════════════════════════════════════════════════════════
Purpose: At the request of the individual
If "Other": Not applicable.
═══════════════════════════════════════════════════════════════════════
SECTION 6 — EXPIRATION
═══════════════════════════════════════════════════════════════════════
This authorization expires on:
Type: Date certain
Specific date: May 8, 2027
Or event: Completion of clinical encounter for which records are requested.
═══════════════════════════════════════════════════════════════════════
SECTION 7 — REQUIRED STATEMENTS (45 CFR § 164.508(c)(2))
═══════════════════════════════════════════════════════════════════════
(a) RIGHT TO REVOKE. I understand that I may revoke this authorization
at any time by submitting a written revocation to the privacy officer
of the covered entity named in Section 2. The revocation will not
apply to any disclosures already made in reliance on this authorization
prior to receipt of the revocation. Revocation of an authorization for
research may be limited to the extent the covered entity has acted in
reliance on the authorization.
(b) TREATMENT NOT CONDITIONED. I understand that the covered entity
generally may not condition my treatment, payment, enrollment in a
health plan, or eligibility for benefits on whether I sign this
authorization, except as permitted under 45 CFR 164.508(b)(4):
(i) research-related treatment; (ii) eligibility/enrollment determinations;
(iii) underwriting; (iv) when the only purpose of treatment is to
disclose PHI to a third party.
(c) RE-DISCLOSURE. I understand that information used or disclosed
pursuant to this authorization may be subject to re-disclosure by the
recipient and is no longer protected by federal HIPAA privacy rules.
However, certain categories (substance use disorder under 42 CFR Part 2;
genetic information under GINA) retain federal protection against
re-disclosure even after disclosure to a non-covered entity.
(d) MARKETING / SALE OF PHI. If purpose is marketing AND covered entity will receive direct or indirect remuneration: I acknowledge that the covered entity will be paid by the recipient for this authorization.
If purpose is sale of PHI: I acknowledge that this authorization will result in remuneration to the covered entity.
(Strike if neither applies.)
═══════════════════════════════════════════════════════════════════════
SECTION 8 — SIGNATURE
═══════════════════════════════════════════════════════════════════════
I have read this authorization and understand my rights. I am signing
voluntarily.
_____________________________________ May 11, 2026
Patient (or personal representative) Date
Signed by: No — signed by patient
If representative: Not applicable.
(Personal representative must attach documentation
of authority — court order, power of attorney, etc.)
═══════════════════════════════════════════════════════════════════════
COPY TO PATIENT
═══════════════════════════════════════════════════════════════════════
The covered entity must provide a copy of the signed authorization to
the patient (45 CFR § 164.508(c)(4)).
About this template
A HIPAA Authorization to Disclose Protected Health Information (PHI) is the legal instrument required by 45 CFR § 164.508 whenever a covered entity wishes to use or disclose PHI for purposes that are NOT treatment, payment, or healthcare operations (TPO). The Privacy Rule defines TPO narrowly: treatment is the provision of healthcare; payment is the activity of obtaining reimbursement; healthcare operations include quality assessment, accreditation, and similar internal functions. Anything else — marketing communications, research participation, sale of PHI, fundraising solicitations, or sharing records with non-affiliated entities — requires this authorization. The form has six core elements that the regulation specifies as mandatory: (1) a meaningful description of the information to be disclosed; (2) the name of the person or class of persons authorized to disclose; (3) the name of the recipient; (4) a description of each purpose; (5) an expiration date or event; and (6) signature with date. It also requires three "required statements": the right to revoke in writing (with the limit that revocation does not apply to prior reliance disclosures); a statement that the covered entity may not condition treatment on signing (with narrow exceptions for research, eligibility determinations, underwriting, and pure-disclosure treatments); and a statement that re-disclosure may not be protected by HIPAA. Marketing communications under 45 CFR § 164.508(a)(3) require the additional disclosure that the covered entity will receive remuneration if applicable. Sale of PHI under § 164.508(a)(4) requires disclosure that the disclosure will result in remuneration to the covered entity. Psychotherapy notes under § 164.508(a)(2) require their own separate authorization and may not be combined with any other authorization on the same form. Substance use disorder records protected by 42 CFR Part 2 require a Part 2-compliant consent, which is more stringent than the HIPAA authorization (it requires a prohibition on re-disclosure notice, among other elements). Genetic information under the Genetic Information Nondiscrimination Act (GINA) of 2008 cannot be used for underwriting in health plans or for hiring decisions, regardless of authorization. Use this form for general PHI disclosures that fall outside TPO. For specific use cases — research, marketing, psychotherapy notes, SUD treatment records — verify with your privacy officer whether additional authorizations or consents are required. Compound authorizations (combining multiple purposes on one form) are permitted under 45 CFR § 164.508(b)(3) only in limited circumstances, primarily for research authorizations conditioned on consent for research-related treatment. State laws may impose stricter authorization requirements; HIPAA does not preempt more protective state laws (45 CFR § 160.203). California, New York, Texas, and Massachusetts in particular have additional state-law requirements that may need to be incorporated.
When to use it
- Disclosing PHI to anyone outside treatment, payment, or healthcare operations.
- Authorizing release of records for research participation.
- Authorizing PHI disclosure to attorneys, employers, or non-medical third parties.
- Authorizing covered entity to send marketing communications based on PHI.
- Authorizing sale of PHI (rare; requires explicit acknowledgement).
What to include
- Patient demographics and identifier (MRN if available).
- Specific description of PHI authorized — not "all records" alone.
- Sensitive categories explicitly identified (HIV, mental health, SUD, genetic, reproductive).
- Named recipient with address.
- Specific purpose of disclosure.
- Expiration date or event (no open-ended authorizations except research).
- Right-to-revoke statement with mailing instructions.
- Treatment-not-conditioned statement (with narrow exceptions noted).
- Re-disclosure warning.
- Marketing or sale disclosure if applicable.
- Signature, date, and signer relationship.