HIPAA Authorization
What a HIPAA authorization permits, what it must contain, and how it differs from healthcare decision-making authority.
Key facts
- HIPAA generally restricts disclosures, but written authorization is not always required; other rules permit some disclosures to personal representatives and people involved in care.
- A HIPAA authorization permits specified disclosures; it does not compel a covered entity to disclose information or give the recipient decision-making power.
- It complements the healthcare directive: your agent needs records to make informed decisions.
The problem it solves
HIPAA privacy regulations limit uses and disclosures of protected health information by covered entities and business associates. A written authorization under 45 CFR § 164.508 can permit disclosure to named people, but it is not always required: covered entities may share directly relevant information with family or others involved in care under § 164.510(b), and qualifying personal representatives generally exercise the individual's HIPAA rights under § 164.502(g).
What a valid authorization contains
Section 164.508 requires a meaningful description of the information; identification of who may disclose and receive it; each purpose; an expiration date or qualifying event; signature and date; and, where applicable, representative authority. It also requires statements about revocation, conditioning of treatment or benefits, and possible redisclosure.
Keep the distinction clear: the healthcare directive says who decides; a HIPAA authorization permits specified disclosures but does not itself require them. HIPAA's individual right of access under § 164.524 is a separate route that may be exercised by a qualifying personal representative under § 164.502(g).
References
- eCFR — 45 CFR § 164.508: Uses and disclosures requiring an authorization
- eCFR — 45 CFR § 164.502: Personal representatives
- eCFR — 45 CFR § 164.510: Family and others involved in care
- eCFR — 45 CFR § 164.524: Individual right of access
- HHS — Why the right of access differs from HIPAA authorization
- NIH National Institute on Aging — Advance Care Planning
This guide is educational only and is not legal, tax, or investment advice. Laws vary by state and change over time; confirm current figures with the linked primary sources or a licensed professional in your state.
Related guides
Put it into practice
Elephant turns these documents into a guided, state-aware workflow — drafted, executed, and stored in one encrypted vault.
Get started