Guidance on HIPAA Authorization Forms
There is much confusion among providers about HIPAA authorizations, including: (1) when an authorization is or is not
required, (2) what the required content is for a valid authorization form, (3) what required notices must be provided on
an authorization form, and (4) what the recordkeeping requirements are. This document provides guidance on these
issues as well as a template for a valid written authorization form. It is intended for use in a physical or occupational
therapy practice. It is not intended to provide comprehensive guidance on unique cases where other exceptions or
guidance might need to be followed, such as releases for psychotherapy notes. Read this information carefully before
implementing the use of the template form and be sure to consult us or another qualified attorney if questions arise
related to specific issues or cases. Clients of PT on Demand have permission to use this template form and letter for
clinic purposes. Please remove the copyright notice in the footnote of the form when you implement its use.
Written authorizations to release protected health information (PHI) must contain specific required information and
statements in order to be a valid authorization. The template form provided meets all of the requirements below. When
using the form, you must complete all information for the authorization to be valid. A cover letter to use when
requesting information is also provided. It informs the recipient that federal law requires the recipient to send the
records requested within 30 days and instructs the recipient how and where to send them.
6 Requirements for the Authorization Form:
• A description of the information to be used or disclosed that identifies the information in a
specific and meaningful fashion.
• The name or other specific identification of the person(s), or class of persons, authorized to
make the requested use or disclosure.
• The name or other specific identification of the person(s), or class of persons, to whom the
covered entity may make the requested use or disclosure.
• A description of each purpose of the requested use or disclosure. The statement “at the
request of the individual” is a sufficient description of the purpose when an individual initiates the authorization
and does not, or elects not to, provide a statement of the purpose.
• An expiration date or an expiration event that relates to the individual or the purpose of the use
or disclosure. The statement “end of the research study,” “none,” or similar language is sufficient if the
authorization is for a use or disclosure of protected health information for research, including for the creation
and maintenance of a research database or research repository.
• Signature of the individual and date. If the authorization is signed by a personal representative
of the individual, a description of such representative's authority to act for the individual must also be provided.
The form must be written in plain language and must contain the following 4 statements:
• A statement that the individual has the right to revoke the authorization in writing, subject to the rights of any
individual who acted in reliance on the authorization prior to receiving notice of revocation, and how the
individual may revoke the authorization.
˝Simons & Associates Law, P.A. 2014
• The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the
authorization. A health care provider may only condition the provision of health care on an authorization if the
health care is solely for the purpose of creating protected health information for disclosure to a third party
authorization for the disclosure of the protected health information to such third party. In this case, the
consequences of refusing to sign an authorization must also be stated.
• A statement that the information disclosed pursuant to the authorization is no longer protected under HIPAA
and may be subject to re-disclosure by the recipient.
• The individual is entitled to a copy of the signed authorization.
Do not release protected health information to anyone who presents a “defective” authorization/release to you. A
defective authorization is one that:
o The expiration date has passed or the expiration event is known by the covered entity to have occurred;
o The authorization has not been filled out completely, with respect to an element described above;
o The authorization is known by the covered entity to have been revoked;
o The authorization is combined with another form. (An authorization for use or disclosure of protected
health information may not be combined with any other document to create a compound
authorization.)
o Any material information in the authorization is known to be false.
You should NOT:
o Release more information than required to meet the purpose of the disclosure.
o Release personal medical information in a workers’ compensation case that is not related to the workrelated
injury to the employer or workers compensation payer unless you obtain a written authorization.
Only the work-related information may be disclosed under the workers’ compensation or payment
exception to requiring a signed authorization.
o Disclose records pursuant to a subpoena that is only signed by the opposing side’s attorney. Get an
authorization to release the information requested or a subpoena signed by the court or administrative
tribunal with jurisdiction over the case.
o Release psychotherapy notes that might be in the record unless you have a separate authorization to
release such records (authorizations to use and disclose psychotherapy records may not be combined
with an authorization to release physical therapy records.
o Release HIV test results without a specific authorization to release such information. If treatment
records contain such information, you should redact it if you don’t get a specific authorization to release
the HIV information.
Recordkeeping requirements:
▪ You must keep a signed written copy of the authorization for 6 years.
▪ You must also be able to provide an accounting of all disclosures made whether an authorization was
required or not upon request by the individual. This includes disclosures for billing purposes. Make sure
your billing system/third party billing company can provide an accounting of all disclosures if the patient
requests it.
Authorizations are NOT required for disclosures to the individual being treated or for purposes of:
˝Simons & Associates Law, P.A. 2014
▪ treatment,
▪ payment, or
▪ health care operations
▪ However, you must honor a request not to disclose information to a third party payer for payment
purposes if the patient pays out of pocket in full at the time of services. If the patient does not pay at
the time of services, you do not have to agree to the request not to disclose the information to the
payer.
Authorizations ARE required for:
o Marketing, except if the communication is in the form of:
▪ A face-to-face communication made by a covered entity to an individual; or
▪ A promotional gift of nominal value provided by the covered entity.
o Marketing includes any communication that involves the clinic receiving remuneration from a third party,
such as when a clinic publishes a newsletter that includes advertising in it from third party who have paid a
fee to advertise. For the sale of protected health information.
Pictures, Videos, Audio recordings and Written Testimonials:
Pictures, videos and audio recordings taken through the course of treatment are considered protected health
information entitled to the same protection as written medical records. Therefore, to disclose pictures, videos and audio
recordings to third parties, you must obtain written authorization. If you intend to use pictures, videos, audio recordings
and/or written testimonials for marketing purposes (including on your website or social media accounts) or to use in
educational presentations, the patient must sign an authorization specifically for that purpose. Please also note that the
Federal Trade Commission’s Guides Concerning Use of Endorsements and Testimonials will apply to any use of a patient’s
image or written/verbal remarks (testimonials) that might be used for advertising/marketing purposes, therefore an
authorization for such use may need additional language to ensure compliance with the FTC’s endorsement/testimonial
rules. We recommend that providers consult an attorney on further guidance on this matter.
For more information and a full text of the HIPAA Privacy Rule, go to: http://www.hhs.gov/ocr/privacy/hipaa/
administrative/privacyrule/index.html
For more information on the FTC Guide Concerning Use of Endorsements and Testimonials, go to: http://www.ecfr.gov/
cgi-bin/text-idx?SID=0ad95bce0e82076b602ca5beab7aaf1f&node=16:1.0.1.2.22&rgn=div5
˝Simons & Associates Law, P.A. 2014
