A HIPAA authorization form is the written permission a patient signs to let a doctor, hospital, or health plan share their protected health information with a specific person or organization. It is required by federal law, 45 CFR 164.508, for any release that is not for treatment, payment, or normal health care operations. Download it free, fill it in, and sign.
Free to download and use.Updated September 2026 by Document eSign
A HIPAA authorization is a revocable permission to release health records, not a binding contract. You can sign it online or on paper, since HIPAA does not require a notary or witness, and you can revoke it in writing at any time. Your provider may also have its own form to use.
A HIPAA authorization form is a written permission slip a patient signs to let a health care provider, hospital, or health plan use or disclose their protected health information to someone else. HIPAA is the federal Health Insurance Portability and Accountability Act, and its Privacy Rule, at 45 CFR 164.508, sets out exactly what this form has to contain. It is required whenever a provider wants to share your health information for a reason that is not treatment, payment, or ordinary health care operations, which the rule already permits without a signature. So you sign one to send records to a new doctor, support an insurance or disability claim, give a family member or lawyer access, or share information for research or marketing. A valid authorization is specific. It names who may release the information, who may receive it, exactly what information is covered, the purpose, and an expiration date or event, and it tells you that you can revoke it, that your care generally cannot be conditioned on signing, and that information sent to the recipient may lose its federal protection. People often call it a HIPAA release form or a medical records release, and for most everyday requests those are the same thing. It is not the same as the Notice of Privacy Practices a provider hands you, which only explains their policies, or a health care power of attorney, which lets someone make medical decisions for you.
Who uses it
A patient sending records to a new doctor or specialistSomeone supporting an insurance, disability, or workers' compensation claimA patient giving a spouse, adult child, or caregiver access to their recordsA person authorizing a lawyer to obtain medical records for a legal matterA provider or clinic that needs written authorization on file before releasing recordsA research participant authorizing use of their health information for a study
What's inside
Patient details: name, date of birth, address, and phone
Who may release the information (the provider or plan that holds the records)
Who may receive the information (the named recipient or class)
A specific description of the information to be shared
Separate initials for extra-protected records: mental health, substance use, HIV, and genetic information
The purpose of the disclosure
An expiration date or event
The right-to-revoke, no-conditioning, and re-disclosure statements the rule requires
A signature line, with space for a personal representative's authority
HOW IT WORKS
From template to signed in three steps.
Heads up: this document usually needs a wet-ink signature, and notarization or witnesses, to be valid. Use these steps to prepare and download it, then sign it the way your state requires.
01
Start from the template
Open it in the editor with the fields already mapped, or download the DOCX to edit offline.
02
Add signers and send
Drop signature and date fields, then route each party in order or in parallel.
03
Get a sealed copy
Everyone signs, and you get a tamper-evident PDF plus an audit certificate.
Free forever. No credit card. Your recipients sign with no account.
The details
Everything to know before you send it.
1
How to fill it in
The patient completes the form and signs it; the provider keeps it on file before releasing anything. Be specific, because a vague or incomplete authorization is not valid and the provider can refuse to act on it.
Patient details: enter your full name, date of birth, address, and phone so the provider can match you to your records.
Who releases and who receives: name the provider or plan that holds the records, and the exact person or organization that may receive them.
Information: describe what is being shared in specific terms, such as a date range or record type, rather than writing "everything."
Sensitive records: initial only the extra-protected categories you actually want released, and leave the rest blank.
Purpose and expiration: state why the information is being shared and set an expiration date or event.
Sign: sign and date the form. If you are signing for someone else, describe your authority to act for them.
2
The six required elements and three required statements
HIPAA does not accept just any signed note. To be valid under 45 CFR 164.508, an authorization has to contain six core elements and three specific statements, and a provider will reject one that is missing any of them. The six elements are a specific description of the information to be used or disclosed; the name of the person or class authorized to make the disclosure; the name of the person or class who may receive it; the purpose (and "at the request of the individual" is enough when you initiate it); an expiration date or event; and your signature and the date, plus a description of authority if a personal representative signs. The three required statements put you on notice of your right to revoke the authorization in writing and how; whether the provider can condition treatment or payment on your signing, which usually they cannot; and the risk that once your information reaches the recipient it may be re-disclosed and no longer protected by HIPAA. The form also has to be written in plain language, and the provider must give you a copy once you sign.
3
When you need one, and when you do not
You do not need an authorization for the routine flow of your care. HIPAA already lets a provider use and share your information for treatment, payment, and health care operations, often shortened to TPO, so a doctor can send a referral or a hospital can bill your insurer without asking you to sign anything. You need a signed authorization for uses and disclosures the rule does not otherwise permit. The clearest examples are marketing that involves payment to the provider, any sale of your information, and psychotherapy notes, which have their own rules. It also covers the everyday requests people actually make, such as sending your records to a new clinic, releasing them to an attorney or a life insurer, or letting a relative see them. A useful way to think about it: if the request is part of getting you treated, paid for, or your provider run, no form is needed; if it is sharing your information with someone outside that flow, you sign an authorization first.
4
Extra-protected records: mental health, substance use, HIV, and genetic information
Some categories of health information carry protection beyond the standard rule, which is why this form asks you to initial them separately rather than sweeping them into a general release. Psychotherapy notes, a therapist's private session notes kept apart from the rest of your record, need their own separate authorization and cannot be bundled with any other request. Substance use disorder records from a federally assisted treatment program are governed by a separate federal law, 42 CFR Part 2, which has historically required more specific consent and limits how the recipient can pass the information on. Many states add their own stricter rules for HIV and AIDS information and for mental health records, and genetic information has separate protection, including a bar under the Genetic Information Nondiscrimination Act on health plans using it for underwriting. Because of all this, initial only the sensitive categories you actually intend to release, and know that a general "all records" authorization may not reach them unless it says so.
5
How long it lasts and how to revoke it
A HIPAA authorization is not open-ended. The form has to state an expiration date or an expiration event, such as one year from signing, a specific date, or the end of a claim or a research study, and HIPAA does not set a fixed maximum, though some states cap it and one year is a common convention. When the date passes or the event happens, the authorization is no longer valid and the provider needs a new one. You can also revoke it earlier at any time by putting your revocation in writing to the provider that holds your records. Revoking stops any future sharing, but it cannot pull back information the provider already released while the authorization was in force, which is why acting promptly matters if you change your mind. An authorization is also treated as invalid, and a provider must refuse to honor it, if it has expired, was left incomplete, is known to have been revoked, or contains information the provider knows to be false.
6
A note on the 2024 substance use records rule
If your authorization touches substance use disorder treatment records, the law here changed recently. In February 2024 the Department of Health and Human Services finalized a rule that brings 42 CFR Part 2, the law protecting those records, more closely in line with HIPAA. Among other changes it lets a patient give a single consent covering future uses and disclosures for treatment, payment, and health care operations, aligns the Part 2 consent elements with HIPAA's, and applies HIPAA's civil and criminal penalties to Part 2 violations. The rule took effect in April 2024, and covered programs have until February 16, 2026 to comply, including updating their privacy notices. The practical point for this form is that substance use records still get special treatment and your specific initials, so if your request involves them, confirm the current consent requirements with the treatment program.
7
Signing it
A HIPAA authorization is valid once the patient, or a personal representative with authority, signs and dates it. HIPAA requires the authorization to be in writing but is neutral about the technology, so an electronic signature is acceptable as long as it is valid under the applicable e-signature law, the federal ESIGN Act and the state UETA. HIPAA itself does not require the form to be notarized or witnessed, though a provider's own policy or a specific state law occasionally adds a step. You can print it and sign by hand or fill it in and sign online, then send it to the provider that holds your records. Keep the copy the provider gives you, since it records what you authorized, to whom, and when it expires, and you will need it if you later decide to revoke.
This template and the guidance on this page are provided for general information only and are not legal advice. Laws differ by country and state, so review the final document against your own situation and have a qualified lawyer check anything high-value or regulated before you sign.
FAQ
Questions, answered.
What is a HIPAA authorization form?
It is a written permission form a patient signs to let a provider, hospital, or health plan use or disclose their protected health information to a specific person or organization. It is required by 45 CFR 164.508 for any release that is not for treatment, payment, or ordinary health care operations, such as sending records to a lawyer, insurer, or family member.
What are the required elements of a valid HIPAA authorization?
Six core elements: a specific description of the information; who may release it; who may receive it; the purpose; an expiration date or event; and the patient's signature and date. It also needs three statements covering the right to revoke, whether care can be conditioned on signing, and the risk of re-disclosure, and it must be in plain language.
How long is a HIPAA authorization valid? Does it expire?
It expires on the date or event written on the form, such as one year from signing, a specific date, or the end of a claim or study. HIPAA does not set a fixed maximum, though some states cap it and one year is common. If no date is stated, this template expires one year after it is signed. You can also revoke it earlier in writing.
What is the difference between a HIPAA authorization and a HIPAA consent?
An authorization is the specific, HIPAA-required form for sharing your information for a purpose outside routine care, and it names the information, the recipient, the purpose, and an expiration. Consent is a broader, more general permission some providers use for routine treatment and billing. Authorizations are what the Privacy Rule actually mandates for non-routine disclosures.
Can a HIPAA authorization be signed electronically?
Yes. HIPAA requires the authorization in writing but does not require a specific technology, so an electronic signature works when it is valid under the ESIGN Act and UETA. HIPAA does not require notarization or a witness, though a provider's policy or a state law occasionally adds one. Fill it in and sign online, or print and sign by hand.
Can I revoke a HIPAA authorization after I sign it?
Yes. You can revoke it at any time by giving written notice to the provider or plan that holds your records. Revoking stops future sharing but cannot undo a disclosure the provider already made while the authorization was in effect, so act promptly if you change your mind. How to revoke is set out in the provider's Notice of Privacy Practices.
Do psychotherapy notes need a separate HIPAA authorization?
Yes. Psychotherapy notes, a therapist's private session notes kept separate from the rest of your record, need their own authorization under HIPAA and cannot be combined with any other request. This template asks you to initial that category separately so it is never swept into a general records release by mistake.
Is the HIPAA authorization form available in Word format?
Yes. Download the HIPAA authorization form as a Word (.docx) file and edit it in Microsoft Word, Google Docs, or Pages. You can also download a PDF or fill it in and sign online.
Can I download the HIPAA authorization form as a PDF?
Yes. A print-ready PDF is available alongside the Word version. Download either one free, or fill it in and sign online without downloading anything.
Live in under a minute
Ready to send your first envelope?
Create your free forever account, upload a document, and send it for signature in minutes. No credit card required.
30 free envelopes a month Legally binding · global Audit trail on every document
