Current Suspected Overdose Deaths in Delaware for 2024: Get Help Now!

Find school water testing results and additional resources

Attention Medicaid Participants: Eligibility Renewals Restarted April 1, 2023

Delaware.gov logo

Human Subjects Review Board HIPAA Guidelines for Authorization


HIPAA requires that a valid authorization be written in plain language, and it must contain the following:

Core elements:

  1. A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion
  2. The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.
  3. The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure.
  4. A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.
  5. An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement “end of the research study,” “none,” or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository.
  6. Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual must also be provided.

Notification Statements

In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following:

  1. The individual’s right to revoke the authorization in writing, and either:
    1. The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or
    2. To the extent that the information required by the previous paragraph is included in the required notice of the entity's privacy policy, a reference to the covered entity’s notifying individuals about its privacy policy.
  2. The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating either:
    1. The covered entity may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization when the prohibition on conditioning of authorizations applies (164CFR508(b)4); or
    2. The consequences to the individual of a refusal to sign the authorization when the covered entity is allowed to condition treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization.
  3. The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this subpart.

An authorization containing these elements (and any others not inconsistent with these elements) can be combined with the research consent form, unless the HIPAA authorization relates to psychotherapy notes.



+