HIPAA requires that a valid authorization be written in plain language, and it must contain the following:
Core elements:
- A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion
- The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.
- The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested
use or disclosure.
- A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a
sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement
of the purpose.
- An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement
“end of the research study,” “none,” or similar language is sufficient if the authorization is for a use or
disclosure of protected health information for research, including for the creation and maintenance of a research database or research
repository.
- Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of
such representative’s authority to act for the individual must also be provided.
Notification Statements
In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the
following:
- The individual’s right to revoke the authorization in writing, and either:
- The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or
- To the extent that the information required by the previous paragraph is included in the required notice of the entity's
privacy policy, a reference to the covered entity’s notifying individuals about its privacy policy.
- The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating
either:
- The covered entity may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs
the authorization when the prohibition on conditioning of authorizations applies (164CFR508(b)4); or
- The consequences to the individual of a refusal to sign the authorization when the covered entity is allowed to condition
treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization.
- The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be
protected by this subpart.
An authorization containing these elements (and any others not inconsistent with these elements) can be combined with the research
consent form, unless the HIPAA authorization relates to psychotherapy notes.