Form · Privacy
HIPAA authorization form
What it is, who uses it, and field-by-field help. Publisher: HHS rule (45 CFR 164.508); sample text written by Rivvi. Links checked October 23, 2026.
Quick answer
Run it in Rivvi
Get help with the 45 CFR 164.508
Ask RivviFree to start, no card. Opens Rivvi, the AI workspace for healthcare teams, with this question filled in.
At a glance
- Rule
- 45 CFR 164.508
- Government form
- None. Each covered entity uses its own form meeting 164.508(c).
- Core elements
- 6
- Required statements
- 3: right to revoke, conditioning, redisclosure
- Language
- Plain language; the person gets a copy
- Government form
- None published nationally; see the links below
Who uses it
- Patients allowing a provider or plan to share their records with someone else, such as a lawyer, employer, or insurer
- Covered entities using PHI for marketing or other purposes that need permission
- Researchers, when no waiver applies
Core elements (164.508(c)(1))
- Description of the information
- What will be used or disclosed, specific enough to identify it (for example, lab results from January 2026 to now).
- Who may disclose
- The person or class of persons allowed to make the disclosure.
- Who may receive
- The person or class of persons the information may go to.
- Purpose
- Each purpose. "At the request of the individual" is enough when the person starts the request.
- Expiration
- A date or an event that ends the authorization.
- Signature and date
- The person's signature and date. A personal representative also describes their authority.
Required statements (164.508(c)(2))
- Right to revoke
- The person can revoke in writing, with the exceptions and how to revoke, or a reference to the notice of privacy practices.
- Conditioning
- Whether treatment, payment, enrollment, or eligibility can depend on signing.
- Redisclosure
- Information disclosed may be redisclosed by the recipient and no longer be protected.
Sample HIPAA authorization (template)
Sample, not legal advice. Sample text written by Rivvi to show the elements of 45 CFR 164.508(c). It is not legal advice and not a government form. State law can add requirements (for example, for mental health, HIV, or substance use records). Have counsel review before use.
AUTHORIZATION TO USE OR DISCLOSE HEALTH INFORMATION Patient name: ____________________ Date of birth: __________ 1. I authorize: ______________________________ (name of provider or plan disclosing) 2. To disclose to: ______________________________ (name and address of recipient) 3. This information: ______________________________ (describe the records and dates) 4. For this purpose: ______________________________ (or "at my request") 5. This authorization expires on: __________ (date) or when: __________ (event) I understand that: - I may revoke this authorization at any time by writing to ____________. Revoking does not affect anything already done in reliance on it. See the notice of privacy practices for exceptions. - [Choose one] My treatment, payment, enrollment, or eligibility for benefits will not depend on whether I sign. / If I do not sign, the following will happen: ____________. - Information disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by federal privacy rules. - I will receive a copy of this form. Signature: ____________________ Date: __________ If signed by a personal representative: name __________ and authority to act (for example, parent, guardian, health care agent) __________
Related pages
Questions
Is there a government HIPAA authorization form?
No. HHS sets the required contents in 45 CFR 164.508(c); each provider or plan uses its own form that meets them.
Do I need an authorization to get my own records?
No. Getting your own records is a right of access request under 45 CFR 164.524, not an authorization. See the release of information page.
How long does a HIPAA authorization last?
Until the expiration date or event written on it, or until you revoke it in writing.