HIPAA Release Authorization

HIPAA Release Authorization

Generates a 45 CFR §164.508-compliant authorization permitting designated recipients to access a patient's protected health information (PHI) from covered entities, typically in an estate-planning context.

Quick Start

Gather before drafting:

1. Jurisdiction — state governs signature and witness/notary formalities
2. Patient identity — legal name, DOB, contact details
3. Recipients — healthcare agent, successor agent(s), other representatives
4. Disclosing entities — providers, hospitals, labs, pharmacies, health plans
5. PHI scope — all records or limited categories
6. Purpose and duration — expiration date, event, or condition
7. Representative authority (if applicable) — POA, guardianship order, court appointment
8. Related documents — healthcare proxy, advance directive for terminology alignment

Required Sections

Every authorization must include these elements per §164.508:

Draft Workflow

1. Confirm inputs against the Quick Start checklist; flag any gaps.
2. Select PHI scope — if client wants full-record access, state it unambiguously; otherwise enumerate categories. Sensitive categories (substance use, mental health, genetic, HIV/AIDS) require explicit inclusion [VERIFY].
3. Draft the form using this structure:
   • Title citing 45 CFR §164.508
   • Patient identification block
   • Authorization statement
   • Disclosers list
   • Recipients list (match names/roles to healthcare POA document)
   • PHI scope with checkbox-style selection
   • Purpose statement tied to healthcare directives
   • Duration clause (date, revocation, or death — whichever first)
   • Patient rights / required statements (all six §164.508 notices)
   • Execution block (patient, then representative if signing on behalf)
   • Witness/notary block if state law applies
4. Validate — all placeholders visible, recipients consistent across sections, terminology aligns with governing POA/directive.
5. Add state-specific addendum only when confirmed for target jurisdiction.

Pitfalls

• Never authorize broader disclosure than needed unless client explicitly requests full-record access.
• Never leave recipient or discloser fields unidentified.
• Never leave representative signature fields blank without authority documentation.
• Federal law is not exclusive — state mandates may impose additional form requirements [VERIFY].
• Estate-planning variants must match healthcare POA terminology in the core delegation document [VERIFY].
• Include attorney-review language in cover memo if template is client-facing.