Definition
A HIPAA authorization is a patient's specific, signed permission to use or disclose their protected health information (PHI) for purposes outside treatment, payment and health care operations. HIPAA "consent" for those routine purposes is optional. Under HIPAA, an authorization is a defined form that must contain required elements, while consent for treatment, payment and health care operations (TPO) is something a covered entity may choose to collect but does not have to (45 CFR 164.506(b)). This pair is one of the most commonly confused in the healthcare operations glossary. The desk-level rule of thumb is simple: if the disclosure is not for TPO, check whether you need a signed authorization.
In practice at a clinic or small practice
At the front desk. A patient asks the clinic to send records to a life insurer, an employer or an attorney. That usually needs a signed authorization, because the disclosure falls outside TPO (45 CFR 164.508(a)(1)). Sending records to a specialist for a referral generally does not need one, because it is a treatment disclosure (45 CFR 164.506(c)). A patient asking for a copy of their own records is different again. That is an access request under the patient's right of access, not an authorization, and it follows its own rules and timelines (45 CFR 164.524).
In the office manager's review. Before records go out under an authorization, the office manager checks four things:
- The form has the required elements.
- It has an expiration date or expiration event.
- It is signed and dated.
- The release matches what the form describes.
For payment and operations disclosures, the minimum necessary standard applies instead. Disclosures made under a valid authorization are limited by the authorization itself (45 CFR 164.502(b)(2)).
The signed form is filed and retained for at least six years (45 CFR 164.530(j)). The patient can revoke it in writing at any time, except to the extent the practice has already acted on it (45 CFR 164.508(b)(5)). The practice generally cannot make treatment conditional on signing an authorization. Narrow exceptions exist, such as research-related treatment or care provided only to create information for a third party, like a pre-employment physical (45 CFR 164.508(b)(4)).
Staff should discuss records requests only in the practice's approved internal channels, not in personal texts or group chats.
Not to be confused with
| Term | What the patient signs or agrees to | Source of the rule |
|---|---|---|
| HIPAA authorization | Specific permission for a defined non-TPO use or disclosure | HIPAA Privacy Rule (45 CFR 164.508) |
| HIPAA consent for TPO | General permission for routine treatment, payment and operations; optional | HIPAA Privacy Rule (45 CFR 164.506(b)) |
| Informed consent to treatment | Agreement to a procedure after the risks, benefits and alternatives are explained | State law and medical ethics, not HIPAA |
| Notice of Privacy Practices acknowledgment | Confirmation that the patient received the notice | HIPAA Privacy Rule; a good-faith effort is required (45 CFR 164.520(c)(2)(ii)) |
Informed consent is a separate clinical form. Signing it does not authorize any disclosure of records.
An NPP acknowledgment is neither consent nor authorization. A refusal to sign it does not block treatment.
Some records carry stricter consent rules than HIPAA. Examples include substance use disorder records under 42 CFR Part 2 and certain records covered by state law.
What the rules say
The primary source is the HIPAA Privacy Rule, administered by the HHS Office for Civil Rights.
Core elements of a valid authorization (45 CFR 164.508(c)):
- A specific description of the information to be used or disclosed
- Who may disclose it and who may receive it
- The purpose of the use or disclosure
- An expiration date or event
- The patient's signature and date, or a personal representative's signature with a description of their authority
- Required statements covering:
- the right to revoke
- whether treatment can be conditioned on signing
- the potential for redisclosure by the recipient
An authorization is always required for:
- Psychotherapy notes, with limited exceptions (45 CFR 164.508(a)(2))
- Most marketing communications (45 CFR 164.508(a)(3))
- Any sale of PHI (45 CFR 164.508(a)(4))
Consent: covered entities may, but are not required to, obtain consent for TPO (45 CFR 164.506(b)).
State law can add consent requirements beyond HIPAA. Check your state's rules and your privacy officer before adopting a form or workflow. This page is general information, not legal advice.
Related reading
- HIPAA Privacy Rule: what the rule covers, who it applies to and how permitted uses and disclosures are structured.
- Notice of Privacy Practices: what the notice must say, when to give it and how to handle the acknowledgment.
- Security, HIPAA and BAA overview: how the site documents security controls and BAA availability for internal staff communication.
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.