What must a HIPAA authorization include?

A valid HIPAA authorization must contain six core elements: a description of the information, who may make the disclosure, who may receive it, a description of each purpose, an expiration date or event, and the individual's signature and date (45 CFR 164.508(c)).

In plain words, the form must say what information is shared, who shares it, who receives it, why, and when the permission ends. The individual must also sign and date the form, and the form must carry the statements that 45 CFR 164.508(c) requires.

What are the core elements of a HIPAA authorization?

A valid HIPAA authorization must contain six core elements and the required statements, and the authorization must be written in plain language. The table below lists each one with its citation.

A form that leaves out any one of the core elements does not meet 45 CFR 164.508(c)(1). The core elements are the same for every authorization, whatever the disclosure is for.

Which section of 45 CFR sets the authorization requirements?

45 CFR 164.508 is the HHS regulation that sets the authorization requirements for HIPAA. Paragraph (c)(1) lists the six core elements, and paragraph (c)(2) lists the required statements, which include the right to revoke in writing. Paragraph (c)(3) requires plain language. Paragraph (a)(2) addresses psychotherapy notes, which need an authorization except in narrow cases.

Do psychotherapy notes always need an authorization?

Psychotherapy notes need an authorization for any use or disclosure, except three narrow cases and certain uses the rule requires or permits. The three cases are the originator's own treatment use, the covered entity's own training programs, and its defense of a legal action the individual brought. The rest of the exceptions cover uses the rule requires or permits under 164.502(a)(2)(ii), 164.512(a), 164.512(d), 164.512(g)(1), and 164.512(j)(1)(i), such as oversight of the originator under 164.512(d). Outside those exceptions, every use or disclosure of psychotherapy notes needs an authorization that meets 164.508(c).

Does the HIPAA authorization rule apply to a small practice?

The authorization requirements in 164.508(c) set no different rule by practice size. A valid authorization contains the same six core elements whether the practice is small or large, and the required statements and the plain language rule apply in the same way.

Must a HIPAA authorization say the individual can revoke it?

The authorization must state the individual's right to revoke in writing. The required statements also cover whether treatment, payment, enrollment, or eligibility can be conditioned on signing, and that redisclosure may end HIPAA protection. Those statements sit under 164.508(c)(2).

What changes when a representative signs a HIPAA authorization?

When a representative signs, the authorization must add the representative's authority to the individual's signature and date. The core element sits in 164.508(c)(1), and the representative's authority is part of that element.

How does the HIPAA authorization rule apply to faxing?

A fax that discloses psychotherapy notes requires a valid authorization before the fax is sent, unless one of the exceptions applies. The core elements and required statements apply to a faxed disclosure in the same way they apply to any other disclosure. A signed form that leaves out the expiration date or event does not meet 164.508(c)(1).

A patient's consent to fax records is covered in patient consent to fax medical records. Records answered by fax are covered in how to respond to a medical records request by fax. Substance use disorder records are covered separately in whether you can fax substance use disorder records.

* The regulation text was read at law.cornell.edu on October 13, 2026.