What it is, and what it must contain

A HIPAA authorization is a signed, written permission allowing a health care provider to disclose protected health information to a named person. Federal regulation sets out exactly what a valid one contains.

  • A description of the information to be used or disclosed.
  • The person authorized to make the disclosure.
  • The person to whom the disclosure may be made.
  • A description of each purpose of the disclosure.
  • An expiry date or an expiry event.
  • The individual's signature and the date.

Most providers have their own form at reception. Signing theirs is usually faster than bringing one, and signing several — the GP, the specialist, the hospital — is what actually works.

1

Three documents people confuse

  • A financial power of attorney covers money and property. It does not give access to medical records.
  • A health care proxy names who decides treatment when the patient cannot. It is about decisions, not about being told things while the patient is perfectly capable of deciding for themselves.
  • A HIPAA authorization is about information. It is what lets a doctor return your call.

A family can hold two of these and still be stonewalled at a desk, which is why this small document is worth attention out of proportion to its length.

When you can get information without one

The privacy rule allows a provider to share information relevant to a person's involvement in the patient's care where the patient agrees, does not object when given the chance, or — if the patient is not present or is incapacitated — where the provider judges disclosure to be in the patient's best interests.

That is real, and it is discretionary. A nurse may use it and a records department may not. An authorization removes the judgment call, which is the whole point of having one.

Do not rely on the discretion. It is available at 2am in an emergency room and unavailable on the phone to a billing department three weeks later.

Getting the records themselves, and what it may cost

Being allowed to hear about your parent's care and being able to obtain the file are different rights, and the second one has a deadline attached that almost nobody invokes.

What the rule requires once a request is made

  1. 30 days The provider must act on the requestNot acknowledge it — act on it. The clock runs from receipt of the request, not from when the records department gets to it.
  2. One extension One extension, and only in writingA single further period of the same length is permitted, and only if the provider writes to say why it needs longer and when the records will arrive. An extension nobody told you about is not an extension.

What they may charge for

The fee is limited by what it may consist of rather than by a dollar figure, which is more useful than a cap would be. A provider may charge for the labor of copying, for supplies, for postage, and for preparing a summary if you agreed to one instead of the full record.

It may not charge you for searching for the record or retrieving it. A line item for retrieval, file location or administrative search is not a permitted fee, and saying so — by name — usually resolves it faster than arguing about the total.

Ask in writing, keep the date, and ask for the records in the format you actually want. A portal export and a paper copy are both available, and the format request is part of the right rather than a courtesy.

34

Not sure which of these is yours?

Sahvelo answers from what it has verified, and asks when it needs one more fact.

Prefer a guided path?

Answer a few questions and build a personalized Handbook around your situation.

Build my personalized Handbook

Sahvelo gives information drawn from statutes, agency guidance and official forms. It is not legal advice for your particular situation. Terms & disclaimer.

Questions people ask about this

  • How long does it last?

    As long as the expiry date or event written on it, which is a required element. An open-ended authorization is generally not valid, so an authorization signed years ago may have quietly expired.1

  • Can a parent take it back?

    Yes. An authorization can be revoked in writing at any time, and that is a feature rather than a problem: it is easier to ask someone to sign one when they know they can undo it.

  • Does it still work after death?

    Health information stays protected after death for a period, and access afterwards generally runs through the personal representative of the estate rather than through the authorization. If you need records for an insurance claim, expect to show your appointment rather than the form.

  • How many do we need?

    One per provider in practice. A hospital's authorization does not bind a separate specialist's office, and each one keeps its own. Signing three or four in a single afternoon is the version of this that works.

  • We asked for the records weeks ago and nothing has arrived.

    The rule gives the provider 30 days from receiving the request, and one further period of the same length only if it writes to you explaining the delay and saying when to expect the file. If neither has happened, the request is out of time. Putting that in writing — naming the date you asked and that deadline — resolves most of these without escalation. If it does not, the complaint route is the provider's own privacy officer first, then the federal Office for Civil Rights, and neither costs anything.

  • They want a large fee before releasing anything.

    Ask for the fee broken down. A provider may charge for the labor of copying, for supplies, for postage, and for a summary you agreed to accept instead of the record. It may not charge for the time spent locating or retrieving the file, and a retrieval or search line is the one that most often disappears when questioned. Asking for an electronic copy rather than paper also removes most of the copying and postage entirely.

Where this sits in the process

Related

Sources

HIPAA is federal and the requirements are in the regulation itself.

  1. 45 C.F.R. §164.508 (Uses and disclosures for which an authorization is required)

    What a valid authorization must contain, and that it is its own document.

    ecfr.gov Checked 2026-08-12

  2. 45 CFR §164.502(g) (Uses and disclosures: personal representatives)

    That a health care decision-maker is treated as the patient for privacy purposes, so the access right transfers.

    ecfr.gov Checked 2026-08-19

  3. 45 CFR §164.524 (Access of individuals to protected health information)

    The 30-day clock on a records request, and the single written extension.

    ecfr.gov Checked 2026-08-19

  4. 45 CFR §164.524 (Access of individuals to protected health information)

    What a provider may and may not charge for when releasing records.

    ecfr.gov Checked 2026-08-19

Sources last reviewed 2026-08-12. Where a source is marked pending re-verification, the page says so wherever the claim appears.

The required contents of an authorization are quoted from the federal regulation. The description of when a provider may share without one is a summary of the privacy rule's permission and is applied at the provider's discretion, which is exactly why the form is worth having.