HIPAA Authorization

A HIPAA Authorization is a legal document that allows an individual's health information to be used or disclosed to a third party. It is required under the Health Insurance Portability and Accountability Act in the US. The authorization must be written in plain language and include: description of information to be disclosed, who may disclose and receive the information, purpose of disclosure, expiration date or event, signature and date, and statement of individual's rights to revoke. Unlike general HIPAA consent for treatment/payment/operations, authorizations are needed for disclosures beyond routine healthcare activities such as sharing records with attorneys, employers, schools, or for marketing. The authorization must be specific about what information is released - blanket authorizations are not valid. Individuals have the right to revoke authorization at any time. Healthcare providers must maintain signed authorizations and document disclosures made pursuant to them.