HIPAA authorization

What it is

A HIPAA authorization is the patient's written permission for a provider or health plan to disclose protected health information to someone else. Plaintiff firms collect one at signing so they can request records and bills from every provider who treated the client.

The rules

Under 45 CFR 164.508(c), a valid authorization must contain a specific description of the information; who may disclose it; who may receive it; the purpose ("at the request of the individual" is enough when the patient starts the request); an expiration date or event; and the patient's signature and date, with a description of authority if a representative signs. It must also state the right to revoke in writing, whether treatment can be conditioned on signing, and that disclosed information may be redisclosed. It must be in plain language, and the patient gets a copy. Psychotherapy notes need their own authorization.

California adds requirements. Under the Confidentiality of Medical Information Act, Civil Code 56.11, an authorization must be handwritten by the signer or in at least 14-point type, and must state the specific uses and an end date. Evidence Code 1158 requires a provider to make records available within five days after an attorney presents the patient's written authorization.

Why it matters to a plaintiff firm

A defective form means a rejected request and weeks lost. Firms keep one current template that meets both HIPAA and the CMIA, send it for signature with the retainer, and track each request until the records arrive. Our records request letter generator helps with the cover letter.