HIPAA authorizations: when the plan needs written permission.
The Privacy Rule lets a plan use and share information for payment, operations and a list of other purposes without asking. Anything outside that list generally needs the individual’s signed authorization. Here is how to tell the difference.
The basics of an authorization.
A Signed, Specific Permission
An authorization is a detailed document that lets a plan use or disclose protected health information for a purpose the rules do not otherwise allow. For an employer, the practical point is that staff should not rely on informal verbal permission or a general form when a signed authorization is needed. Counsel can help prepare a form that fits the plan.
It Is Separate From A General Consent
It has to describe the information, who may disclose it, who may receive it, the purpose, an expiration and the individual’s signature and date. A plan should keep the authorization form separate from the enrollment packet and other forms, and should have counsel review the wording so that it contains each required element and is easy to read.
Marketing Needs One
HHS says an authorization is expressly required for marketing communications, with two narrow exceptions. Employers should check any communication that promotes products or services using health plan information, and ask counsel whether an authorization applies before the communication goes out.
It Can Be Revoked
HHS confirms an individual can revoke an authorization, generally in writing, for future disclosures. Staff should know how to accept and record a revocation, and tell the carrier or administrator promptly. Counsel can confirm how the plan should handle anything already done in reliance on the authorization.
What a valid authorization requires.
When It Is Needed
An authorization is required for uses and disclosures that the rules do not otherwise permit, including most uses of psychotherapy notes, marketing, and sale of health information. If staff are unsure whether a request needs an authorization, they should pause and ask counsel or the privacy official before sharing any health information, and record the answer in the plan file.
Core Elements
It must describe the information, name who may disclose it and who may receive it, state the purpose, give an expiration date or event, and carry the individual’s signature and date. A good form is complete, dated and signed, and written in plain language. Counsel can prepare or review a template, and staff should check each signed form for missing items before acting on it.
Required Statements
It must tell the individual about the right to revoke, whether treatment, payment, enrollment or eligibility can be conditioned on signing, and the possibility of redisclosure. Employers should make sure the form includes each required statement and that staff do not add pressure or conditions that conflict with them. Counsel can confirm the current wording for the plan.
Conditioning Is Limited
Treatment, payment, enrollment and eligibility generally cannot be conditioned on signing an authorization, with narrow exceptions such as certain pre-enrollment authorizations by a health plan. Staff should not suggest to employees that coverage or enrollment depends on signing an authorization. Counsel can confirm the narrow situations where the rules allow an exception.
Revocation
An individual can revoke an authorization at any time, but the revocation must be in writing, and it does not undo actions already taken in reliance on it. The plan should have a simple way to receive a revocation, a named person to record it and a process to tell vendors, and counsel can confirm how it affects uses already made.
Psychotherapy Notes
An authorization for psychotherapy notes generally cannot be combined with another authorization, and a plan cannot condition enrollment or eligibility on it. Because these notes receive special treatment, employers should ask counsel before any request involving them, and make sure staff know it should be handled separately from other forms and requests.
Source: 45 CFR 164.508.
Handling requests in practice.
Sort The Request First
Ask whether the use is payment, plan operations or another permitted purpose. If not, an authorization is likely needed. A short intake question helps staff sort requests quickly. If the answer is unclear, send the request to the privacy official or counsel before releasing any health information.
Use A Complete Form
Keep a standard form with every required element, so staff are not improvising on a call. Counsel can review the template, and staff should keep a clean copy on file, check every signed form for missing elements and avoid editing the standard wording without review.
Track Expirations And Revocations
Record the scope and end date of each authorization, and stop disclosures when one is revoked. A simple log or calendar reminder works well. Staff should also tell vendors when an authorization ends or is revoked, and record the date on which the notice was sent.
Do Not Pressure Employees
A plan generally cannot make treatment, payment, enrollment or eligibility depend on an authorization, with limited exceptions. Training should remind managers and HR staff not to suggest that enrolling or keeping coverage depends on signing a form, and counsel can confirm the narrow exceptions that may apply.
Three questions before sharing.
Is This A Permitted Use Already
If it is payment or operations, an authorization is probably not the tool. Many routine requests, such as paying a claim or running the plan, are covered by other rules. Staff should check with the privacy official or counsel before asking an employee for a signature.
Who Is Asking And Why
A manager, a family member and a broker each raise different questions. Confirm who the requester is and what the purpose is. Verify the identity and role of the person asking, confirm that they are allowed to receive the information, and share only what is needed. Counsel can help set a simple verification step.
Is There A Narrower Way
Often a summary or a de-identified report meets the need without an authorization. Before asking for an authorization, consider whether a summary or aggregate report would meet the same need. Counsel can help decide when a narrower approach is appropriate.
Common Questions About HIPAA Authorizations
Does a spouse calling about a claim need an authorization?
It depends on the plan’s procedures and the facts. Plans often rely on authorizations or other documented permissions, so ask us to review yours.
Can we require an authorization to enroll?
Only in limited situations. A health plan may condition enrollment or eligibility on an authorization requested before enrollment for certain eligibility, enrollment, underwriting or risk rating purposes. Check with counsel.
Can an employee cancel one?
Yes. An individual can revoke an authorization, and the revocation applies going forward.
Does a broker helping with a claim need one?
If the broker is a business associate of the plan, an agreement may cover it. If the broker acts for the employee, the employee’s permission matters. We can walk through your setup.
Is an authorization the same as a business associate agreement?
No. An authorization is permission from the individual. A business associate agreement is a contract between the plan and a vendor.
Is this legal advice?
No. For a specific request, involve your counsel. We can help you frame it.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
Laws and rules referenced
45 C.F.R. § 164.508 — Authorizations for uses and disclosures of protected health information, including marketing and psychotherapy notes.
This page is general information, not legal or tax advice. Rules change and facts matter, so confirm your situation with counsel or a qualified advisor.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.