When does a therapist need a HIPAA authorization?

A HIPAA-covered therapist or practice generally needs an authorization when the planned use or disclosure is not otherwise permitted by the HIPAA Privacy Rule. Psychotherapy notes and most marketing uses have specific authorization rules, so review 45 CFR 164.508 rather than relying on a general release or TPO consent.

Is a HIPAA authorization the same as a consent form?

No. A covered entity may obtain consent for treatment, payment, and health care operations, but that voluntary consent is not an authorization for a use or disclosure that requires one. Keep the two documents and workflows distinct.

Can a therapy practice use this authorization example as its form?

No. Use the filled example to see the required information and review questions. Adapt the document to the actual people, information, purpose, expiration, representative authority, state requirements, and practice process, then have your privacy lead or counsel review it.

HIPAAauthorizationprivacyclinical documentationprivate practice

What Is HIPAA Authorization? Requirements for Therapy Practices

Q: What is HIPAA authorization?

HIPAA authorization is a specific written permission for a use or disclosure of protected health information that the Privacy Rule does not otherwise permit. Under 45 CFR 164.508(c), it must identify the information, who may use or disclose it, who may receive it, the purpose, an expiration, and the individual's signature and date, with additional requirements in the regulation.

Priya Mehta · Group & Recovery Therapy Editor · October 22, 2026 · 7 min read

Outline

Worked example Completed authorization for a named records request

Practice: Harbor Street Therapy, PLLC

Client: Jordan Lee

Information authorized: My psychotherapy treatment records from January 1, 2026, through October 9, 2026, excluding psychotherapy notes kept separately by the author.

Person authorized to disclose: Harbor Street Therapy, PLLC and its workforce members who maintain the records described above.

Person authorized to receive: Jordan Lee’s attorney, Morgan Patel, at Patel Health Law, 200 Market Street, Suite 400, Chicago, Illinois 60601.

Purpose: To support Jordan Lee’s disability-benefits appeal.

Expiration: This authorization expires on December 31, 2026, unless revoked earlier in writing.

Client statement: I understand that I may revoke this authorization in writing at any time, except to the extent action has already been taken in reliance on it. I understand that treatment, payment, enrollment, or eligibility for benefits will not be conditioned on signing this authorization, except as the law permits. I understand that information disclosed under this authorization may be subject to redisclosure and may no longer be protected by the federal HIPAA Privacy Rule.

Client signature: Jordan Lee

Date signed: October 9, 2026

This filled example shows the shape of a specific authorization. It is not a federal form and is not ready to use without review. Replace the names, dates, records, recipient, purpose, expiration, and required statements with facts that match the request in front of you. Do not use a broad, blank release because it looks convenient.

What is HIPAA authorization in practice

The short answer to “what is HIPAA authorization?” is specific written permission for a use or disclosure that the Privacy Rule does not otherwise allow. The rule at 45 CFR 164.508 identifies uses and disclosures that require authorization and sets the authorization’s required elements. The answer depends on the specific information, recipient, purpose, and rule behind the request.

The question “what is HIPAA authorization” belongs at the start of every records-release review, before anyone decides that a familiar release form is enough.

An authorization is not the same as a routine treatment, payment, or health care operations workflow. It is also not the same as a client’s general request for access to their own records. Keep the request, the legal basis, and the document you use aligned.

HIPAA authorization elements at a glance

Use this table as a first review. Read the regulation for the complete requirements, including special rules for psychotherapy notes, marketing, compound authorizations, revocation, conditioning, and defective authorizations.

Core element or statement	What it says	Common mistake
Information description	The information to be used or disclosed, described in a specific and meaningful way	Writing “all records” when the request only concerns a defined date range or record type
Person authorized to use or disclose	The covered entity or other person authorized to make the use or disclosure	Naming only the recipient and leaving the releasing practice unclear
Person or class receiving information	The person or class of persons who may receive the information	Leaving the recipient open-ended so staff cannot tell where the records may go
Purpose	The purpose of the requested use or disclosure, unless the authorization is for a disclosure at the individual’s request	Using a vague purpose when the actual request has a defined purpose
Expiration	An expiration date or event	Omitting an end point or treating a general TPO consent as an authorization
Signature and date	The individual’s signature and date, with representative authority when applicable	Filing a signature without documenting who signed for a minor or another individual
Required statements	Notice of revocation, conditioning, potential redisclosure, and other statements required by the rule	Copying a short release sentence that omits required notices

The receiving person, the purpose, and the expiration should make sense together. If the authorization names an attorney for a benefits appeal, a recipient field that says “anyone who asks” is not a meaningful match. When a staff member brings you a new records request, point them to these fields rather than handing them a generic release. If the request changes, stop and review whether a new authorization is needed.

Uses that need special attention

Psychotherapy notes

Psychotherapy notes receive special protection under 45 CFR 164.508(a)(2). A covered entity generally may not use or disclose them without an authorization, subject to the limited exceptions in the rule. The authorization must identify psychotherapy notes as the information to be used or disclosed; an authorization for an ordinary medical record does not automatically do that work. An authorization that names “all treatment records” does not automatically reach psychotherapy notes you keep separately.

Keep psychotherapy notes separate from the rest of the clinical record in your workflow. Before releasing anything, confirm what record set the request actually covers and whether the information is a psychotherapy note or part of the designated record set.

Marketing

Marketing uses and disclosures generally require an authorization under the Privacy Rule. The regulation includes exceptions, including certain face-to-face communications and nominal promotional gifts, so do not treat every educational message or practice communication as the same fact pattern. Review 45 CFR 164.508(a)(3) before using protected health information to promote a product or service.

An authorization for marketing must also address remuneration when the covered entity receives payment from a third party for the communication, as the rule requires. Have your privacy lead or counsel review the message, audience, data source, and payment arrangement before sending it.

Other disclosures outside the ordinary workflow

A release to a named attorney, employer, school, family member, insurer outside an otherwise permitted process, or other third party may require an authorization depending on the facts. Do not decide from the recipient’s label alone. Identify the information, the requested use or disclosure, the legal basis, and the rule that supports the decision.

A client can ask for access to their own protected health information without turning that access request into a third-party authorization. For an access request, follow your practice’s access workflow and the rule that applies to the request.

Review a request before you send records

Use this sequence when a third party asks your therapy practice for protected health information:

Identify the requester and confirm the client’s identity.
Name the exact information requested, including date range and record type.
Decide whether the planned use or disclosure is otherwise permitted or needs an authorization.
Check whether psychotherapy notes, marketing, sale of PHI, or another special rule changes the review.
Match the authorization to the person authorized to disclose, the recipient, the purpose, and the expiration.
Check the signature, date, representative authority, required statements, and any revocation.
Confirm that the authorization is not combined with another document in a way the rule prohibits.
Record the reviewer, decision, disclosure date, and materials sent according to your practice process.

Do not send records merely because the requester supplies a document titled “HIPAA release.” Read the document. If a required element is missing or the request has changed, pause the disclosure and route the question to the person responsible for privacy or to counsel. When a disclosure also raises competing professional duties, use an ethical decision-making worksheet to record the options, consultation, and reasoning; it does not replace HIPAA authorization requirements or legal advice.

Authorization versus other practice documents

A HIPAA authorization is narrower than a general practice intake packet and different from a TPO consent. A notice of privacy practices explains how your practice handles protected health information; it does not itself authorize every disclosure. A business associate agreement governs a covered entity’s relationship with a business associate; it is not a client authorization.

For the difference between an authorization and consent, see the HIPAA consent form sample. For the practice-wide review of vendors and data handling, see the HIPAA compliance guide for solo practitioners. For the categories of information that may identify a client, see the PHI identifiers guide.

Keep the review in your documentation workflow

A signed authorization should be easy for the next reviewer to find and understand. Store the authorization with the related request, record what was disclosed, and preserve the expiration and revocation status. Limit access to the people who need it for the workflow.

Emosapien helps clinicians keep documentation organized for review, while the practice remains responsible for its privacy decisions, access controls, and disclosures.

Keep Disclosure Reviews Together

Draft a structured review note while you check each authorization element.

Start a review note →

Free plan
No credit card

Disclosure review

Fictional practice · Ask

Request says

Confirm the records, recipient, purpose, expiration, signature, and date before sending.

Review-ready draft

Draft a structured note; check each authorization element before signing.

Ask about this request… →

References

Legal Information Institute. (n.d.). 45 C.F.R. § 164.508: Uses and disclosures for which an authorization is required. Cornell Law School.
Legal Information Institute. (n.d.). 45 C.F.R. § 164.508(a)(2): Psychotherapy notes. Cornell Law School.
Legal Information Institute. (n.d.). 45 C.F.R. § 164.508(a)(3): Marketing. Cornell Law School.