HIPAA Consent Form Sample for Therapy Practices

The example is filled so you can see the scope of a HIPAA consent form sample. Do not hand it to a client unchanged. Replace the practice name, explain the uses your practice actually makes, and have the person responsible for your privacy process review the final version. Treat this HIPAA consent form sample as a starting point for that review.

If you want the one-page element sheet while you adapt your policy, email me the HIPAA consent element sample. Keep reading first: the important work is separating this optional TPO consent from an authorization.

Consent and authorization are different documents

The short version belongs at the top of your workflow. Under 45 CFR 164.506(b), a covered entity may obtain consent for uses and disclosures to carry out treatment, payment, or health care operations. The rule also says that consent is not effective when an authorization under 45 CFR 164.508 is required.

The distinction is operationally important: consent for TPO is voluntary, while authorization is required for a use or disclosure the Privacy Rule does not otherwise permit. An authorization is more detailed and specific. Your TPO consent should not claim to do that job.

Element	TPO consent	Authorization	Why it matters
Purpose	Treatment, payment, or health care operations	A specified use or disclosure that needs permission	The purpose determines which document you need
Status	Optional under 45 CFR 164.506(b)	Required when the Privacy Rule requires it	Signing a voluntary consent does not cure a missing authorization
Scope	The TPO uses and disclosures your practice describes	The particular protected health information and use or disclosure described	Narrow scope prevents the documents from making promises they cannot support
Detail	Your practice’s process and plain-language explanation	Required elements under 45 CFR 164.508(c)	The authorization checklist is not interchangeable with a consent summary

Elements to put in your TPO consent

Write the consent around your actual workflow. Avoid copying a broad release phrase that makes the reader guess what the practice does.

Element	What to write	Review question
Practice identity	Legal or operating name of the covered entity	Is the entity named consistently with your notice of privacy practices?
Client identity	The individual whose protected health information is involved	Can staff match the document to the correct record?
TPO uses	Treatment, payment, and health care operations uses your practice makes	Does each example belong to one of the three categories?
People and roles	Staff or providers who need access, plus any workflow detail you choose to explain	Does the description match role-based access in your practice?
Questions	How the client can ask for an explanation before signing	Who answers questions when the clinician is unavailable?
Separate permission	A clear statement that this consent is not an authorization	Would a new staff member know to use the authorization workflow instead?
Signature record	Client signature, date, and your documentation step	Where will you store the signed consent and the review note?

A consent can support a clear conversation, but it does not replace your notice of privacy practices required by 45 CFR 164.520 or another condition that applies to the planned use or disclosure. Check the rule that governs the actual situation.

Authorization elements to check separately

When you need an authorization, build or review that document against 45 CFR 164.508(c). The regulation names the core elements below. A TPO consent that omits them is not an authorization.

Authorization element	What your reviewer should locate	Common scope error
Description of information	A specific and meaningful description of the protected health information to be used or disclosed	”All records” without checking whether the rule and purpose support that scope
Person authorized to use or disclose	The covered entity or other person authorized to make the use or disclosure	Naming only the recipient and not the releasing party
Person receiving the information	The person or class of persons to whom the covered entity may make the disclosure	Leaving the recipient open-ended
Purpose	The purpose of each requested use or disclosure; “at the request of the individual” may be sufficient when the individual initiates the authorization and does not provide a purpose	Treating the purpose as optional when 45 CFR 164.508(c)(1)(iv) requires a description
Expiration	An expiration date or event	Treating an open-ended TPO consent as an authorization
Signature and date	The individual’s signature and date, with representative authority when applicable	Filing a form signed by someone whose authority is not documented

Have your reviewer check the remaining validity, revocation, conditioning, and compound-authorization rules that apply to the planned disclosure. Do not use this article as a substitute for the regulation or for advice about a particular client.

When you need an authorization instead

Use the authorization path when your planned use or disclosure is not otherwise permitted by the Privacy Rule and does not fit an exception that removes the authorization requirement. The exact rule depends on the situation, so review the applicable provision before relying on the document.

Use this short handoff checklist before you send information:

• Name the information you plan to use or disclose.
• Name the person or organization that may use or disclose it.
• Name the person or organization that will receive it.
• State the purpose and the expiration required for the authorization.
• Check the signature, date, representative authority, revocation, and conditioning requirements.
• Ask your privacy lead or counsel to review unusual, broad, compound, or legally sensitive requests.
• Store the signed authorization with the record and follow your retention and access process.

A request for a copy of a record, a provider-to-provider treatment disclosure, a payer claim, and a release to a named third party can follow different rules. Do not solve all four with one blank “HIPAA release” form.

Download the HIPAA consent element sample

The download is a working aid, not a jurisdiction-ready legal form. Use this HIPAA consent form sample beside your policy review, then document the version you approved and the date you approved it.

For the client-facing treatment agreement, see the informed consent form for counseling. For the privacy notice that explains your broader practices, see the notice of privacy practices. If the request is specifically for a release that needs authorization elements, use the HIPAA authorization guide.

References

• Legal Information Institute. (n.d.). 45 CFR § 164.506: Uses and disclosures to carry out treatment, payment, or health care operations. Cornell Law School.
• Legal Information Institute. (n.d.). 45 CFR § 164.508: Uses and disclosures for which an authorization is required. Cornell Law School.
• Legal Information Institute. (n.d.). 45 CFR § 164.520: Notice of privacy practices for protected health information. Cornell Law School.