The HIPAA authorization

The problem it solves

Federal privacy law bars providers from discussing your care with anyone you have not authorized — including a spouse or an adult child. Families discover this at the worst possible moment, when a hospital will not return a phone call.

A HIPAA authorization removes that obstacle. It is not a decision-making document: it only permits disclosure, which is exactly why it is safe to give to a wider circle than your healthcare agent.

Categories that need their own authorization

Mental-health and psychiatric records, substance use disorder treatment records (protected separately by 42 C.F.R. Part 2), HIV testing and treatment records, and genetic test results receive heightened protection under federal or state law. A general authorization often will not release them, so this document names them expressly — and lets you exclude any category you would rather keep private.

Scope, duration and revocation

• Scope: your complete record, or only what is needed to make health care decisions.
• Billing and claim records: useful when someone has to sort out insurance for you.
• Duration: open-ended until you revoke it in writing, or ending on a date you choose.
• Revocation: in writing to the provider holding your records, effective except where it has already been relied on.
• No conditioning: treatment, payment and eligibility for benefits cannot be made contingent on your signing it.