HIPAA consent or HIPAA authorization?
The Privacy Rule uses two different words, and the forms people search for are almost always the second one. A consent, under 45 CFR 164.506(b), is optional: a provider may ask clients to agree to the use of their information for treatment, payment and health care operations, but doesn't have to. An authorization, under 45 CFR 164.508, is required whenever no other rule permits the disclosure, and its contents are fixed.
That split decides a lot of everyday questions. When a client's psychiatrist calls to coordinate medication, HIPAA lets you share what's needed for that provider's treatment of the client without an authorization (164.506(c)). When a life insurer, an attorney or the client's employer wants records, you need one. Psychotherapy notes kept apart from the record are different again: releasing them takes an authorization even when the recipient is another clinician treating the client (164.508(a)(2)).
State law can be stricter than HIPAA, and many states protect mental health records more tightly. A state privacy law that is more stringent than the Privacy Rule stays in force (45 CFR 160.203(b)), so some states require a signed release where HIPAA wouldn't. Check your state's rules before you decide a release can go without a form.
| | |
|---|
The client's new therapist asks for a treatment summary | No authorization for another provider's treatment, unless state law requires one | Many practices still use this template |
The client asks you to send records to their attorney | | |
A disability or life insurer asks for records | | |
Anyone asks for psychotherapy notes | An authorization for psychotherapy notes only | This template, psychotherapy notes version |
The client wants a copy of their own record | No authorization: it's the client's right of access under 164.524 | |
For consent to therapy itself, use the consent form template. For general medical records requests, see the medical release form template.
What a valid authorization contains
Element (45 CFR 164.508(c)) | | |
|---|
The information to release | A specific, meaningful description, such as dates of service, diagnosis and a treatment summary | |
| | Leaving it blank to fill in later |
| A named person, organization or class of recipients | A company name with no department or claim number |
| Why it's being released. If the client starts the request and gives no reason, "at the request of the individual" is enough | |
| A date, or an event tied to the purpose | |
| The client's, or a personal representative's with a description of their authority | A parent signs for an adult child with no stated authority |
| That the client can revoke in writing, the exceptions, and how to do it | |
| Whether treatment or payment can depend on signing it (for a therapist, almost always: it can't) | |
| That the recipient may pass the information on without HIPAA protection | |
The form has to be in plain language, and when you ask a client to sign one, you have to give them a copy of the signed form (164.508(c)(3) and (c)(4)).
HIPAA authorization example
Marcus is a fictional client, and the insurer and practice are invented. Nothing below describes a real person or company.
Client: Marcus, 47, in weekly therapy since January for depression after a back injury. He has filed a long‑term disability claim and the insurer has asked for his mental health records.
Information to be released: Dates of service from January 6 to October 28, 2026; diagnosis; current treatment plan; and a treatment summary letter written for this request. Psychotherapy notes are not included.
Released by: Maple Row Counseling, the practice where Marcus is seen.
Released to: Northfield Mutual, long‑term disability claims unit, claim number on the form.
Purpose: Evaluation of my long‑term disability claim.
Expires: March 31, 2027, or when a final decision is made on the claim, whichever comes first.
Statements: Marcus may revoke the authorization in writing to the practice address, except for anything already released in reliance on it. His treatment does not depend on signing. Once Northfield Mutual has the information, HIPAA may no longer protect it.
Signed: Marcus, November 3, 2026. He was given a copy the same day, and the original is in his record.
Three weeks later the insurer wrote back asking for "complete records including all session notes." The therapist sent what the authorization listed and nothing more, and replied that any further records, including psychotherapy notes, would need a new authorization from Marcus.
Copy this onto your letterhead. Fill in every field before the client signs. For psychotherapy notes, use a separate copy of the form that releases nothing else.
- Client name and date of birth:
- Information to be released: [specific description: dates, document types, topics]
- Released by: [practice or clinician name]
- Released to: [name, organization, address, reference number]
- Purpose: [reason, or "at the request of the individual"]
- This authorization expires on: [date or event]
- Right to revoke: I may revoke this authorization at any time by writing to [address]. Revoking it does not affect information already released in reliance on it.
- Treatment: My treatment, payment, enrollment or eligibility for benefits will not depend on whether I sign this form.
- Redisclosure: Information released under this authorization may be disclosed again by the recipient and may no longer be protected by federal privacy law.
- Signature and date:
- If signed by a personal representative: [name and description of authority, such as legal guardian or health care power of attorney]
- Copy given to the client on: [date]
When an authorization is defective
A signed form isn't automatically good. Under 45 CFR 164.508(b)(2), an authorization is not valid if:
- its expiration date has passed, or you know the expiration event has happened;
- it hasn't been filled out completely;
- you know it has been revoked;
- it's missing a required element;
- it's combined with another document in a way the rule doesn't allow;
- you know something material in it is false.
Read a form that arrives from an attorney or insurer against that list before releasing anything. Their forms are often written for medical records in general and leave out the statements HIPAA requires.
Revocation and record keeping
A client can revoke an authorization in writing at any time. The revocation doesn't undo releases you already made while relying on the form (164.508(b)(5)). File the signed authorization, any revocation and a note of what you sent and when. The Privacy Rule requires a signed authorization to be retained (45 CFR 164.508(b)(6)), and state record rules may set a longer period.
Common HIPAA authorization mistakes
- Releasing "any and all records" because the requester's form said so.
- No expiration date or event.
- Staff filling in blank fields after the client has signed.
- Folding a psychotherapy notes release into a general records release.
- Telling a client they can't continue therapy unless they sign a release for a third party.
- Asking a client to sign an authorization to get a copy of their own record. That's a right of access request under 45 CFR 164.524, not a disclosure.
Where Twofold fits
Twofold doesn't send records or collect signatures. Its part is the session note: when a client asks in session for records to go to an insurer or a lawyer, the draft note can record the request and what you agreed to release, and you file the signed authorization with it. Our article on psychotherapy notes explains why keeping process notes separate changes what an authorization has to cover, and AI therapy notes explains how the drafts are made.
Consent form template, medical release form template, notice of privacy practices template, telehealth consent form template and mental health referral form template.
Reviewed and updated November 2026.
