HIPAA Authorization Requirements (45 CFR 164.508)
Required elements and statements for a valid HIPAA authorization, plus the prohibition on combining authorizations with other documents in most circumstances.
Primary source
45 CFR 164.508 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.508 sets the elements of a valid HIPAA authorization to use or disclose PHI for any purpose not otherwise permitted. The required elements are: a specific and meaningful description of the information; the persons authorized to disclose it; the persons authorized to receive it; the purpose; an expiration date or event; the individual's signature and date; and three required statements covering the right to revoke, the ability to condition or not condition treatment on the authorization, and the potential for re-disclosure.
A defective authorization (missing element, expired, known to be revoked, contains material misrepresentation, or combined with another authorization or document in a prohibited way) is invalid and cannot support disclosure. Combinations with other documents are prohibited except in narrow circumstances laid out in 164.508(b)(3).
Many state laws require additional elements for specific disclosure types (mental health, HIV, substance use). The covered entity must follow the more stringent standard. Authorizations executed under 42 CFR Part 2 for SUD records are separately regulated and have stricter content requirements.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Marketing Restrictions (45 CFR 164.508(a)(3))Most communications encouraging an individual to purchase or use a product or service require a HIPAA-compliant authorization, with narrow exceptions for face-to-face communications and promotional gifts of nominal value.
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- RegulationHIPAA Research Uses and Disclosures (45 CFR 164.512(i))Research uses of PHI without individual authorization require either IRB or Privacy Board waiver, a limited data set with data use agreement, or reviews preparatory to research and decedent research with specific safeguards.
- SRAHIPAA Patient Right of Access: A Small-Practice WalkthroughHow 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.
- ComplianceHIPAA Subpoena Response: Court Order vs Administrative Subpoena (45 CFR § 164.512)Court order, civil subpoena, grand-jury subpoena, DEA administrative demand — each triggers a different HIPAA response path. Identify the type before you produce a single record.
- Glossary42 CFR Part 2 (SUD Records)Federal regulation providing heightened confidentiality protection for substance use disorder treatment records.
- ComplianceBehavioral Health Compliance: 42 CFR Part 2 + HIPAA TogetherHow SAMHSA's 42 CFR Part 2 framework for substance use disorder records overlays HIPAA after the 2024 final rule alignment, and what behavioral health practices must document.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.