Templates / Standard authorization form

Compliance and security

Standard authorization form

Free PDF • 2 pages, print-ready • Clinician-reviewed

Anja Dodevska Last updated November 13, 2026 Reviewed by Dr. Vanja Kitanova

---

A standard authorization form is a written document in which a patient lets a healthcare provider use or share their protected health information. Only the patient signs it, and it grants permission without creating a treatment agreement the way a consent form does. Practices need one before releasing records for a purpose HIPAA does not otherwise permit, such as a request from a lawyer or an employer.

Template details

Template type

Form

Format

Printable PDF, 2 pages

Sections

4 sections

Fields to complete

9 fields

Best for

Compliance and security

Key takeaways

Only the patient signs a standard authorization form, and it permits sharing specific health information with a named party.

HIPAA requires six core elements and three statements under 45 CFR 164.508, and a form missing one is invalid.

A patient asking for their own records makes an access request under 45 CFR 164.524, which needs no authorization.

Patients can revoke a signed authorization in writing, except where the practice has already acted on it.

Pabau sends authorizations to patients before the visit and stores each signed copy in the patient record.

What is a standard authorization form?

A standard authorization form records a patient’s written permission for a provider to use or disclose specific health information. Under HHS guidance on the Privacy Rule, an authorization is required for any use or disclosure the rule does not otherwise allow.

That usually means a purpose outside treatment, payment and health care operations, or a release to a third party the patient names. A lawyer, an employer and a life insurer are typical recipients. The same rule sets the elements a valid authorization must contain, covered below.

The form differs from a medical consent form, which records agreement to a treatment, with risks and responsibilities on both sides. An authorization covers permission to share information, and only the patient signs to grant it.

A practice’s notice of privacy practices tells patients which disclosures need no authorization at all, such as sharing records with another clinician for treatment.

Types of authorization forms in healthcare

Practices handle three kinds of authorization paperwork. Each one governs a different kind of request, so a single form rarely covers every case.

HIPAA authorization requirements

A HIPAA authorization must be written in plain language and must include the six core elements listed in 45 CFR 164.508. Missing any one of them makes the authorization invalid.

• A specific description of the information to be used or disclosed
• The name of the person or organization authorized to disclose it
• The name of the person or organization that will receive it
• A description of each purpose of the disclosure
• An expiration date or event
• The patient’s signature and the date

The form must also carry three statements. It explains the patient’s right to revoke in writing, whether treatment can be conditioned on signing, and that the recipient may re-disclose the information. The patient receives a copy of the signed form.

Our HIPAA authorization form sets out the same elements for practices that want a version written around HIPAA alone.

Prior authorization request forms for health plans

Insurers use prior authorization forms to confirm coverage before a service is delivered. No single national form covers every health plan. CMS publishes a model coverage determination request form for Medicare Part D drug coverage only, and plan sponsors may use their own versions.

Some states set one standard form for health care services. In Texas, health benefit plan issuers must accept the Texas standard prior authorization form whenever a plan requires prior authorization.

Authorization to release medical records

A records release authorization lets a practice send a patient’s file to a named recipient, such as a lawyer or an employer. A patient asking for their own records makes an access request under 45 CFR 164.524 instead. Providers must act on it within 30 days, and state rules may set shorter timelines.

The chart below routes each kind of request to the document it needs.

What to include in a standard authorization form

Every field on the form carries a legal function. The template groups them into four sections, and each needs checking before a patient signs.

1. Patient identification: Full name, date of birth, Social Security number and address
2. Disclosing entity: The provider or health plan releasing the information
3. Recipient: The person or organization receiving it, with contact details
4. Purpose: The specific reason for the disclosure
5. Scope: The health information covered, with an optional date range
6. Expiration: A date or event that ends the authorization
7. Revocation and re-disclosure: How the patient can withdraw, and what HIPAA stops protecting once the information leaves
8. Signatures: The patient or a personal representative, with the relationship stated

The template sets a one-year expiration when no date or event is filled in. That default keeps a rushed form from running open-ended.

How to fill it out and file it

Completion is a short process, but skipping a field can invalidate the whole document. Staff should check each step before filing.

1. Confirm the patient’s identity against the record before they sign.
2. Describe the information in specific terms rather than “all records”.
3. Name the recipient in full, including the organization address.
4. State the purpose in a sentence the patient can understand.
5. Set an expiration date or event, then give the patient a signed copy.

If a parent, guardian or other personal representative signs, record their relationship on the form. An authorized representative form keeps their standing authority on file for later requests.

State-specific authorization requirements

HIPAA sets a federal floor, and state law can add requirements on top. Oregon, for example, specifies a format for certain authorizations under ORS 192.566. Before you adopt any template, check your state health department and medical board guidance.

How Pabau collects and stores signed authorizations

Paper authorizations travel badly. The form is printed, signed at the front desk, scanned and filed in a folder that the next records request has to find. An expired form often goes unnoticed until someone opens that folder.

Pabau, the practice management platform we build, turns this form into a digital form the patient completes and signs on their own device. Its patient intake software sends the authorization before the visit, and patients can also fill it in through the patient portal.

The signed copy lands in the patient’s medical records, next to the notes it relates to. When a lawyer’s request arrives, staff confirm the recipient, scope and expiry from the patient file in one place.

Collect signed authorizations before the visit

Pabau sends authorization forms to patients ahead of the appointment and files each signed copy in the patient record. Staff can check scope and expiry without searching paper files.

Book a demo

Conclusion

Many requests for patient information never need this form. A patient asking for their own file makes an access request, and an insurer’s pre-approval runs on the payer’s form. Keep the standard authorization form for releases HIPAA does not otherwise permit, and fill every core element before the patient signs.

Precision is the trade-off worth accepting. A scope of “all records” is quicker to write but harder to defend, and a missing expiration can void the document. Book a demo to see how Pabau collects signed authorizations before the visit and keeps them with the patient record.

Continue your research

Handling mental health or substance use records? Authorization for release of confidential information covers patient details, the information released, the purpose and the recipient.

Practicing in Massachusetts? HIPAA release form for Massachusetts names who may receive records, what they cover, and when the permission ends.

Moving consent onto patients’ phones? E-consent form shows what a signed-on-screen consent must include and how to send it.

Frequently asked questions