45 C.F.R. § 164.508

Section 164.508(a)(1) generally prohibits a covered entity from using or disclosing protected health information without valid authorization.

Commissioner of Mental Health & Addiction Services v. Freedom of Information Commission · filed 2023-08-29§ 164.508(a)(1)

HIPAA’s Privacy Rule generally prohibits a ‘‘covered entity’’ from using or disclosing protected ‘‘health information’’ without a valid authorization. 45 C.F.R. § 164.508 (a) (1) (2021).

Section 164.508(a)(1) generally requires valid authorization before a covered entity may use or disclose protected health information, subject to HIPAA exceptions.

United States v. Wilson · filed 2024-04-15§ 164.508(a)(1)

Generally, a health care provider cannot disclose such information “without authorization” from the patient. 42 U.S.C. § 1320-d(a); see 45 C.F.R. § 164.508 (“Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section.”).

Section 164.508(a) regulates the procedures for disclosing protected health information and does not create a privilege for patients’ medical information.

People v. Moylan · filed 2025-03-11§ 164.508(a)

HIPAA does not create a privilege for patients’ medical information; it merely provides the procedures to follow for the disclosure of that information from a “covered entity.” 45 C.F.R. § 164.508(a) (2022)

Section 164.508(a)(1) requires authorization for disclosures by covered medical providers, but its authorization requirement does not apply to an insurer that is not a covered entity.

Frohn v. Globe Life and Accident Ins Co · filed 2024-04-29§ 164.508(a)(1), (b)(5)

The general rule of § 164.508 that requires authorization applies to “covered entit[ies].” Id. § 164.508(a)(1). A covered entity is a health plan, a health care clearinghouse, or “[a] health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.” Id. § 160.103.

The marketing provision in § 164.508(a)(4) requires individualized inquiries into each class member’s circumstances.

Post v. Amerisourcebergen Corporation · filed 2023-08-29§ 164.508(a)(4)

even if the “marketing” provision of HIPAA were applicable, it would still require individualized inquiries as to each member of the class.

Section 164.508(c)(1) makes each of the six listed elements mandatory for a fully compliant HIPAA authorization.

Christie v. Baptist Memorial Hospital d/b/a Baptist Memorial Hospital for Women · filed 2023-11-15§ 164.508(c)(1)

These elements are mandatory for a fully compliant HIPAA authorization.

Under § 164.508(b)(2)(v), an incorrect birth year is not material information that invalidates an otherwise compliant authorization when the patient remains identifiable and the birth year was not required.

Coram v. Jimmy C. Brasfield, M.D. · filed 2024-02-22§ 164.508(b)(2)(v)

Moreover, the authorization contains correct identifying information for Mrs. Coram, such as her name. Inasmuch as Defendants could identify Mrs. Coram from the authorization notwithstanding the birth year, and they admit the information need not be included in the authorization at all, we disagree that Mrs. Coram’s birth year is “material information” under the circumstances.

Section 164.508(c)(1)(vi) requires an authorization to include the individual’s signature and the date of signature.

Elmore v. Travis L. Mills, CRNA · filed 2025-03-31§ 164.508(c)(1)(vi)

Plaintiff’s signature and the date of signature, together, are a core element according to 45 C.F.R. § 164.508(c)(1). Without Plaintiff’s signature and the date of the signature, Sorce and TVO would be unable to obtain Decedent’s medical records from the providers listed on the medical authorizations.

Section 164.508(c)(1)(ii) and (iii) require an authorization to identify the persons or entities permitted to disclose and receive the records; leaving those selections blank makes the authorization incomplete and ineffective.

Pamela Crenshaw on behalf of her mother Dorothy Murphy v. Methodist Healthcare-Memphis Hospitals · filed 2025-05-07§ 164.508(c)(1)(ii)-(iii)

Because the authorization does not contain the identifying information of each person or entity able to receive and disclose Ms. Murphy’s medical information, the authorization is incomplete and ineffective. See 45 C.F.R. § 164.508(c)(ii)-(iii).

Section 164.508(c)(1)(vi) requires a signed and dated authorization, and an unsigned form is not HIPAA-compliant.

BUCKNER v. COMPLETE WELLNESS CHIROPRACTIC CENTER · filed 2025-05-15§ 164.508(c)(1)(vi)

The unsigned forms failed to satisfy the sixth compliance requirement mandated by HIPAA. See 45 C.F.R. §164.508(c)(1)(vi).

Section 164.508(a)(1) requires a covered entity to use or disclose protected health information only with a valid authorization, and any disclosure must remain consistent with that authorization.

Lori Lynn Martinolich, Etc. v. New Jersey State Police · filed 2025-10-28§ 164.508(a)(1)

[A] covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization.

Section 164.508’s signature requirement supports requiring a signed authorization before an authorized representative may obtain personal health information.

Sellers · filed 2025-11-17§ 164.508

Requiring a signature ensures that only authorized representatives act on behalf of Plan beneficiaries and is necessary for the release of personal health information under HIPAA. See 45 C.F.R. § 164.508.

Section 164.508(c)(1)(ii) and (iii) require an authorization to identify the persons or entities authorized to disclose and receive medical records.

Moxley v. AMISUB (SFH), Inc. d/b/a Saint Francis Hospital · filed 2026-03-13§ 164.508(c)(1)(ii)-(iii)

Because the authorizations tendered by Appellant do not contain the identifying information of each person or entity able to receive/obtain Mr. Moxley’s medical information, the authorizations are incomplete and ineffective. Crenshaw, 2025 WL 1336350, at *4 (citing 45 C.F.R. § 164.508(c)(ii)-(iii)).

A HIPAA authorization under § 164.508(c)(1) must describe the information to be disclosed in a specific and meaningful way.

Beaty v. St. Luke's Hospital of Kansas City · filed 2009-11-17§ 164.508(c)(1)(i)

The authorization must contain “[a] description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.”

Section 164.508 requires the authorization to identify the person authorized to disclose records, describe each purpose of disclosure, and warn that the recipient may redisclose the information.

E.J., a minor by his mother and father Victor and Lynell Jeffrey v. Paul Okolocha, M.D., Okolocha Medical Corp., and Okolocha Medical, Pain and Weight · filed 2012-08-13§ 164.508(c)(1)(iii), (c)(1)(iv), (c)(2)(iii), and (a)(1)

Thus, the authorization fails to include “specific identification of the person authorized to make the disclosure.” ... The authorization here contains no description of purpose. ... Without that language, however, the authorization does not comply with HIPAA.

Section 164.508(c)(1) requires a HIPAA authorization to include six specified elements, including descriptions of the information and purpose and identification of the persons authorized to disclose and receive it.

Christine Stevens ex rel. Mark Stevens v. Hickman Community Health Care Services, Inc. · filed 2013-11-25§ 164.508(c)(1)

Federal regulations state that a HIPAA compliant authorization must include the following six elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure. . . . (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. . . . (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual must also be provided.’

A HIPAA authorization must describe the medical information to be disclosed, identify the persons or organizations authorized to disclose it, and specify the information authorized for use or disclosure.

Stevens ex rel. Stevens v. Hickman Community Health Care Services, Inc. · filed 2013-11-25§ 164.508(c)(1)(i), (ii), and (iv)

Second, Plaintiffs medical authorization failed to satisfy at least three of the six compliance requirements mandated by HIPAA. Specifically, Plaintiffs authorization lacked a description of the medical information to be disclosed, 45 C.F.R. § 164.508(c)(l)(i); failed to state the individuals or organizations authorized to disclose the decedent’s medical records, 45 C.F.R. § 164.508(c)(l)(ii); and failed to specify the type of information authorized to be used or disclosed, 45 C.F.R. § 164.508(c)(l)(iv).

Section 164.508(c)(1) requires an authorization to contain six specified elements, while § 164.508(a)(1) generally bars disclosure without valid authorization.

Roberts v. Sue Drill, M.D. · filed 2014-06-26§ 164.508(c)(1), (a)(1)

The form provided by Plaintiff failed to specifically identify “the person(s) or class of persons authorized to make the requested use or disclosure” and “the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure.” Specifically, the form only permitted the use or disclosure of the medical records by Plaintiff’s counsel. Additionally, Plaintiff signed the form in her representative capacity but failed to provide a description of her authority to act for Decedent.

Section 164.508(c)(1) requires an authorization to contain six specified elements, while § 164.508(a)(1) generally bars disclosure without valid authorization.

Roberts v. Sue Prill, M.D. · filed 2014-06-26§ 164.508(c)(1), (a)(1)

The form provided by Plaintiff failed to specifically identify “the person(s) or class of persons authorized to make the requested use or disclosure” and “the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure.” Specifically, the form only permitted the use or disclosure of the medical records by Plaintiff’s counsel. Additionally, Plaintiff signed the form in her representative capacity but failed to provide a description of her authority to act for Decedent.

Section 164.508(c)(1)(vi) requires a HIPAA authorization to include the individual's signature and date, but omitting the date was a relatively minor defect where defendants could obtain the relevant records and were not prejudiced.

Hamilton v. Abercrombie Radiological Consultants, Inc. · filed 2014-12-15§ 164.508(c)(1)(vi)

Here, the only allegation of error in the HIPAA form is the missing date that is required under C.F.R. §164.508(c)(1)(vi). ... While we concede that it is not good practice to omit any of the C.F.R. criteria from a HIPAA form, we conclude that the relatively minor shortcoming in the HIPAA form here is not fatal to the Appellant’s cause of action.

An authorization may substantially comply with § 164.508(c) despite omitting specified language when the omission does not prejudice defendants' ability to obtain relevant medical records.

Margie Hunt v. Sudha Nair M.D. · filed 2015-09-25§ 164.508(c), particularly (c)(2)(ii)-(iii)

We find that the plaintiff‟s medical authorization fulfills all of the requirements of 45 C.F.R. § 164.508(c), except that it does not use certain language specified in 45 C.F.R. § 164.508(c)(ii)-(iii).

Under §§ 164.508(c)(1) and 164.508(b)(2)(ii), an authorization must contain all specified elements and is invalid if a required element is left blank.

Bray v. Radwan R. Khuri, MD · filed 2015-12-03§ 164.508(c)(1), (b)(2)(ii)

In addition, federal regulations state that “[a]n authorization is not valid” if “[t]he authorization has not been filled out completely, with respect to an element described by paragraph (c) of this section….”

Section 164.508(b)(2)(ii) requires a HIPAA authorization to be dated, and an undated authorization is legally inoperable.

Austin v. United States, Department of the U.S. Army · filed 2015-06-11§ 164.508(b)(2)(ii)

Finally, Sgt. Austin’s HIPAA release was defective. He failed to date it, thus rendering it legally inoperable.

A HIPAA authorization must identify the information and the persons authorized to disclose and receive it; an incomplete form does not authorize disclosure.

J.A.C., by and through her next friend and mother, Lesha Carter v. Methodist Healthcare Memphis Hospitals · filed 2016-11-02§ 164.508(c)(1)

In this case, the authorization forms given to the Providers were markedly inadequate.

Section 164.508(a)(2) requires authorization for psychotherapy-note disclosures, and the court-order exception in § 164.512(e) is not one of its listed exceptions.

Hardy v. Scandinavian Airlines System · filed 2025-02-06§ 164.508(a)(2)

However, HIPAA explicitly requires authorization for the disclosure of “psychotherapy notes,” with only limited exceptions. 45 C.F.R. § 164.508(a)(2). Permissible disclosure pursuant to § 164.512(e) is not listed as an exception, but permissible disclosure pursuant to § 164.512(a) is listed.

Section 164.508(c) permits disclosure of protected health information when a patient executes a valid written authorization conforming to the regulation's requirements.

In Re Collins · filed 2009-06-05§ 164.508(c)

HIPAA itself allows the disclosure of protected health information if the patient has executed a valid, written authorization conforming to the requirements of 45 C.F.R. § 164.508(c).

Section 164.508 requires a valid authorization for a covered entity to use or disclose protected health information, and the authorization must describe the information specifically and meaningfully.

State Ex Rel. Collins v. Roldan · filed 2009-06-09§ 164.508(a), (c)(1)(i)

Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section.

Section 164.508 requires a patient’s specific authorization before confidential medical information may be released.

Hung Nam Tran v. Kriz · filed 2010-05-06§ 164.508

As the district court properly noted, however, federal law requires that a patient specifically authorize the release of confidential medical information, see 42 U.S.C. § 1320d-2; 45 C.F.R. § 164.508; see Nw. Mem’l Hosp. v. Ashcroft, 362 F.3d 923, 924-25 (7th Cir.2004), and this he failed to do.

Section 164.508(a)(1) requires a covered entity to obtain a valid authorization before using or disclosing protected health information unless another provision permits or requires the disclosure.

State Ex Rel. Proctor v. Messina · filed 2010-08-31§ 164.508(a)(1)

Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section.

Section 164.508(a) protects against unauthorized disclosure or sharing of a person’s medical information.

County of San Diego v. Mason · filed 2012-09-14§ 164.508(a)

Furthermore, the Health Insurance Portability and Accountability Act of 1996 (HIPAA; Pub.L. No. 104-191 (Aug. 21, 1996) 110 Stat. 1936) prohibits the unauthorized disclosure or sharing of a person’s medical information and imposes civil and criminal penalties on those who do. (42 U.S.C. §§ 1320d-5, 1320d-6; 45 C.F.R. § 164.508(a) (2011).)

Section 164.508(a)(1) generally prohibits a covered entity from using or disclosing protected health information without a valid authorization.

Charles Webb and Evangeline Webb, Individually and as Husband and Wife v. Charles Roberson, M.D. · filed 2013-04-17§ 164.508(a)(1)

Under HIPAA, a covered entity generally “may not use or disclose protected health information without a[] [valid] authorization[.]” 45 C.F.R. §164.508(a)(1).

Section 164.508(a)(1) requires a healthcare provider to obtain the patient's authorization before disclosing patient information in connection with a potential medical-negligence claim, unless disclosure is otherwise permitted under HIPAA.

Murphy v. Dulay · filed 2013-09-25§ 164.508(a)(1)

Under 45 C.F.R. § 164.508(a)(1), a healthcare provider may disclose a patient’s information in connection with a potential medical-negligence claim against another provider only with the patient’s authorization — that is, with the patient’s consent — or under the safeguards provided by 45 C.F.R. § 164.512(e).

Section 164.508(a)(1) prohibits a covered entity from using or disclosing protected health information without an authorization valid under the section.

Deborah Mason Hawkins, Individually and as Administratrix of the Estate of Wayne Hawkins v. Rodney A. Martin, M.D., and Baptist Memorial Hospital · filed 2014-06-23§ 164.508(a)(1)

[A] covered entity may not use or disclose protected health information without an authorization that is valid under this section.

Section 164.508(a)(1) generally bars a covered entity from using or disclosing protected health information without valid authorization, subject to limited exceptions.

Harmon v. Shore · filed 2015-04-23§ 164.508(a)(1)

However, HIPAA generally provides that a covered entity may not “use or disclose protected health information without” valid authorization.

Section 164.508(a)(1) requires a fully compliant authorization before medical providers may use or disclose a patient's records, and the authorization must enable defendants to obtain and review relevant records.

Dolman v. MD · filed 2015-12-23§ 164.508(a)(1)

Because HIPAA itself prohibits medical providers from using or disclosing a plaintiff's medical records without a fully compliant authorization form, it is a threshold requirement of the statute that the plaintiff's medical authorization must be sufficient to enable defendants to obtain and review a plaintiff's relevant medical records.

A patient's signed authorization identifying the psychotherapist and the records to be disclosed satisfies § 164.508(a)(2)'s authorization requirement for psychotherapy notes.

Kalinoski v. Evans · filed 2005-07-12§ 164.508(a)(2)

The Court therefore finds that plaintiff has authorized the disclosure of psychotherapy notes within the meaning of section 164.508(a)(2).

A covered entity may disclose psychotherapy notes when the patient has authorized the disclosure and a court order independently permits disclosure under § 164.512(e).

Evenson v. Hartford Life & Annuity Insurance · filed 2007-09-28§ 164.508(a)(2)

There is no basis for Howorth-Fair to withhold production of the notes.

Section 164.508(a)(2)(ii) does not require authorization for psychotherapy notes when disclosure is required under § 164.512(d) to oversee the notes' originator.

Wolin v. The Department of Financial and Professional Regulation · filed 2012-12-21§ 164.508(a)(2)(ii)

Section 164.508 of the regulations provides that authorization for psychotherapy notes is not required if disclosure is required by section 164.512(d) with respect to the oversight of the originator of the psychotherapy notes.

The exception in § 164.508(a)(2)(i)(C) for disclosure of psychotherapy notes to defend against a legal action does not apply when the person whose records were disclosed did not bring the action.

Abeyta v. Sierra Tucson, Inc. and Heidi Sonntag · filed 2014-02-19§ 164.508(a)(2)(i)(C)

This provision does not apply because Abeyta has not brought a legal action against Sonntag.

Section 164.508 generally governs health-care providers’ disclosure of a patient’s records, not a patient’s disclosure of the patient’s own records.

Vogelsberg, Jeffrey v. Kim, Young · filed 2019-08-13§ 164.508

He cites the Health Insurance Portability and Accountability Act (HIPAA), but that statute generally applies to health care providers disclosing a patient’s documents, see United States v. Bek, 493 F.3d 790, 802 (7th Cir. 2007) (citing 45 C.F.R. §§ 164.508 and 160.103), not to a patient disclosing his own records.

Section 164.508(c)(1)(iv) treats a purpose description as a core element of a HIPAA authorization.

Carl Short Ex Rel. Allison Hope Short v. Metro Knoxville HMA, LLC · filed 2019-08-23§ 164.508(c)(1)(iv)

Indeed, Plaintiff’s authorization satisfied the core elements of a HIPAA authorization while the authorization in Parks did not.

Section 164.508(c)(1) treats identification of the person or entity authorized to disclose records as an essential element of a valid HIPAA authorization.

Moore-Pitts v. Carl A. Bradley, DDA, MAGD · filed 2019-12-09§ 164.508(c)(1)

As did the Court in Lawson, we conclude that this is an essential element for the Defendant to obtain records from the other providers.

Section 164.508(b) makes an authorization invalid when it is incomplete as to information required by § 164.508(c)(1).

Owens v. Gary W. Stephens, D.O. · filed 2020-04-16§ 164.508(b), (c)(1)

An authorization is not valid, if the document submitted has any of the following defects: …(ii) The authorization has not been filled out completely with respect to an element described by paragraph (c) of this section . . . .

Section 164.508(b)(2)(ii) makes an authorization invalid when it is incomplete as to any core element required by § 164.508(c)(1).

Martin v. Rolling Hills Hospital, LLC · filed 2020-04-29§ 164.508(c)(1)(ii), (c)(1)(v), (c)(1)(vi), and (b)(2)(ii)

Under federal law, a medical authorization is not HIPAA compliant if “[t]he authorization has not been filled out completely, with respect to” a core element. 45 C.F.R. § 164.508(b)(2)(ii).

Section 164.508(a)(1) prohibits disclosure without valid authorization, while §§ 164.508(c)(1) and (b)(2) specify required elements and defects that invalidate an authorization.

Tammy Combs v. Leslie Milligan, M.D. · filed 2020-05-01§ 164.508(a)(1), (c)(1), and (b)(2)

a covered entity may not use or disclose protected health information without an authorization that is valid under this section.

Section 164.508(c)(1)(iii) requires recipient identification on the authorization, and omission of that core element makes the authorization invalid.

Alysia Reese McCracken Hancock v. BJR Enterprises, LLC · filed 2020-05-14§ 164.508(c)(1)(iii), (b)(1), and (b)(2)(ii)

In the case before us, POA failed to identify on the medical authorization the identity of the individual authorized to receive Patient’s records. As in Wenzler, we conclude that this is an essential element. A medical authorization lacking a core element is not valid.

Section 164.508(b) makes an authorization invalid when it is incomplete as to an element required by § 164.508(c)(1).

Carrasco v. North Surgery Center, LP · filed 2020-05-28§ 164.508(b), (c)(1)

(2) Defective authorizations. An authorization is not valid if the document submitted has any of the following defects: …(ii) The authorization has not been filled out completely with respect to an element described by paragraph (c) of this section . . . .

Section 164.508(a)(1) does not authorize pharmacies to direct or control customers’ use of their protected health information or to enforce customers’ authorization rights.

Trone Health Services, Inc. v. Express Scripts Holding Co. · filed 2020-09-04§ 164.508(a)(1)

We agree that, textually, HIPAA does not authorize the Pharmacies to direct or control the use of their customers’ information and does not grant the Pharmacies power to enforce their customers’ rights.

Section 164.508(c)(2)(i) permits a person who has given a HIPAA-compliant authorization to revoke it at any time.

Larson Jr. v. State of Alaska, Department of Corrections, Board of Parole · filed 2020-11-20§ 164.508(c)(2)(i)

Finally, a person giving a HIPAA-compliant medical information release form may revoke the release at any time.

Section 164.508(c)(2)(iii) requires a valid authorization to warn that disclosed information may be redisclosed and lose Privacy Rule protection.

Haage v. Zavala · filed 2020-12-29§ 164.508(c)(2)(iii)

To be “valid” for purposes of section 164.508, the authorization must, among other things, “contain statements adequate to place the individual on notice of *** [t]he potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this subpart.”

Section 164.508(a)(2)(ii) permits disclosure of psychotherapy notes without authorization when disclosure is required by law.

Klug v. Marshall University Board of Governors · filed 2021-03-29§ 164.508(a)(2)(ii)

Notably, even with the added protection given to psychotherapy notes, HIPAA allows their disclosure to a third-party with a valid authorization, 45 C.F.R. §164.508(a)(1), and without an authorization when the disclosure is required by law. 45 C.F.R. §§164.508(a)(2)(ii), 164.512(a).

Section 164.508 requires a valid authorization before protected health information may be used or disclosed, and the use or disclosure must remain consistent with that authorization.

Savannah Leigh Jackson v. The State of Tennessee · filed 2021-05-19§ 164.508(a)(1), (c)(1), and (c)(1)(vi)

[e]xcept as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization.

Section 164.508(c)(1)(iii) requires a HIPAA authorization to identify the person or entity authorized to receive the records.

Reese v. The Waters of Clinton, LLC · filed 2021-08-04§ 164.508(c)(1)(iii)

This is a core element of a HIPAA-compliant medical authorization.

Section 164.508(c)(1) requires a valid authorization to state the disclosure’s purpose and identify the persons who will receive the information, although substantial compliance may suffice.

Y.C. v. Superior Court · filed 2021-11-08§ 164.508(c)(1)

Although the therapist interviewed Y.C. over the telephone, her admonishments covered HIPAA’s principal requirements for a valid authorization, including an advisement of the purpose of the interview and identification of the persons to whom disclosure of information would be made. (See 45 C.F.R. § 164.508(c)(1).) Under the circumstances, there was substantial compliance with the HIPAA safeguards.

Section 164.508(c)(1) requires a valid authorization to state the disclosure’s purpose and identify the persons who will receive the information, and substantial compliance may suffice.

Y.C. v. Super. Ct. · filed 2021-12-07§ 164.508(c)(1)

Although the therapist interviewed Y.C. over the telephone, her admonishments covered HIPAA’s principal requirements for a valid authorization, including an advisement of the purpose of the interview and identification of the persons to whom disclosure of information would be made.

Section 164.508(c)(1)(vi) requires an authorization signed by a personal representative to describe the basis for that representative’s authority.

Wilson v. UnitedHealthcare Insurance Co · filed 2022-02-24§ 164.508(a)(1), (c)(1)(vi)

As noted, however, to be a valid signature authorizing the release of another individual’s protected health information, HIPAA requires that the authorization form describe the basis for that authority.

Section 164.508(a)(1) generally prohibits use or disclosure without valid authorization unless another HIPAA provision permits or requires it.

Farhat v. Unique Healthcare Systems, LLC · filed 2022-03-04§ 164.508(a)(1)

“Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section.”

Section 164.508(c)(1) requires the listed core elements for a fully compliant HIPAA authorization.

Lott v. Veronica Mallett, M.D. · filed 2022-03-25§ 164.508(c)(1)

These elements are mandatory for a fully compliant HIPAA authorization.

Section 164.508(c)(1)(vi) requires an authorization signed by a representative to describe that representative’s authority to act for the individual.

Estate of Jennifer Diane Vickers v. Diversicare Leasing Corporation · filed 2022-06-13§ 164.508(c)(1)(vi)

To comply with HIPAA, authorization forms must contain six core elements, including the “[s]ignature of the individual and date,” and “ [i]f the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual.”

Section 164.508 permits disclosure of protected health information when the patient or the patient’s representative provides proper authorization.

Carter-Mixon v. City of Tacoma · filed 2022-09-20§ 164.508

The records can also be disclosed with proper authorization from patients or their representatives.

Section 164.508(b)(5)(i) preserves an action taken in reliance on a prior authorization even if that authorization is later validly revoked.

Johnson v. West Virginia University Board of Governors · filed 2022-10-17§ 164.508(b)(5)(i)

So even if the revocation was valid, the action still does not rise to a HIPAA violation as there is an exception when a “covered entity has [already] taken action in reliance” of the previous authorization. 45 C.F.R. § 164.508(b)(5)(i).

Section 164.508 generally requires an individual’s consent before protected health information may be disclosed.

Wiley v. Wexford Health Sources, Inc. · filed 2022-10-17§ 164.508

HIPAA generally prohibits the disclosure of an individual’s health-related information without that individual’s consent.

Section 164.508(b)(3) prohibits combining an authorization with another document to create a compound authorization.

Carl Short Ex Rel. Allison Hope Short v. Metro Knoxville HMA, LLC · filed 2019-08-23§ 164.508(b)(3)

the Code of Federal Regulations, with certain exceptions not applicable here, specifically prohibits compound authorizations.

Section 164.508(b) makes an authorization invalid when it is incomplete as to a core element required by § 164.508(c)(1), including the information description and representative authority.

Helen Shaw as Administrator for the Estate of John Suttle v. Lawrence B. Gross, MD · filed 2021-04-13§ 164.508(b), (c)(1)

An authorization is not valid, if the document submitted has any of the following defects: * * * (ii) The authorization has not been filled out completely with respect to an element described by paragraph (c) of this section . . . .

Section 164.508(a)(1) generally requires a valid authorization before a covered entity may use or disclose protected health information, subject to HIPAA's exceptions.

University of Virginia Medical Center v. Jordan · filed 2016-02-02§ 164.508(a)(1)

Moreover, 45 C.F.R. § 164.508(a)(1) provides that “[e]xcept as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section” – but, as noted above, 45 C.F.R. § 164.502(a)(1)(i) permits disclosure of a patient’s protected health information to the patient.

Section 164.508(c)(1) requires six elements in a HIPAA-compliant medical authorization, and a signed but incomplete form fails the regulation.

Ibrahim v. Williams · filed 2016-02-29§ 164.508(c)(1)

The court found that medical authorization Plaintiff sent with the October 22, 2013 letter and which was introduced into the record at the November 4 hearing on the motions “only include[d] Ms. Ibrahim‟s signature and date, and, thus, failed to comply with five of the six requirements set forth in 45 C.F.R. §164.508(c)(1) for medical authorization forms.”

Section 164.508(c)(1)(vi) requires an individual's signature and date on a HIPAA authorization, including a description of representative authority when applicable.

Travis v. Cookeville Regional Medical Center · filed 2016-09-20§ 164.508(c)(1)(vi)

It is undisputed that the unsigned HIPAA form Mr. Travis submitted with his supplemental documents failed to satisfy the sixth compliance requirement mandated by HIPAA.

Section 164.508(a)(2)(i)(C) narrowly permits a covered entity to use or disclose medical records to defend itself in a legal action, while § 164.508(a)(1) generally bars use or disclosure without valid authorization.

Cright v. Tijuan Overly, M.D. · filed 2016-10-17§ 164.508(a)(2)(i)(C) and (a)(1)

The case now before us is not covered by one of the narrow exceptions that allows for use of a patient’s medical records without authorization.

Section 164.508(c)(1)(iii) requires specific identification of the person, entity, or class of persons authorized to receive protected health information; “bearer” alone is insufficient.

Rush v. Jackson Surgical Associates PA · filed 2017-02-13§ 164.508(c)(1)(iii)

Under the plain language of the regulation, a name is not required so long as there is specific identification of the entity, person, or class of persons authorized to receive the protected health records.

Section 164.508(c)(1)(ii) requires the authorization to identify the persons or organizations authorized to make the disclosure, and an attached provider list cannot cure that omission.

Lawson v. Knoxville Dermatology Group, P.C. · filed 2017-08-01§ 164.508(c)(1)(ii), (b)(3)

Although the omission in this case includes only one of the omitted items at issue in Roberts, we determine that it is a necessary element to Defendants’ legal authorization to use the pertinent medical records to mount a defense.

Section 164.508(c) requires a detailed authorization for uses and disclosures of protected health information.

State v. Peltz · filed 2017-03-02§ 164.508(c)

The act’s privacy rule requires a detailed authorization for uses and disclosures of protected health information.

Section 164.508's heightened authorization requirements do not apply to publicly available webpage URLs and content that do not relate to an individual's health condition.

Smith v. Facebook, Inc. · filed 2017-05-09§ 164.508

As such, the stricter authorization requirements of HIPAA (as well as Cal. Civ. Code § 1798.91) do not apply.

Section 164.508(a)(1) bars disclosure without valid authorization, and § 164.508(c)(1) specifies six elements a HIPAA-compliant authorization must contain.

Joshlin Renee Woodruff by and through Dorothy Cockrell v. Armie Walker, M.D. · filed 2017-05-26§ 164.508(a)(1), (c)(1)

“[A] covered entity may not use or disclose protected health information without an authorization that is valid under this section.” ... Federal regulations state that a HIPAA compliant authorization must include the following six elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure[.] (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure[.] (vi) Signature of the individual and date.

Section 164.508(a)(1) generally requires valid authorization before a provider may use or disclose protected health information, subject to HIPAA exceptions.

Bray v. Radwan R. Khuri, M.D. · filed 2017-07-05§ 164.508(a)(1)

As a general rule, HIPAA prohibits a healthcare provider from using or disclosing protected health information without a valid authorization.

Section 164.508(a)(1) generally bars disclosure without valid authorization, and § 164.508(c)(1) requires six specified authorization elements.

Grizzle v. Parkwest Medical Center · filed 2017-07-25§ 164.508(a)(1), (c)(1)

As a general rule, HIPAA prohibits a healthcare provider from using or disclosing protected health information without a valid authorization.

Section 164.508(a)(1) and (c)(1) require written medical authorization meeting specific requirements before protected health information may be disclosed.

Clary v. Deidra A. Miller · filed 2017-08-08§ 164.508(a)(1), (c)(1)

HIPAA prohibits the disclosure of protected health information without a written medical authorization that meets specific requirements.

Section 164.508's face-to-face marketing exception does not protect the initial obtaining of protected health information.

O'Donnell v. Angels at Home Healthcare, Inc. · filed 2018-01-08§ 164.508(a)(3)(i)(A)

By its plain language, section 164.508 protects using and disclosing health information under certain circumstances, not obtaining it initially.

Section 164.508(a)(1) generally requires a patient's authorization before a covered entity may use or disclose protected health information.

United States v. Deleon · filed 2018-04-30§ 164.508(a)(1)

Generally, a healthcare provider cannot use or disclose a patient's health care information without the patient's authorization.

A HIPAA authorization must be sufficiently complete and specific to authorize access to and use of the requested medical records under § 164.508.

Riley v. Methodist Healthcare Memphis · filed 2018-05-02§ 164.508(a)(1), (b)(2)(ii), and (c)(1)(iii)

We glean from these cases that substantial compliance requires that the noncomplying features of the authorization do not render it insufficient to authorize access and use of the records.

Section 164.508(b)(1)(i) and (c) generally require written consent or authorization to disclose mental-health information to third-party payors.

Jessica Velcoff, Ph.D. v. MedStar Health · filed 2018-06-21§ 164.508(b)(1)(i), (c)

As we have previously indicated, under the MHIA, consent to or authorization of disclosure of mental-health information to third-party payors must generally be in writing. D.C. Code §§ 7-1131.14 (6) (2018 Repl.); 7-1201.01 (8A), -1202.02 (a), -1202.07 (a); 45 C.F.R. § 164.508(b)(1)(i), (c) (2017).

Section 164.508 permits use or disclosure of protected health information when a covered entity obtains or receives a valid authorization and does not preempt Alaska's rule allowing ex parte contact.

Harrold-Jones v. Drury · filed 2018-06-22§ 164.508(a)(1), (b)(4)

Specifically, the authorization exception allows for “use or disclosure of protected health information” when “a covered entity obtains or receives a valid authorization for its use.”

Section 164.508(b)(2) makes an authorization defective when it is incomplete as to an element required by § 164.508(c), and a recipient may not fill in its blanks.

Desiree Dawn Roberts v. Wellmont Health System · filed 2018-07-05§ 164.508(b)(2) and (c)

HIPAA deems authorizations defective if not filled out completely.

Section 164.508(b)(2) requires a HIPAA authorization to be complete, so a third party may not fill in its blanks after execution.

Smith v. Wellmont Health System · filed 2018-07-09§ 164.508(a)(1), (b)(2)

HIPAA deems authorizations defective if not filled out completely.

Section 164.508(b)(2)(i) makes an authorization invalid when its expiration date has passed, so it cannot authorize disclosure under § 164.508(a)(1), and § 164.508(c)(3) requires plain language.

Konah Evangeline Buckman, Mother And Next Of Kin Of Edward Kofi Sasa Lenox Buckman A/K/A Edward Welsely v. Mountain Stat · filed 2018-07-26§ 164.508(b)(2)(i), (a)(1), and (c)(3)

As a result of the expiration date having passed, the defendants were not authorized to receive any of the patient’s medical records.

Section 164.508(a)(1) generally prohibits disclosure of medical records without valid written authorization, subject to exceptions.

Shands Jacksonville Medical Center, Inc. v. Eartha Pusha, as Personal etc. · filed 2018-08-24§ 164.508(a)(1)

Subject to certain exceptions not applicable here, HIPAA expressly prohibits the disclosure of medical records without valid written authorization.

Section 164.508(c)(1)(iii) requires specific identification of the person or class of persons who may receive a disclosure, and an incomplete core element makes the authorization defective and invalid.

Wenzler v. Yu · filed 2018-11-20§ 164.508(c)(1)(iii), (b)(2)(ii), and (a)(1)

Under the plain language of the regulation,” with respect to subsection (iii), “a name is not required so long as there is specific identification of the entity, person, or class of persons authorized to receive the protected health records.”

Section 164.508(b)(2)(ii) treats an authorization as invalid when it is incomplete as to a required element of § 164.508(c), including the purpose description in § 164.508(c)(1)(iv).

Parks v. Rebecca A. Walker, M.D. · filed 2018-11-28§ 164.508(b)(2)(ii), (c)(1), and (c)(1)(iv)

An authorization is not valid if, among other things, it “has not been filled out completely, with respect to an element described by paragraph (c) of this section.”

Section 164.508 requires written authorization before a provider may obtain protected medical records when no HIPAA exception applies.

Doe v. University of Southern Calif. · filed 2018-12-11§ 164.508

Because none of the exceptions applies here, USC would need Jane’s written authorization to obtain her medical records from the rape treatment center.

Under § 164.508(a)(1), a covered entity may not use or disclose protected health information without an authorization valid under the section.

Kerry Gray v. Saint Francis Hospital-Bartlett, Inc. a/k/a Tenet HealthSystem Bartlett, Inc. · filed 2019-04-16§ 164.508(a)(1)

a covered entity may not use or disclose protected health information without an authorization that is valid under this section.

Section 164.508(c)(1)(i) and (v) require a description of the information to be disclosed and an expiration date, and omitting either core requirement defeats compliance.

Williams v. Gateway Medical Center - Concurring In Part and Dissenting In Part · filed 2019-04-18§ 164.508(c)(1)(i) and (v)

Without an expiration date or a description of the information to be used or disclosed, the medical authorizations failed to comply with two of the “core” requirements of 45 C.F.R. § 164.508(c).

Section 164.508(b)(2) and (c)(1)(i) require an authorization to be completely filled out for each core element, including a specific description of the information to be disclosed.

Williams v. Gateway Medical Center · filed 2019-04-18§ 164.508(b)(2), (c)(1)(i)

An authorization is not valid if, among other things, it “has not been filled out completely, with respect to an element described by paragraph (c) of this section.”

A HIPAA-compliant authorization under § 164.508(c) may place directly on its face a neutral statement explaining the interview’s litigation purpose and voluntary nature.

Porcelli v. Northern Westchester Hospital Center · filed 2009-06-09§ 164.508(c)

Accordingly, we hold that the method the plaintiffs employed here—placing the admonition directly on the HIPAA-compliant authorizations and highlighting the language—is consistent with Arons, as it clearly serves the primary purpose of conveying the information in a manner that best prevents the accidental disclosure of privileged information.

Section 164.508(a)(2)(i)(C) permits a covered entity to use or disclose protected health information to defend itself in a legal action only within the regulation's limited exception.

Hughes v. Henry County Medical Center d/b/a Lake Haven Behavioral Center · filed 2015-06-09§ 164.508(a)(1), (a)(2)(i)(C)

Because HIPAA itself prohibits medical providers from using or disclosing a plaintiff's medical records without a fully compliant authorization form, it is a threshold requirement of the statute that the plaintiff's medical authorization must be sufficient to enable defendants to obtain and review a plaintiff's relevant medical records.

HIPAA does not preempt New Jersey's state-law procedure permitting informal interviews of treating physicians when the applicable authorization and discovery safeguards are used.

Smith v. American Home Prod. Corp. · filed 2003-09-23§ 164.508

The answer is plainly "no."

A state medical-negligence statute requiring a HIPAA-compliant authorization before suit is consistent with § 164.508 and is not federally preempted.

Glen Murphy v. Aldolfo C. Dulay · filed 2014-10-10§ 164.508

In summary, after reviewing the HIPAA regulations, we conclude that the authorization form required in § 766.1065 complies with HIPAA.

A plaintiff who places medical condition in controversy may be compelled to furnish HIPAA-compliant authorizations for informal interviews, although the treating physician remains free not to cooperate.

Arons v. Jutkowitz · filed 2007-11-27§ 164.508

Plaintiffs waived the physician-patient privilege as to this information when they brought suit, so there was no basis for their refusal to furnish the requested HIPAA-compliant authorizations.

A valid authorization is an alternative route to disclosure of protected health information, and the disclosure must conform to the authorization.

In re Estate of Broderick · filed 2005-12-16§ 164.508(a)(1), (c)

If a covered entity receives a valid authorization, its disclosure must be consistent with that authorization.

The regulation requires written authorization before a covered health-care provider discloses a patient's protected medical records, absent a separate HIPAA exception.

Doe v. Univ. of S. Cal. · filed 2018-12-1145 C.F.R. § 164.508(a)(1)

USC would need Jane's written authorization to obtain her medical records from the rape treatment center.