HIPAA Authorization Form - Utah

comments throughout and customize as needed.
3. Remove all guidance comments before final execution.
4. Have this document reviewed by qualified Utah legal counsel before use.
JURISDICTION: UT
LAST UPDATED: 2026-05-11
-->

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (UTAH)

(Comprehensive — HIPAA + Utah mental health, HIV/communicable disease, substance use, medical records, and genetic privacy laws)

TABLE OF CONTENTS

1. Parties and Document Header
2. Definitions
3. Description of PHI and Authorized Disclosure
4. Special Categories of Sensitive Information (Utah-Specific)
5. Purpose, Recipients, and Expiration
6. Patient Rights — Revocation, Refusal, Re-Disclosure
7. Representations and Acknowledgments
8. General Provisions
9. Execution Block

1. PARTIES AND DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Effective Date: [__/__/____]

This Authorization is executed pursuant to 45 C.F.R. § 164.508 and the laws of the State of Utah, including Utah Code §§ 26B-5-312, 26B-5-503, 26B-7-201 et seq., 78B-5-618, and Title 13, Chapter 60, Part 2 (Genetic Testing Privacy).

2. DEFINITIONS

"Authorization" means this HIPAA authorization form, including all schedules and addenda.

"Covered Entity" or "CE" has the meaning given in 45 C.F.R. § 160.103.

"HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and its implementing regulations at 45 C.F.R. Parts 160 and 164.

"Individual" means the subject of the PHI and the signatory hereto, as defined in 45 C.F.R. § 160.103.

"Mental Health Records" means records subject to Utah Code § 26B-5-312 (formerly § 62A-15-643) and § 58-60-114.

"PHI" means Protected Health Information as defined in 45 C.F.R. § 160.103.

"Private Genetic Information" has the meaning given in Utah Code § 13-60-102.

"Substance Use Records" means records subject to 42 C.F.R. Part 2 and Utah Code § 26B-5-503.

3. DESCRIPTION OF PHI AND AUTHORIZED DISCLOSURE

3.1 Description of PHI to be Used or Disclosed (45 C.F.R. § 164.508(c)(1)(i)):

[Describe records with reasonable specificity — e.g., "All medical records from [DATE] through [DATE]," "Discharge summaries from [Hospital]," "Laboratory results dated [____]," "Imaging studies," "Physician progress notes."]

3.2 Date Range. Records dated from [__/__/____] to [__/__/____], or ☐ all dates on file.

3.3 Form of Disclosure. Disclosure shall be made by:
☐ Paper copy
☐ Electronic copy (PDF / EHR portal) — fee cap per Utah Code § 78B-5-618(10)(c)(ii)(B)
☐ Certified copy
☐ Facsimile to: [_______________________]
☐ Other: [_______________________]

4. SPECIAL CATEGORIES OF SENSITIVE INFORMATION (UTAH-SPECIFIC)

I specifically authorize the disclosure of the following categories of records (initial each that applies):

4.1 Re-Disclosure of 42 C.F.R. Part 2 Records. Federal law (42 C.F.R. Part 2) prohibits any further re-disclosure of substance use disorder records unless: (a) the Individual signs a separate written consent expressly permitting re-disclosure, (b) re-disclosure is otherwise expressly permitted by 42 C.F.R. Part 2, or (c) re-disclosure is required by law. A general HIPAA authorization is NOT sufficient.

4.2 Re-Disclosure — Communicable Disease Records. Information disclosed under Utah Code §§ 26B-7-201 to 26B-7-223 remains subject to the confidentiality requirements of those sections.

4.3 Genetic Information. Disclosure of private genetic information is subject to the restrictions of Utah's Genetic Testing Privacy Act (Title 13, Ch. 60, Pt. 2) and the federal Genetic Information Nondiscrimination Act ("GINA"). Employers and health insurers face specific restrictions on access and use.

5. PURPOSE, RECIPIENTS, AND EXPIRATION

5.1 Purpose of Disclosure (45 C.F.R. § 164.508(c)(1)(iv)):
☐ Continuity of care / treatment by new provider
☐ Personal use by the Individual ("at the request of the individual")
☐ Insurance / payment / claims
☐ Legal proceeding — Case No. [_______________________]
☐ Disability / SSA / VA benefits
☐ Workers' compensation
☐ Research study: [_______________________]
☐ Other: [_______________________]

5.2 Authorized Recipient(s) (45 C.F.R. § 164.508(c)(1)(iii)):
Name: [_______________________]
Address: [_______________________]
Phone / Fax / Email: [_______________________]

5.3 Expiration (45 C.F.R. § 164.508(c)(1)(v)). This Authorization expires on the EARLIEST of:
(a) Date: [__/__/____]; or
(b) Event: [e.g., "conclusion of legal proceeding," "completion of research study," "termination of insurance claim"]; or
(c) Written revocation by the Individual under Section 6.1.

If left blank, this Authorization expires one (1) year from the Effective Date.

6. PATIENT RIGHTS — REVOCATION, REFUSAL, RE-DISCLOSURE

6.1 Right to Revoke (45 C.F.R. § 164.508(c)(2)(i)). I may revoke this Authorization at any time by submitting a signed written revocation to:
[Covered Entity HIPAA Privacy Officer Name / Address]

Revocation is effective upon receipt, EXCEPT to the extent the Covered Entity has already acted in reliance on this Authorization before receiving the revocation.

6.2 Refusal Does Not Affect Treatment (45 C.F.R. § 164.508(c)(2)(ii)). The Covered Entity may NOT condition treatment, payment, enrollment in a health plan, or eligibility for benefits on my signing this Authorization, except as permitted under 45 C.F.R. § 164.508(b)(4).

6.3 Re-Disclosure Warning (45 C.F.R. § 164.508(c)(2)(iii)). I understand that information disclosed pursuant to this Authorization may be re-disclosed by the recipient and may no longer be protected by HIPAA. However, records subject to 42 C.F.R. Part 2, Utah Code § 26B-5-503, Utah Code §§ 26B-7-201 et seq., and Utah's Genetic Testing Privacy Act retain their statutory protection against re-disclosure.

6.4 Right to Copy. I am entitled to receive a copy of this signed Authorization (45 C.F.R. § 164.508(c)(4)).

6.5 Right to Inspect / Copy Records. Utah Code § 78B-5-618 and 45 C.F.R. § 164.524 provide me with the right to inspect and obtain copies of my own medical records, subject to statutory fee caps and limited exceptions.

7. REPRESENTATIONS AND ACKNOWLEDGMENTS

7.1 Capacity. I represent that I am the Individual identified above, or the legally authorized personal representative under Utah law (e.g., parent of a minor under Utah Code § 78B-3-406; guardian under § 75-5-301 et seq.; attorney-in-fact for health-care decisions under § 75-2a-101 et seq.; or attorney-in-fact under a declaration for mental health treatment under Utah Code § 26B-5-313).

7.2 Voluntary. I have read and understand this Authorization. I sign it freely and voluntarily, without coercion.

7.3 Compensation. ☐ I have / ☐ I have NOT received remuneration in exchange for executing this Authorization. (If marketing or sale of PHI is involved, additional disclosures are required under 45 C.F.R. § 164.508(a)(3)-(4).)

7.4 Stringent Utah Law Acknowledged. I understand that Utah mental health, HIV/communicable disease, substance use, and genetic information records are subject to confidentiality protections more stringent than HIPAA, and that those protections continue to apply notwithstanding any disclosure made under this Authorization.

8. GENERAL PROVISIONS

8.1 Governing Law. This Authorization is governed by HIPAA and, to the extent not preempted, the laws of the State of Utah.

8.2 Severability. If any provision is held invalid, the remaining provisions remain in full force.

8.3 Counterparts and Electronic Signatures. Executed counterparts and electronic signatures (E-SIGN; Utah Uniform Electronic Transactions Act, Utah Code § 46-4-101 et seq.) are deemed originals.

8.4 Form Compliance. This form is intended to satisfy the core elements of 45 C.F.R. § 164.508(c). Specific recipients may require supplemental forms (e.g., separate 42 C.F.R. Part 2 consent or genetic information release).

9. EXECUTION BLOCK

IN WITNESS WHEREOF, the Individual (or personal representative) executes this Authorization as of the Effective Date.

Individual / Patient

Signature: _________________________________
Printed Name: _____________________________
Date: __________________

Personal Representative (if applicable)

Signature: _________________________________
Printed Name: _____________________________
Authority / Relationship: _____________________ (e.g., parent of minor; guardian under Utah Code § 75-5-301; agent under § 75-2a-101 et seq.; attorney-in-fact under § 26B-5-313)
Date: __________________

Witness (recommended for mental health, substance use, or genetic information authorizations)

Signature: _________________________________
Printed Name: _____________________________
Date: __________________

Covered Entity Acknowledgment (optional)

By: __________________________ Title: ____________________
Printed Name: _____________________________
Date: __________________

Sources and References

• 45 C.F.R. § 164.508 — HIPAA authorization core elements
• 45 C.F.R. § 164.508(a)(2) — Psychotherapy notes
• 42 C.F.R. Part 2 — Federal substance use disorder confidentiality
• Utah Code § 26B-5-312 — Confidentiality of mental health information and records (recompiled 2023)
• Utah Code § 26B-5-313 — Declaration for mental health treatment
• Utah Code § 26B-5-503 — Substance use disorder treatment confidentiality
• Utah Code §§ 26B-7-201 to 26B-7-223 — Communicable disease and HIV reporting / confidentiality
• Utah Code § 78B-5-618 — Patient access to medical records (fee caps)
• Utah Code Title 13, Chapter 60, Part 2 — Genetic Testing and Procedure Privacy Act
• Utah Code § 58-60-114 — Mental health therapist–client confidential communications
• Utah Courts, Patient / Third-Party Access to Medical Records (2026 fee schedule): https://www.utcourts.gov/en/court-records-publications/resources/interest-rates/medical-records.html