# HIPAA authorization

> A HIPAA authorization is a signed form that lets your providers release health records to someone else, such as an insurer. See what it must say.

Canonical page: https://accidentclaimfacts.com/glossary/hipaa-authorization/  
Last reviewed: October 29, 2026 by the Accident Claim Facts editorial team  
General information, not legal advice. Talk to a licensed attorney in your state.

## Quick answer

A HIPAA authorization is a signed form that lets your doctor, hospital or other health care provider release your health information to someone else, such as an insurance company. Federal rules say a valid form must state what will be released, who may release it, who may receive it, the purpose, an expiration date or event, and your signature and date.

## In a car accident claim

After a crash, an adjuster for an insurer may send an authorization to sign. It lets the insurer get records straight from your providers instead of waiting for you to send them. Some forms are broad: they cover every provider and every date, including old visits that have nothing to do with the crash. Many people read the form closely, and some ask for one limited to the providers and dates related to the crash.

You can take an authorization back at any time, in writing, except for anything already done in reliance on it. Counseling records get extra protection: psychotherapy notes generally need their own separate authorization. You also have your own right to the records in your designated record set, and a provider generally must act on your request within 30 days. Our guide to [medical records](https://accidentclaimfacts.com/claim-process/medical-records/) explains how to request them.

## Example

> **Example:** An adjuster mails a form that covers "all medical records from any provider" with no end date. The injured driver's file includes years of unrelated visits. They ask the insurer to accept a version limited to the hospital and clinic that treated them after the crash, with an expiration date.

## Related terms

- [Designated record set](https://accidentclaimfacts.com/glossary/designated-record-set/)
- [Psychotherapist-patient privilege](https://accidentclaimfacts.com/glossary/psychotherapist-patient-privilege/)
- [Recorded statement](https://accidentclaimfacts.com/glossary/recorded-statement/)

## FAQ

### Do I have to sign a HIPAA authorization for the other driver's insurer?

HIPAA itself does not require you to sign one. Without it, the insurer generally cannot get records from your providers directly, but it will still want proof of your injuries before it pays. Your own policy may have separate cooperation terms.

### How long does a HIPAA authorization last?

Until the expiration date or event written on the form, unless you revoke it sooner in writing. A form that leaves out a required element, such as the expiration, is not valid.

## Sources

- [eCFR, 45 CFR 164.508 Uses and disclosures for which an authorization is required](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508) — required elements, revocation and psychotherapy notes
- [HHS, HIPAA FAQ: How timely must a covered entity be in responding to individuals' requests for access to their PHI?](https://www.hhs.gov/hipaa/for-professionals/faq/how-timely-must-a-covered-entity-be/index.html), checked June 24, 2016