Glossary
HIPAA authorization
A signed form that lets a doctor, hospital or other provider release your health information to someone else, such as an insurer. It must say what is released, to whom, why and when it expires.
General information, not legal advice. Talk to a licensed attorney in your state.
Quick answer
A HIPAA authorization is a signed form that lets your doctor, hospital or other health care provider release your health information to someone else, such as an insurance company. Federal rules say a valid form must state what will be released, who may release it, who may receive it, the purpose, an expiration date or event, and your signature and date.
In a car accident claim#
After a crash, an Insurance adjuster. The insurance company employee who investigates a claim, decides what the policy covers and negotiates payment. Glossary for an insurer may send an authorization to sign. It lets the insurer get records straight from your providers instead of waiting for you to send them. Some forms are broad: they cover every provider and every date, including old visits that have nothing to do with the crash. Many people read the form closely, and some ask for one limited to the providers and dates related to the crash.
You can take an authorization back at any time, in writing, except for anything already done in reliance on it. Counseling records get extra protection: psychotherapy notes generally need their own separate authorization. You also have your own right to the records in your Designated record set. The records a health care provider or health plan keeps about you and uses to make decisions, including medical and billing records. Your HIPAA right of access covers these records. Glossary, and a provider generally must act on your request within 30 days. Our guide to medical records explains how to request them.
Example#
Related terms#
Questions people ask
Do I have to sign a HIPAA authorization for the other driver's insurer?
HIPAA itself does not require you to sign one. Without it, the insurer generally cannot get records from your providers directly, but it will still want proof of your injuries before it pays. Your own policy may have separate cooperation terms.
How long does a HIPAA authorization last?
Until the expiration date or event written on the form, unless you revoke it sooner in writing. A form that leaves out a required element, such as the expiration, is not valid.
Sources
- eCFR, 45 CFR 164.508 Uses and disclosures for which an authorization is required — required elements, revocation and psychotherapy notes
- HHS, HIPAA FAQ: How timely must a covered entity be in responding to individuals' requests for access to their PHI? — as of June 2016
Last reviewed October 29, 2026 by the Accident Claim Facts editorial team. Found an error? Tell us.
Keep reading
- GlossaryGlossaryShort, plain-English definitions of the legal and insurance terms that come up after a crash, each with an example, related terms and the sources behind it.
- The claim processMedical recordsYour HIPAA right to copies of your medical records and bills, how fast providers must answer and what they may charge, what to request for a claim, and what…
- Injury typesPTSD and anxietyEmotional harm after a crash, including PTSD and anxiety, can be part of an injury claim. This guide covers what official health sources say, records, privacy…
- GlossaryHit-and-runA crash in which a driver leaves without stopping, giving information or helping the injured, as the law requires.
- GlossaryImpairment ratingA doctor's measure, usually a percentage, of the lasting loss of function an injury left once recovery has leveled off. It describes the body, not the value…
- GlossaryIndependent contractorA worker who runs their own business and controls how the work is done. The respondeat superior rule that applies to employees does not apply to independent…