[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"guide-payload-hipaa-requirements-by-state":3},{"id":4,"cmsSource":5,"title":6,"slug":7,"butterSlug":8,"category":9,"state":8,"legalPage":10,"author":8,"tldr":8,"costBreakdown":509,"summary":8,"featuredImage":8,"featuredImageUrl":8,"featuredImageAlt":8,"hero":510,"headerOverride":511,"tocTitle":8,"hideToc":8,"body":513,"categories":822,"tags":823,"primaryProduct":824,"meta":825,"updatedAt":828,"createdAt":829,"_status":508},599,"payload","HIPAA Authorization Requirements by State: What's Different?","hipaa-requirements-by-state",null,"personal",{"id":11,"cmsSource":5,"title":12,"slug":13,"productSlug":8,"documentType":14,"butterSlug":8,"previewPath":8,"relatedGuide":8,"quickLinks":15,"hero":16,"sections":54,"sidebarAd":480,"meta":493,"disclaimer":8,"legacyDisclaimerHtml":8,"updatedAt":506,"createdAt":507,"_status":508},172,"HIPAA Authorization","hipaa-authorization","other",[],{"landerVariant":17,"headline":18,"headlineAccent":8,"subtitle":19,"legacySubtitleHtml":8,"checkmarkText":8,"desktopImage":33,"mobileImage":44,"desktopImageUrl":8,"mobileImageUrl":8,"ctaType":53,"ctaText":8,"ctaLink":8},"design-test-v3","HIPAA Authorization Form",{"root":20},{"type":21,"format":22,"indent":23,"version":24,"children":25,"direction":8},"root","",0,1,[26],{"type":27,"format":22,"indent":23,"version":24,"children":28,"direction":8,"textStyle":22,"textFormat":23},"paragraph",[29],{"mode":30,"text":31,"type":32,"style":22,"detail":23,"format":23,"version":24},"normal","Give your healthcare provider written permission to share your protected health information with someone you name.","text",{"id":34,"alt":8,"updatedAt":35,"createdAt":36,"url":37,"thumbnailURL":8,"filename":38,"mimeType":39,"filesize":40,"width":41,"height":42,"focalX":43,"focalY":43},361,"2026-09-15T11:50:11.668Z","2026-09-15T11:50:11.575Z","https:\u002F\u002Fs3.us-east-2.amazonaws.com\u002Fshared-cms-main-media.legalnature.com\u002FHIPPA%20preview.png","HIPPA preview.png","image\u002Fpng",965366,1319,1592,50,{"id":45,"alt":8,"updatedAt":46,"createdAt":47,"url":48,"thumbnailURL":8,"filename":49,"mimeType":39,"filesize":50,"width":51,"height":52,"focalX":43,"focalY":43},362,"2026-09-15T11:50:18.779Z","2026-09-15T11:50:18.740Z","https:\u002F\u002Fs3.us-east-2.amazonaws.com\u002Fshared-cms-main-media.legalnature.com\u002FHIPPA%20preview%20mobile.png","HIPPA preview mobile.png",121834,1134,690,"standard",[55,81,128,135,171,243,249,287,320,324,368,371,393,396,473],{"id":56,"content":57,"legacyHtml":8,"variant":76,"anchorId":8,"alignment":77,"ctaText":8,"ctaLink":8,"padding":78,"blockName":8,"blockType":79,"visibility":80},"6a8de9b55cb0a7cbbec42640",{"root":58},{"type":21,"format":22,"indent":23,"version":24,"children":59,"direction":8},[60,66,72],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":63,"direction":8},"h2","heading",[64],{"mode":30,"text":65,"type":32,"style":22,"detail":23,"format":23,"version":24},"What is a HIPAA authorization form?",{"type":27,"format":22,"indent":23,"version":24,"children":67,"direction":8,"textStyle":22,"textFormat":24},[68,70],{"mode":30,"text":69,"type":32,"style":22,"detail":23,"format":24,"version":24},"A HIPAA authorization is a signed document that gives a healthcare provider, hospital, or health plan permission to share your protected health information with a specific person you name.",{"mode":30,"text":71,"type":32,"style":22,"detail":23,"format":23,"version":24}," Without one, HIPAA's privacy rule blocks doctors and other covered entities from releasing your medical records — even to a spouse, adult child, or caregiver. LegalNature's HIPAA authorization form is state-compliant and lets you specify exactly what information can be shared, with whom, and for how long.",{"type":27,"format":22,"indent":23,"version":24,"children":73,"direction":8,"textStyle":22,"textFormat":23},[74],{"mode":30,"text":75,"type":32,"style":22,"detail":23,"format":23,"version":24},"Most people don't think about medical records access until they're in a hospital waiting room being told a spouse or adult child \"can't be given any information\" — even in an emergency. A HIPAA authorization closes that gap before it becomes a crisis. It's a short, simple document, but it does something a general power of attorney or advance directive doesn't: it directly unlocks communication between your healthcare providers and the people you trust.","default","left","medium","rich-content",{"hideOnMobile":8,"hideOnDesktop":8},{"id":82,"heading":83,"layout":84,"columns":8,"itemStyle":85,"blockName":8,"items":86,"blockType":126,"visibility":127},"6a8dea395cb0a7cbbec42641","See our other healthcare documents","grid","card-with-image",[87,105],{"id":88,"title":89,"description":90,"legacyHtml":8,"image":97,"imageUrl":8,"url":104},"6a8dea495cb0a7cbbec42642","Healthcare Power of Attorney",{"root":91},{"type":21,"format":22,"indent":23,"version":24,"children":92,"direction":8},[93],{"type":27,"format":22,"indent":23,"version":24,"children":94,"direction":8,"textStyle":22,"textFormat":23},[95],{"mode":30,"text":96,"type":32,"style":22,"detail":23,"format":23,"version":24},"Authorizes a trusted person to make medical decisions if you are unable to communicate your wishes, including end-of-life care and treatment choices. Also referred to as a medical power of attorney in many states.",{"id":98,"alt":8,"updatedAt":99,"createdAt":100,"url":101,"thumbnailURL":8,"filename":102,"mimeType":39,"filesize":103,"width":41,"height":42,"focalX":43,"focalY":43},360,"2026-09-15T11:43:12.674Z","2026-09-15T11:43:12.565Z","https:\u002F\u002Fs3.us-east-2.amazonaws.com\u002Fshared-cms-main-media.legalnature.com\u002FHPOA%20preview.png","HPOA preview.png",1088874,"\u002Fdocuments\u002Fcreate\u002Fhealthcare-power-of-attorney",{"id":106,"title":107,"description":108,"legacyHtml":8,"image":115,"imageUrl":22,"url":125},"6a8dea585cb0a7cbbec42643","Advance Healthcare Directive",{"root":109},{"type":21,"format":22,"indent":23,"version":24,"children":110,"direction":8},[111],{"type":27,"format":22,"indent":23,"version":24,"children":112,"direction":8,"textStyle":22,"textFormat":23},[113],{"mode":30,"text":114,"type":32,"style":22,"detail":23,"format":23,"version":24},"A legal document that lets a person outline their preferences for medical care if they become unable to make or communicate their own decisions due to illness or incapacity.",{"id":116,"alt":8,"updatedAt":117,"createdAt":118,"url":119,"thumbnailURL":8,"filename":120,"mimeType":121,"filesize":122,"width":123,"height":124,"focalX":43,"focalY":43},241,"2026-10-14T16:33:47.088Z","2026-08-05T20:43:15.110Z","https:\u002F\u002Fs3.us-east-2.amazonaws.com\u002Fshared-cms-main-media.legalnature.com\u002FAdvance%20Healthcare%20Directive%20Preview%20D","Advance Healthcare Directive Preview D","image\u002Fwebp",442816,1200,1448,"\u002Fdocuments\u002Fcreate\u002Fadvance-healthcare-directive","list",{"hideOnMobile":8,"hideOnDesktop":8},{"id":129,"heading":130,"showStates":131,"hideOnStateOverride":132,"blockName":8,"blockType":133,"visibility":134},"6a8deb3c5cb0a7cbbec42644","Create a HIPAA authorization in your state",true,false,"state-selector",{"hideOnMobile":8,"hideOnDesktop":8},{"id":136,"heading":137,"blockName":8,"items":138,"blockType":169,"visibility":170},"6a8debe75cb0a7cbbec42648","How to create your HIPAA authorization with LegalNature",[139,149,159],{"id":140,"title":141,"description":142,"legacyHtml":8},"6a8dec175cb0a7cbbec42649","Answer a few simple questions in our online form",{"root":143},{"type":21,"format":22,"indent":23,"version":24,"children":144,"direction":8},[145],{"type":27,"format":22,"indent":23,"version":24,"children":146,"direction":8,"textStyle":22,"textFormat":23},[147],{"mode":30,"text":148,"type":32,"style":22,"detail":23,"format":23,"version":24},"Tell us who you're authorizing, what categories of information they can access, and how long the authorization should last.",{"id":150,"title":151,"description":152,"legacyHtml":8},"6a8dec2d5cb0a7cbbec4264a","Preview your document",{"root":153},{"type":21,"format":22,"indent":23,"version":24,"children":154,"direction":8},[155],{"type":27,"format":22,"indent":23,"version":24,"children":156,"direction":8,"textStyle":22,"textFormat":23},[157],{"mode":30,"text":158,"type":32,"style":22,"detail":23,"format":23,"version":24},"Review your state-specific HIPAA authorization before finalizing it.",{"id":160,"title":161,"description":162,"legacyHtml":8},"6a8dec375cb0a7cbbec4264b","Print, sign, and deliver",{"root":163},{"type":21,"format":22,"indent":23,"version":24,"children":164,"direction":8},[165],{"type":27,"format":22,"indent":23,"version":24,"children":166,"direction":8,"textStyle":22,"textFormat":23},[167],{"mode":30,"text":168,"type":32,"style":22,"detail":23,"format":23,"version":24},"Print and sign your authorization, then provide a copy to each healthcare provider, hospital, or health plan you want to honor it.","steps",{"hideOnMobile":8,"hideOnDesktop":8},{"id":172,"content":173,"legacyHtml":8,"variant":76,"anchorId":8,"alignment":77,"ctaText":240,"ctaLink":241,"padding":78,"blockName":8,"blockType":79,"visibility":242},"6a8deb685cb0a7cbbec42645",{"root":174},{"type":21,"format":22,"indent":23,"version":24,"children":175,"direction":8},[176,180],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":177,"direction":8},[178],{"mode":30,"text":179,"type":32,"style":22,"detail":23,"format":23,"version":24},"Why you may need a HIPAA authorization",{"tag":181,"type":126,"start":24,"format":22,"indent":23,"version":24,"children":182,"listType":239,"direction":8,"textFormat":24},"ul",[183,190,197,204,211,218,225,232],{"type":184,"value":24,"format":22,"indent":23,"version":24,"children":185,"direction":8},"listitem",[186,188],{"mode":30,"text":187,"type":32,"style":22,"detail":23,"format":24,"version":24},"Give a spouse or adult child access to your medical records",{"mode":30,"text":189,"type":32,"style":22,"detail":23,"format":23,"version":24}," so they can follow up with doctors, review test results, or manage care during a hospitalization.",{"type":184,"value":191,"format":22,"indent":23,"version":24,"children":192,"direction":8},2,[193,195],{"mode":30,"text":194,"type":32,"style":22,"detail":23,"format":24,"version":24},"Let a caregiver coordinate care",{"mode":30,"text":196,"type":32,"style":22,"detail":23,"format":23,"version":24}," across multiple providers without waiting on you to personally approve every call.",{"type":184,"value":198,"format":22,"indent":23,"version":24,"children":199,"direction":8},3,[200,202],{"mode":30,"text":201,"type":32,"style":22,"detail":23,"format":24,"version":24},"Keep family members informed during travel, surgery, or illness",{"mode":30,"text":203,"type":32,"style":22,"detail":23,"format":23,"version":24}," without them having to track you down for verbal permission each time.",{"type":184,"value":205,"format":22,"indent":23,"version":24,"children":206,"direction":8},4,[207,209],{"mode":30,"text":208,"type":32,"style":22,"detail":23,"format":24,"version":24},"Support an aging parent's care",{"mode":30,"text":210,"type":32,"style":22,"detail":23,"format":23,"version":24}," by giving one or more adult children the ability to speak directly with physicians and hospital staff.",{"type":184,"value":212,"format":22,"indent":23,"version":24,"children":213,"direction":8},5,[214,216],{"mode":30,"text":215,"type":32,"style":22,"detail":23,"format":24,"version":24},"Protect against gaps left by other estate planning documents",{"mode":30,"text":217,"type":32,"style":22,"detail":23,"format":23,"version":24}," — a healthcare power of attorney authorizes someone to make medical decisions, but it doesn't always guarantee the same person can access records unless HIPAA-compliant language is included.",{"type":184,"value":219,"format":22,"indent":23,"version":24,"children":220,"direction":8},6,[221,223],{"mode":30,"text":222,"type":32,"style":22,"detail":23,"format":24,"version":24},"Control disclosure instead of leaving it to chance",{"mode":30,"text":224,"type":32,"style":22,"detail":23,"format":23,"version":24}," by naming exactly who can receive your information and what categories of records they can see.",{"type":184,"value":226,"format":22,"indent":23,"version":24,"children":227,"direction":8},7,[228,230],{"mode":30,"text":229,"type":32,"style":22,"detail":23,"format":24,"version":24},"Simplify insurance and billing questions",{"mode":30,"text":231,"type":32,"style":22,"detail":23,"format":23,"version":24}," by authorizing a trusted person to discuss claims, coverage, or billing disputes with your health plan.",{"type":184,"value":233,"format":22,"indent":23,"version":24,"children":234,"direction":8},8,[235,237],{"mode":30,"text":236,"type":32,"style":22,"detail":23,"format":24,"version":24},"Set an expiration date or event",{"mode":30,"text":238,"type":32,"style":22,"detail":23,"format":23,"version":24}," so the authorization doesn't outlive its purpose.","bullet","Create Your HIPAA Authorization Today","\u002Fdocuments\u002Fcreate\u002Fhipaa-authorization",{"hideOnMobile":8,"hideOnDesktop":8},{"id":244,"style":245,"size":246,"blockName":8,"blockType":247,"visibility":248},"6a8dec705cb0a7cbbec4264c","line","lg","separator",{"hideOnMobile":8,"hideOnDesktop":8},{"id":250,"content":251,"legacyHtml":8,"variant":76,"anchorId":8,"alignment":77,"ctaText":8,"ctaLink":8,"padding":78,"blockName":8,"blockType":79,"visibility":286},"6a8deb805cb0a7cbbec42646",{"root":252},{"type":21,"format":22,"indent":23,"version":24,"children":253,"direction":8},[254,258,264],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":255,"direction":8},[256],{"mode":30,"text":257,"type":32,"style":22,"detail":23,"format":23,"version":24},"What information a HIPAA authorization can cover",{"type":27,"format":22,"indent":23,"version":24,"children":259,"direction":8,"textStyle":22,"textFormat":24},[260,262],{"mode":30,"text":261,"type":32,"style":22,"detail":23,"format":24,"version":24},"A HIPAA authorization can be as broad or as narrow as you want it to be.",{"mode":30,"text":263,"type":32,"style":22,"detail":23,"format":23,"version":24}," You choose the categories of information covered, and your document should specifically identify each one rather than relying on a blanket \"all records\" statement, which some providers will not accept. Common categories include the following:",{"tag":181,"type":126,"start":24,"format":22,"indent":23,"version":24,"children":265,"listType":239,"direction":8},[266,270,274,278,282],{"type":184,"value":24,"format":22,"indent":23,"version":24,"children":267,"direction":8},[268],{"mode":30,"text":269,"type":32,"style":22,"detail":23,"format":23,"version":24},"General medical records, including diagnoses, treatment notes, and physician correspondence",{"type":184,"value":191,"format":22,"indent":23,"version":24,"children":271,"direction":8},[272],{"mode":30,"text":273,"type":32,"style":22,"detail":23,"format":23,"version":24},"Billing, insurance, and payment records",{"type":184,"value":198,"format":22,"indent":23,"version":24,"children":275,"direction":8},[276],{"mode":30,"text":277,"type":32,"style":22,"detail":23,"format":23,"version":24},"Hospital and emergency room records",{"type":184,"value":205,"format":22,"indent":23,"version":24,"children":279,"direction":8},[280],{"mode":30,"text":281,"type":32,"style":22,"detail":23,"format":23,"version":24},"Prescription and pharmacy records",{"type":184,"value":212,"format":22,"indent":23,"version":24,"children":283,"direction":8},[284],{"mode":30,"text":285,"type":32,"style":22,"detail":23,"format":23,"version":24},"Lab results and diagnostic imaging",{"hideOnMobile":8,"hideOnDesktop":8},{"id":288,"content":289,"legacyHtml":8,"variant":318,"anchorId":8,"alignment":77,"ctaText":240,"ctaLink":8,"padding":78,"blockName":8,"blockType":79,"visibility":319},"6a8deb9a5cb0a7cbbec42647",{"root":290},{"type":21,"format":22,"indent":23,"version":24,"children":291,"direction":8},[292,296,314],{"type":27,"format":22,"indent":23,"version":24,"children":293,"direction":8,"textStyle":22,"textFormat":24},[294],{"mode":30,"text":295,"type":32,"style":22,"detail":23,"format":24,"version":24},"Certain categories of health information carry extra legal protection and may need to be specifically called out in your authorization, or may require a separate authorization entirely depending on the provider and state:",{"tag":181,"type":126,"start":24,"format":22,"indent":23,"version":24,"children":297,"listType":239,"direction":8},[298,302,306,310],{"type":184,"value":24,"format":22,"indent":23,"version":24,"children":299,"direction":8},[300],{"mode":30,"text":301,"type":32,"style":22,"detail":23,"format":23,"version":24},"Mental health and psychotherapy notes",{"type":184,"value":191,"format":22,"indent":23,"version":24,"children":303,"direction":8},[304],{"mode":30,"text":305,"type":32,"style":22,"detail":23,"format":23,"version":24},"HIV\u002FAIDS status and other communicable disease information",{"type":184,"value":198,"format":22,"indent":23,"version":24,"children":307,"direction":8},[308],{"mode":30,"text":309,"type":32,"style":22,"detail":23,"format":23,"version":24},"Substance use disorder treatment records, which are independently protected under a federal regulation known as 42 C.F.R. Part 2",{"type":184,"value":205,"format":22,"indent":23,"version":24,"children":311,"direction":8},[312],{"mode":30,"text":313,"type":32,"style":22,"detail":23,"format":23,"version":24},"Genetic testing information",{"type":27,"format":22,"indent":23,"version":24,"children":315,"direction":8,"textStyle":22,"textFormat":23},[316],{"mode":30,"text":317,"type":32,"style":22,"detail":23,"format":23,"version":24},"If you want a specific person to have access to any of these sensitive categories, say so explicitly in the authorization. A general authorization that doesn't name these categories may not be enough for a provider to release them, and consulting with an attorney is recommended if your situation involves highly sensitive medical information.","highlight",{"hideOnMobile":8,"hideOnDesktop":8},{"id":321,"style":245,"size":322,"blockName":8,"blockType":247,"visibility":323},"6a8dee6d5cb0a7cbbec42659","md",{"hideOnMobile":8,"hideOnDesktop":8},{"id":325,"content":326,"legacyHtml":8,"variant":76,"anchorId":8,"alignment":77,"ctaText":365,"ctaLink":366,"padding":78,"blockName":8,"blockType":79,"visibility":367},"6a8dee635cb0a7cbbec42658",{"root":327},{"type":21,"format":22,"indent":23,"version":24,"children":328,"direction":8},[329,333,337,359],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":330,"direction":8},[331],{"mode":30,"text":332,"type":32,"style":22,"detail":23,"format":23,"version":24},"HIPAA Authorization vs. Healthcare Power of Attorney",{"type":27,"format":22,"indent":23,"version":24,"children":334,"direction":8,"textStyle":22,"textFormat":23},[335],{"mode":30,"text":336,"type":32,"style":22,"detail":23,"format":23,"version":24},"These two documents are often confused, but they serve different purposes and are not substitutes for each other:",{"tag":181,"type":126,"start":24,"format":22,"indent":23,"version":24,"children":338,"listType":239,"direction":8},[339,349],{"type":184,"value":24,"format":22,"indent":23,"version":24,"children":340,"direction":8},[341,343,345,347],{"mode":30,"text":342,"type":32,"style":22,"detail":23,"format":24,"version":24},"HIPAA authorization",{"mode":30,"text":344,"type":32,"style":22,"detail":23,"format":23,"version":24}," — Gives a named person permission to ",{"mode":30,"text":346,"type":32,"style":22,"detail":23,"format":191,"version":24},"receive information",{"mode":30,"text":348,"type":32,"style":22,"detail":23,"format":23,"version":24}," about your medical records and health status. It does not give that person authority to make decisions on your behalf.",{"type":184,"value":191,"format":22,"indent":23,"version":24,"children":350,"direction":8},[351,353,355,357],{"mode":30,"text":352,"type":32,"style":22,"detail":23,"format":24,"version":24},"Healthcare power of attorney",{"mode":30,"text":354,"type":32,"style":22,"detail":23,"format":23,"version":24}," — Gives your agent authority to ",{"mode":30,"text":356,"type":32,"style":22,"detail":23,"format":191,"version":24},"make medical decisions",{"mode":30,"text":358,"type":32,"style":22,"detail":23,"format":23,"version":24}," for you if you become unable to make them yourself. It does not automatically guarantee your agent access to your records unless the document also includes HIPAA-compliant authorization language.",{"type":27,"format":22,"indent":23,"version":24,"children":360,"direction":8,"textStyle":22,"textFormat":24},[361,363],{"mode":30,"text":362,"type":32,"style":22,"detail":23,"format":24,"version":24},"The safest approach is to have both.",{"mode":30,"text":364,"type":32,"style":22,"detail":23,"format":23,"version":24}," A healthcare power of attorney without HIPAA authorization language can leave your agent unable to get the information they need to make informed decisions. A HIPAA authorization without a healthcare power of attorney lets someone see your records, but it doesn't give them any decision-making authority if you're incapacitated.","Learn More About a Healthcare Power of Attorney","https:\u002F\u002Fwww.legalnature.com\u002Fcategories\u002Fhealthcare\u002Fhealthcare-power-of-attorney",{"hideOnMobile":8,"hideOnDesktop":8},{"id":369,"style":245,"size":322,"blockName":8,"blockType":247,"visibility":370},"6a8deea05cb0a7cbbec4265a",{"hideOnMobile":8,"hideOnDesktop":8},{"id":372,"heading":373,"description":374,"legacyHtml":8,"image":381,"imageUrl":22,"layout":390,"blockName":8,"blockType":391,"visibility":392},"6a8deda85cb0a7cbbec4264e","Why choose LegalNature?",{"root":375},{"type":21,"format":22,"indent":23,"version":24,"children":376,"direction":8},[377],{"type":27,"format":22,"indent":23,"version":24,"children":378,"direction":8,"textStyle":22,"textFormat":23},[379],{"mode":30,"text":380,"type":32,"style":22,"detail":23,"format":23,"version":24},"LegalNature offers the guidance to navigate the nuances of healthcare document creation across all 50 states and the District of Columbia. LegalNature offers a 30-day money-back guarantee. If you're not happy, then we’re not happy. Give us a call and let us help.",{"id":382,"alt":8,"updatedAt":383,"createdAt":384,"url":385,"thumbnailURL":8,"filename":386,"mimeType":121,"filesize":387,"width":388,"height":389,"focalX":43,"focalY":43},218,"2026-07-29T18:21:40.238Z","2026-07-29T18:21:40.153Z","https:\u002F\u002Fs3.us-east-2.amazonaws.com\u002Fshared-cms-main-media.legalnature.com\u002FWhy%20Choose","Why Choose",204042,786,958,"image-right","media-content",{"hideOnMobile":8,"hideOnDesktop":8},{"id":394,"style":245,"size":322,"blockName":8,"blockType":247,"visibility":395},"6a8dedcf5cb0a7cbbec4264f",{"hideOnMobile":8,"hideOnDesktop":8},{"id":397,"heading":398,"background":399,"blockName":8,"items":400,"blockType":471,"visibility":472},"6a8dedd65cb0a7cbbec42650","Frequently asked questions","white",[401,411,421,431,441,451,461],{"id":402,"question":403,"answer":404,"legacyHtml":8},"6a8dedde5cb0a7cbbec42651","What is a HIPAA authorization?",{"root":405},{"type":21,"format":22,"indent":23,"version":24,"children":406,"direction":8},[407],{"type":27,"format":22,"indent":23,"version":24,"children":408,"direction":8,"textStyle":22,"textFormat":23},[409],{"mode":30,"text":410,"type":32,"style":22,"detail":23,"format":23,"version":24},"A HIPAA authorization is a signed document that gives a healthcare provider, hospital, or health plan permission to share your protected health information with a person or organization you name. Without it, HIPAA's Privacy Rule generally prevents these disclosures, even to close family members.",{"id":412,"question":413,"answer":414,"legacyHtml":8},"6a8dede95cb0a7cbbec42652","Why do I need a HIPAA authorization if I already have a healthcare power of attorney?",{"root":415},{"type":21,"format":22,"indent":23,"version":24,"children":416,"direction":8},[417],{"type":27,"format":22,"indent":23,"version":24,"children":418,"direction":8,"textStyle":22,"textFormat":23},[419],{"mode":30,"text":420,"type":32,"style":22,"detail":23,"format":23,"version":24},"A healthcare power of attorney gives your agent authority to make medical decisions for you, but it doesn't always guarantee that agent — or anyone else you trust — can access your medical records. A HIPAA authorization specifically unlocks records access, so pairing the two documents closes the gap between decision-making authority and information access.",{"id":422,"question":423,"answer":424,"legacyHtml":8},"6a8dedf35cb0a7cbbec42653","What information can a HIPAA authorization release?",{"root":425},{"type":21,"format":22,"indent":23,"version":24,"children":426,"direction":8},[427],{"type":27,"format":22,"indent":23,"version":24,"children":428,"direction":8,"textStyle":22,"textFormat":23},[429],{"mode":30,"text":430,"type":32,"style":22,"detail":23,"format":23,"version":24},"You choose. A HIPAA authorization can cover general medical records, billing and insurance information, hospital records, and prescription history. Sensitive categories like mental health notes, HIV\u002Fcommunicable disease status, substance use treatment records, and genetic information typically need to be specifically named to be included.",{"id":432,"question":433,"answer":434,"legacyHtml":8},"6a8dedfd5cb0a7cbbec42654","How long does a HIPAA authorization last?",{"root":435},{"type":21,"format":22,"indent":23,"version":24,"children":436,"direction":8},[437],{"type":27,"format":22,"indent":23,"version":24,"children":438,"direction":8,"textStyle":22,"textFormat":23},[439],{"mode":30,"text":440,"type":32,"style":22,"detail":23,"format":23,"version":24},"A HIPAA authorization must include an expiration date or a specific expiration event, such as \"upon revocation\" or the end of a particular course of treatment. You choose the time frame when you create your document, and some states impose their own default limits on certain categories of sensitive information.",{"id":442,"question":443,"answer":444,"legacyHtml":8},"6a8dee075cb0a7cbbec42655","Can I revoke a HIPAA authorization?",{"root":445},{"type":21,"format":22,"indent":23,"version":24,"children":446,"direction":8},[447],{"type":27,"format":22,"indent":23,"version":24,"children":448,"direction":8,"textStyle":22,"textFormat":23},[449],{"mode":30,"text":450,"type":32,"style":22,"detail":23,"format":23,"version":24},"Yes. You can revoke a HIPAA authorization in writing at any time, except to the extent a provider has already relied on it. Once revoked, notify each provider or organization that received a copy so they update their records accordingly.",{"id":452,"question":453,"answer":454,"legacyHtml":8},"6a8dee105cb0a7cbbec42656","Do I need a HIPAA authorization for my child?",{"root":455},{"type":21,"format":22,"indent":23,"version":24,"children":456,"direction":8},[457],{"type":27,"format":22,"indent":23,"version":24,"children":458,"direction":8,"textStyle":22,"textFormat":23},[459],{"mode":30,"text":460,"type":32,"style":22,"detail":23,"format":23,"version":24},"Parents generally have access to a minor child's medical records as the child's personal representative, but this changes once a child turns 18, and it can also change earlier for certain categories of care a minor is legally allowed to consent to on their own, depending on state law. A HIPAA authorization can formalize continued access where appropriate.",{"id":462,"question":463,"answer":464,"legacyHtml":8},"6a8dee1b5cb0a7cbbec42657","Is a HIPAA authorization the same as a general medical records release?",{"root":465},{"type":21,"format":22,"indent":23,"version":24,"children":466,"direction":8},[467],{"type":27,"format":22,"indent":23,"version":24,"children":468,"direction":8,"textStyle":22,"textFormat":23},[469],{"mode":30,"text":470,"type":32,"style":22,"detail":23,"format":23,"version":24},"They serve a similar purpose, but a HIPAA authorization is specifically structured to meet the requirements of the federal HIPAA Privacy Rule, including required elements like an expiration date, a description of the information covered, and a revocation notice. A generic \"release\" form may not include everything a provider needs to honor the request.","faqs",{"hideOnMobile":8,"hideOnDesktop":8},{"id":474,"headline":475,"text":476,"image":477,"ctaText":8,"blockName":8,"blockType":478,"visibility":479},"6a8def245cb0a7cbbec4265b","Start Your HIPAA Authorization","Complete your HIPAA authorization in minutes with LegalNature's intuitive, step-by-step guidance",{"id":34,"alt":8,"updatedAt":35,"createdAt":36,"url":37,"thumbnailURL":8,"filename":38,"mimeType":39,"filesize":40,"width":41,"height":42,"focalX":43,"focalY":43},"get-started",{"hideOnMobile":8,"hideOnDesktop":8},{"headline":481,"image":482,"imageUrl":8,"steps":483},"Create your HIPAA authorization in minutes",{"id":45,"alt":8,"updatedAt":46,"createdAt":47,"url":48,"thumbnailURL":8,"filename":49,"mimeType":39,"filesize":50,"width":51,"height":52,"focalX":43,"focalY":43},[484,487,490],{"id":485,"text":486},"6a8defca5cb0a7cbbec4265c","Complete our form",{"id":488,"text":489},"6a8defd25cb0a7cbbec4265d","Preview and download your document",{"id":491,"text":492},"6a8defdb5cb0a7cbbec4265e","Review, sign, and deliver your document",{"title":494,"description":495,"keyword":8,"ogImage":496},"HIPAA Authorization Form | LegalNature","Create a HIPAA authorization form online to let doctors, hospitals, and insurers share your medical records with the people you choose. 30-day money-back guarantee.",{"id":497,"alt":8,"updatedAt":498,"createdAt":499,"url":500,"thumbnailURL":8,"filename":501,"mimeType":502,"filesize":503,"width":504,"height":505,"focalX":43,"focalY":43},359,"2026-09-15T11:37:44.463Z","2026-09-15T11:37:44.201Z","https:\u002F\u002Fs3.us-east-2.amazonaws.com\u002Fshared-cms-main-media.legalnature.com\u002FHIPAA%20Authorization%20Form%20thumb.jpg","HIPAA Authorization Form thumb.jpg","image\u002Fjpeg",553695,1862,996,"2026-09-16T16:56:45.372Z","2026-08-25T19:13:38.045Z","published",[],{"overline":8,"title":8,"subtitle":8},{"title":8,"link":8,"cta":512},"Get Started",[514,528,551,582,588,636,673,675,710,751,806,819],{"id":515,"content":516,"legacyHtml":8,"blockName":8,"blockType":527},"6aa825d10979175c21a893dc",{"root":517},{"type":21,"format":22,"indent":23,"version":24,"children":518,"direction":8},[519],{"type":27,"format":22,"indent":23,"version":24,"children":520,"direction":8,"textStyle":22,"textFormat":23},[521,523,525],{"mode":30,"text":522,"type":32,"style":22,"detail":23,"format":23,"version":24},"HIPAA sets one federal floor for medical privacy, but it isn't the whole picture. ",{"mode":30,"text":524,"type":32,"style":22,"detail":23,"format":24,"version":24},"A number of states layer their own, stricter authorization rules on top of the federal baseline,",{"mode":30,"text":526,"type":32,"style":22,"detail":23,"format":23,"version":24}," sometimes for medical records generally, and more often for specific categories like mental health, HIV status, or genetic information. When a state law is more protective of privacy than HIPAA, the state law controls for that requirement.","guide-rich-text",{"id":529,"content":530,"legacyHtml":8,"blockName":8,"blockType":527},"6aa825ec0979175c21a893dd",{"root":531},{"type":21,"format":22,"indent":23,"version":24,"children":532,"direction":8},[533,537,543,547],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":534,"direction":8},[535],{"mode":30,"text":536,"type":32,"style":22,"detail":23,"format":23,"version":24},"Why Does HIPAA Allow States to Add Their Own Rules?",{"type":27,"format":22,"indent":23,"version":24,"children":538,"direction":8,"textStyle":22,"textFormat":24},[539,541],{"mode":30,"text":540,"type":32,"style":22,"detail":23,"format":24,"version":24},"HIPAA is a floor, not a ceiling, and federal regulation says so directly.",{"mode":30,"text":542,"type":32,"style":22,"detail":23,"format":23,"version":24}," Under 45 CFR § 160.203, a HIPAA standard generally overrides (\"preempts\") a contrary state law, but § 160.203(b) carves out an exception: a state law is not preempted if it relates to the privacy of health information and is \"more stringent\" than the HIPAA standard it would otherwise conflict with. A separate provision, 45 CFR § 160.202, defines what \"more stringent\" means: in practice, a state law qualifies if it gives individuals stronger privacy protections, broader access to their own records, or requires consent in situations where HIPAA alone would not.",{"type":27,"format":22,"indent":23,"version":24,"children":544,"direction":8,"textStyle":22,"textFormat":23},[545],{"mode":30,"text":546,"type":32,"style":22,"detail":23,"format":23,"version":24},"This is why a document that fully satisfies HIPAA can still fall short of what a particular state expects. The federal rule tells providers what they must do at minimum. It was never designed to be the only word on the subject, and lawmakers in many states have added their own layer of protection, usually for records they consider unusually sensitive.",{"type":27,"format":22,"indent":23,"version":24,"children":548,"direction":8,"textStyle":22,"textFormat":23},[549],{"mode":30,"text":550,"type":32,"style":22,"detail":23,"format":23,"version":24},"The result is that requirements can vary noticeably depending on where you live and what kind of records you're trying to authorize someone to access. Below are the three patterns that variation tends to follow.",{"id":552,"content":553,"legacyHtml":8,"blockName":8,"blockType":527},"6aa826050979175c21a893de",{"root":554},{"type":21,"format":22,"indent":23,"version":24,"children":555,"direction":8},[556,560,564,570,576],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":557,"direction":8},[558],{"mode":30,"text":559,"type":32,"style":22,"detail":23,"format":23,"version":24},"Trend 1: States With Their Own General Medical Privacy Law",{"type":27,"format":22,"indent":23,"version":24,"children":561,"direction":8,"textStyle":22,"textFormat":23},[562],{"mode":30,"text":563,"type":32,"style":22,"detail":23,"format":23,"version":24},"A handful of states have passed a broad medical privacy statute that applies to health records generally, not just one sensitive category. In these states, that law — not HIPAA alone — sets the baseline for what a valid authorization has to include.",{"type":27,"format":22,"indent":23,"version":24,"children":565,"direction":8,"textStyle":22,"textFormat":24},[566,568],{"mode":30,"text":567,"type":32,"style":22,"detail":23,"format":24,"version":24},"California",{"mode":30,"text":569,"type":32,"style":22,"detail":23,"format":23,"version":24}," is the clearest example. Its Confidentiality of Medical Information Act adds requirements that go beyond the federal rule, including specific formatting expectations and a shorter default validity period than many people assume applies everywhere. A HIPAA-only authorization used in California may not, on its own, satisfy the state's additional requirements.",{"type":27,"format":22,"indent":23,"version":24,"children":571,"direction":8,"textStyle":22,"textFormat":24},[572,574],{"mode":30,"text":573,"type":32,"style":22,"detail":23,"format":24,"version":24},"Minnesota",{"mode":30,"text":575,"type":32,"style":22,"detail":23,"format":23,"version":24}," takes a similar approach through its Health Records Act, which sets a general written-consent requirement for health records broadly, rather than limiting itself to one type of sensitive information. That's actually somewhat unusual — most states that add extra protection focus on a specific record category rather than covering health records across the board.",{"type":27,"format":22,"indent":23,"version":24,"children":577,"direction":8,"textStyle":22,"textFormat":24},[578,580],{"mode":30,"text":579,"type":32,"style":22,"detail":23,"format":24,"version":24},"What this means for you:",{"mode":30,"text":581,"type":32,"style":22,"detail":23,"format":23,"version":24}," if you live in a state with its own general medical privacy law, don't assume a generic form is enough. Look for language confirming the form accounts for your state's specific requirements, not just the federal ones.",{"id":583,"variant":584,"productName":12,"link":585,"cta":512,"message":586,"blockName":8,"blockType":587},"6aa8266e0979175c21a893df","document","https:\u002F\u002Fwww.legalnature.com\u002Fdocuments\u002Fcreate\u002Fhipaa-authorization","Create your state-compliant HIPAA authorization form today.","guide-product-cta",{"id":589,"content":590,"legacyHtml":8,"blockName":8,"blockType":527},"6aa826ad0979175c21a893e0",{"root":591},{"type":21,"format":22,"indent":23,"version":24,"children":592,"direction":8},[593,597,603,607,627,631],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":594,"direction":8},[595],{"mode":30,"text":596,"type":32,"style":22,"detail":23,"format":23,"version":24},"Trend 2: States That Single Out Sensitive Record Categories",{"type":27,"format":22,"indent":23,"version":24,"children":598,"direction":8,"textStyle":22,"textFormat":23},[599,601],{"mode":30,"text":600,"type":32,"style":22,"detail":23,"format":23,"version":24},"This is the more common pattern nationally. Rather than one broad statute, most states add extra protection for specific categories of records they consider especially sensitive: most often ",{"mode":30,"text":602,"type":32,"style":22,"detail":23,"format":24,"version":24},"mental health and psychotherapy notes, HIV and communicable disease status, substance use treatment records, and genetic information.",{"type":27,"format":22,"indent":23,"version":24,"children":604,"direction":8,"textStyle":22,"textFormat":23},[605],{"mode":30,"text":606,"type":32,"style":22,"detail":23,"format":23,"version":24},"A few examples of how this plays out:",{"tag":181,"type":126,"start":24,"format":22,"indent":23,"version":24,"children":608,"listType":239,"direction":8,"textFormat":24},[609,615,621],{"type":184,"value":24,"format":22,"indent":23,"version":24,"children":610,"direction":8},[611,613],{"mode":30,"text":612,"type":32,"style":22,"detail":23,"format":24,"version":24},"Texas",{"mode":30,"text":614,"type":32,"style":22,"detail":23,"format":23,"version":24}," has a detailed mental health records statute that covers authorized disclosure, required disclosure, and how someone can revoke consent for mental health records specifically — separate from how the state treats general medical records.",{"type":184,"value":191,"format":22,"indent":23,"version":24,"children":616,"direction":8},[617,619],{"mode":30,"text":618,"type":32,"style":22,"detail":23,"format":24,"version":24},"New York",{"mode":30,"text":620,"type":32,"style":22,"detail":23,"format":23,"version":24}," requires a specific, state-approved release for HIV-related information. A general HIPAA authorization is not sufficient on its own to release HIV records in New York; state health officials require the release to meet a distinct format.",{"type":184,"value":198,"format":22,"indent":23,"version":24,"children":622,"direction":8},[623,625],{"mode":30,"text":624,"type":32,"style":22,"detail":23,"format":24,"version":24},"Illinois",{"mode":30,"text":626,"type":32,"style":22,"detail":23,"format":23,"version":24}," maintains three separate laws covering mental health records, HIV\u002FAIDS-related information, and genetic information respectively, each with its own consent requirements, rather than relying on one general statute.",{"type":27,"format":22,"indent":23,"version":24,"children":628,"direction":8,"textStyle":22,"textFormat":23},[629],{"mode":30,"text":630,"type":32,"style":22,"detail":23,"format":23,"version":24},"Substance use treatment records add another layer on top of this: federal law (a rule separate from HIPAA, found at 42 C.F.R. Part 2) already requires its own specific consent for many federally assisted substance use programs, regardless of what state law says. Where a state also has its own substance use confidentiality rule, that can mean satisfying two separate consent standards at once.",{"type":27,"format":22,"indent":23,"version":24,"children":632,"direction":8,"textStyle":22,"textFormat":24},[633,634],{"mode":30,"text":579,"type":32,"style":22,"detail":23,"format":24,"version":24},{"mode":30,"text":635,"type":32,"style":22,"detail":23,"format":23,"version":24}," if you're trying to authorize the release of mental health, HIV, substance use, or genetic records, check whether your state calls for a separate, specifically worded authorization rather than a general one.",{"id":637,"content":638,"legacyHtml":8,"blockName":8,"blockType":527},"6aa827420979175c21a893e1",{"root":639},{"type":21,"format":22,"indent":23,"version":24,"children":640,"direction":8},[641,645,657,662,668],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":642,"direction":8},[643],{"mode":30,"text":644,"type":32,"style":22,"detail":23,"format":23,"version":24},"Trend 3: Fewer States Requiring Extra Signing Formalities ",{"type":27,"format":22,"indent":23,"version":24,"children":646,"direction":8,"textStyle":22,"textFormat":23},[647,649,651,653,655],{"mode":30,"text":648,"type":32,"style":22,"detail":23,"format":23,"version":24},"Beyond ",{"mode":30,"text":650,"type":32,"style":22,"detail":23,"format":191,"version":24},"what",{"mode":30,"text":652,"type":32,"style":22,"detail":23,"format":23,"version":24}," has to be authorized, a smaller number of states have addressed ",{"mode":30,"text":654,"type":32,"style":22,"detail":23,"format":191,"version":24},"how",{"mode":30,"text":656,"type":32,"style":22,"detail":23,"format":23,"version":24}," certain sensitive-record authorizations must be signed. This trend is real, but it's narrower than the first two, tied specifically to mental health records in the states that have it, and currently moving toward fewer formalities rather than more.",{"type":27,"format":22,"indent":23,"version":24,"children":658,"direction":8,"textStyle":22,"textFormat":24},[659,660],{"mode":30,"text":624,"type":32,"style":22,"detail":23,"format":24,"version":24},{"mode":30,"text":661,"type":32,"style":22,"detail":23,"format":23,"version":24}," offers the clearest, most current example. Its Mental Health and Developmental Disabilities Confidentiality Act required a witnessed signature for mental health record authorizations for years. That requirement was repealed in 2025, reflecting a broader shift toward simplifying consent formalities rather than adding to them.",{"type":27,"format":22,"indent":23,"version":24,"children":663,"direction":8,"textStyle":22,"textFormat":24},[664,666],{"mode":30,"text":665,"type":32,"style":22,"detail":23,"format":24,"version":24},"North Carolina",{"mode":30,"text":667,"type":32,"style":22,"detail":23,"format":23,"version":24}," takes a different approach for certain mental health and substance use records: it allows oral consent given in the presence of a witness the client chooses, as an alternative to a written signature — rather than requiring a witness on top of a written form.",{"type":27,"format":22,"indent":23,"version":24,"children":669,"direction":8,"textStyle":22,"textFormat":24},[670,671],{"mode":30,"text":579,"type":32,"style":22,"detail":23,"format":24,"version":24},{"mode":30,"text":672,"type":32,"style":22,"detail":23,"format":23,"version":24}," don't assume that every state requires a witness or notary for a HIPAA-related authorization. Most don't, and where a formality like this exists, it tends to apply narrowly to mental health records rather than to authorizations in general.",{"id":674,"variant":584,"productName":12,"link":585,"cta":512,"message":586,"blockName":8,"blockType":587},"6aa827820979175c21a893e2",{"id":676,"content":677,"legacyHtml":8,"blockName":8,"blockType":527},"6aa827890979175c21a893e3",{"root":678},{"type":21,"format":22,"indent":23,"version":24,"children":679,"direction":8},[680,684,688],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":681,"direction":8},[682],{"mode":30,"text":683,"type":32,"style":22,"detail":23,"format":23,"version":24},"How to Know If Your State Adds Anything Extra",{"type":27,"format":22,"indent":23,"version":24,"children":685,"direction":8,"textStyle":22,"textFormat":23},[686],{"mode":30,"text":687,"type":32,"style":22,"detail":23,"format":23,"version":24},"With this much variation, the most reliable approach is usually the simplest one:",{"tag":689,"type":126,"start":24,"format":22,"indent":23,"version":24,"children":690,"listType":709,"direction":8},"ol",[691,697,703],{"type":184,"value":24,"format":22,"indent":23,"version":24,"children":692,"direction":8},[693,695],{"mode":30,"text":694,"type":32,"style":22,"detail":23,"format":24,"version":24},"Ask the provider or facility directly",{"mode":30,"text":696,"type":32,"style":22,"detail":23,"format":23,"version":24}," whether they require anything beyond a standard HIPAA authorization for the type of record you're trying to release, especially for mental health, HIV, substance use, or genetic information.",{"type":184,"value":191,"format":22,"indent":23,"version":24,"children":698,"direction":8},[699,701],{"mode":30,"text":700,"type":32,"style":22,"detail":23,"format":24,"version":24},"Check whether the record falls into a sensitive category.",{"mode":30,"text":702,"type":32,"style":22,"detail":23,"format":23,"version":24}," General medical records are far less likely to need special handling than the categories covered in Trend 2.",{"type":184,"value":198,"format":22,"indent":23,"version":24,"children":704,"direction":8},[705,707],{"mode":30,"text":706,"type":32,"style":22,"detail":23,"format":24,"version":24},"Default to a form built to meet the stricter standard.",{"mode":30,"text":708,"type":32,"style":22,"detail":23,"format":23,"version":24}," A form designed to accommodate both the federal baseline and common state-level additions is more likely to be accepted without a second round of paperwork.","number",{"id":711,"content":712,"legacyHtml":8,"blockName":8,"blockType":527},"6aa836d50979175c21a893e4",{"root":713},{"type":21,"format":22,"indent":23,"version":24,"children":714,"direction":8},[715,719,734],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":716,"direction":8},[717],{"mode":30,"text":718,"type":32,"style":22,"detail":23,"format":23,"version":24},"What This Means for Filling Out Your Form",{"type":27,"format":22,"indent":23,"version":24,"children":720,"direction":8,"textStyle":22,"textFormat":23},[721,723,732],{"mode":30,"text":722,"type":32,"style":22,"detail":23,"format":23,"version":24},"The safest approach is a HIPAA authorization form that adjusts to the state you select, rather than a one-size-fits-all template. LegalNature's ",{"id":724,"type":725,"fields":726,"format":22,"indent":23,"version":198,"children":729,"direction":8},"6aa836e2f0f716292954cb7e","link",{"url":727,"newTab":132,"linkType":728},"http:\u002F\u002Flegalnature.com\u002Fcategories\u002Fpersonal-affairs\u002Fhipaa-authorization","custom",[730],{"mode":30,"text":731,"type":32,"style":22,"detail":23,"format":23,"version":24},"HIPAA authorization form",{"mode":30,"text":733,"type":32,"style":22,"detail":23,"format":23,"version":24}," is built to reflect state-specific requirements based on the state you choose, so you're not left guessing whether a generic form covers what your state expects.",{"type":27,"format":22,"indent":23,"version":24,"children":735,"direction":8,"textStyle":22,"textFormat":23},[736,738,740,742,749],{"mode":30,"text":737,"type":32,"style":22,"detail":23,"format":23,"version":24},"If what you actually need is the authority to make medical ",{"mode":30,"text":739,"type":32,"style":22,"detail":23,"format":191,"version":24},"decisions",{"mode":30,"text":741,"type":32,"style":22,"detail":23,"format":23,"version":24}," on someone's behalf — not just access to their records — that's a different document. A ",{"id":743,"type":725,"fields":744,"format":22,"indent":23,"version":198,"children":746,"direction":8},"6aa836e2f0f716292954cb7f",{"url":745,"newTab":132,"linkType":728},"https:\u002F\u002Fwww.legalnature.com\u002Fcategories\u002Fhealthcare\u002Fmedical-power-of-attorney",[747],{"mode":30,"text":748,"type":32,"style":22,"detail":23,"format":23,"version":24},"medical power of attorney",{"mode":30,"text":750,"type":32,"style":22,"detail":23,"format":23,"version":24}," covers decision-making authority, while a HIPAA authorization only covers information sharing.",{"id":752,"heading":753,"background":399,"blockName":8,"items":754,"blockType":471,"visibility":805},"6aa8381a0979175c21a893e5","Frequently Asked Questions",[755,765,775,785,795],{"id":756,"question":757,"answer":758,"legacyHtml":8},"6aa838210979175c21a893e6","Is HIPAA the same in every state?",{"root":759},{"type":21,"format":22,"indent":23,"version":24,"children":760,"direction":8},[761],{"type":27,"format":22,"indent":23,"version":24,"children":762,"direction":8,"textStyle":22,"textFormat":23},[763],{"mode":30,"text":764,"type":32,"style":22,"detail":23,"format":23,"version":24},"No. HIPAA sets a federal minimum, but states can — and many do — pass stricter privacy laws. Where a state law offers more protection than HIPAA, the state law applies for that specific requirement.",{"id":766,"question":767,"answer":768,"legacyHtml":8},"6aa8382a0979175c21a893e7","Why do some states require separate authorization for mental health or HIV records?",{"root":769},{"type":21,"format":22,"indent":23,"version":24,"children":770,"direction":8},[771],{"type":27,"format":22,"indent":23,"version":24,"children":772,"direction":8,"textStyle":22,"textFormat":23},[773],{"mode":30,"text":774,"type":32,"style":22,"detail":23,"format":23,"version":24},"Lawmakers in many states consider these record categories unusually sensitive and have passed laws requiring more specific, separately worded consent before they can be released — on top of, not instead of, HIPAA's baseline requirements.",{"id":776,"question":777,"answer":778,"legacyHtml":8},"6aa838320979175c21a893e8","Does my HIPAA authorization need to be notarized or witnessed?",{"root":779},{"type":21,"format":22,"indent":23,"version":24,"children":780,"direction":8},[781],{"type":27,"format":22,"indent":23,"version":24,"children":782,"direction":8,"textStyle":22,"textFormat":23},[783],{"mode":30,"text":784,"type":32,"style":22,"detail":23,"format":23,"version":24},"Usually not. Most states don't require a witness or notary for a HIPAA authorization. Where a witness-type requirement exists, it tends to apply narrowly to certain mental health record disclosures rather than to authorizations generally, and at least one state (Illinois) has recently removed a requirement like this rather than adding one.",{"id":786,"question":787,"answer":788,"legacyHtml":8},"6aa8383d0979175c21a893e9","Can one HIPAA authorization form work in every state?",{"root":789},{"type":21,"format":22,"indent":23,"version":24,"children":790,"direction":8},[791],{"type":27,"format":22,"indent":23,"version":24,"children":792,"direction":8,"textStyle":22,"textFormat":23},[793],{"mode":30,"text":794,"type":32,"style":22,"detail":23,"format":23,"version":24},"A form that only meets the federal HIPAA baseline may not satisfy every state's additional requirements, particularly for mental health, HIV, substance use, or genetic records. A form designed to adjust to your specific state is more reliable.",{"id":796,"question":797,"answer":798,"legacyHtml":8},"6aa838450979175c21a893ea","What happens if a state law is stricter than HIPAA?",{"root":799},{"type":21,"format":22,"indent":23,"version":24,"children":800,"direction":8},[801],{"type":27,"format":22,"indent":23,"version":24,"children":802,"direction":8,"textStyle":22,"textFormat":23},[803],{"mode":30,"text":804,"type":32,"style":22,"detail":23,"format":23,"version":24},"The stricter state law controls for that requirement. Providers and patients in that state need to follow the state standard, not just the federal minimum, when it comes to that particular rule.",{"hideOnMobile":8,"hideOnDesktop":8},{"id":807,"content":808,"legacyHtml":8,"blockName":8,"blockType":527},"6aa8384f0979175c21a893eb",{"root":809},{"type":21,"format":22,"indent":23,"version":24,"children":810,"direction":8},[811,815],{"tag":61,"type":62,"format":22,"indent":23,"version":24,"children":812,"direction":8},[813],{"mode":30,"text":814,"type":32,"style":22,"detail":23,"format":23,"version":24},"Conclusion",{"type":27,"format":22,"indent":23,"version":24,"children":816,"direction":8,"textStyle":22,"textFormat":23},[817],{"mode":30,"text":818,"type":32,"style":22,"detail":23,"format":23,"version":24},"HIPAA gives every state the same starting point, but plenty of states have built on top of it — whether through a broad state privacy law, sensitive-category carve-outs for records like mental health and HIV status, or occasional signing formalities that are becoming less common, not more. The safest way to navigate this is to treat HIPAA as the floor, not the finish line, and to use a form built to reflect your state's specific requirements. LegalNature's HIPAA authorization form adjusts automatically based on the state you select, so you can create a document built for where you actually live.",{"id":820,"variant":584,"productName":12,"link":585,"cta":512,"message":821,"blockName":8,"blockType":587},"6aa8385e0979175c21a893ec","Create your state-compliant HIPAA authorization form in minutes.",[],[],{"name":8,"slug":8,"productVersionSlug":8},{"title":826,"description":827,"keyword":8,"ogImage":8},"HIPAA Authorization Requirements by State: What's Different","HIPAA sets a federal floor for medical privacy, but many states add stricter rules. See the three patterns and what they mean for your authorization.","2026-09-16T16:51:29.204Z","2026-09-14T18:09:51.329Z"]