Short answer: At minimum: a specific description of the information, who may disclose it, who may receive it, each purpose, an expiration date or event, and the individual’s signature and date, plus statements about the right to revoke and that treatment or benefits do not depend on signing.
The core elements of a valid authorization are:
- a description of the information to be used or disclosed, in a specific and meaningful way;
- who is authorized to make the disclosure;
- who may receive it;
- a description of each purpose (“at the request of the individual” is enough when the individual starts it);
- an expiration date or event;
- the individual’s signature and date (and, if a personal representative signs, a description of their authority).
The form must also tell the person they can revoke it in writing, whether treatment, payment, enrollment or eligibility depends on signing, and that information disclosed may be redisclosed by the recipient. A health plan generally may not make enrollment or benefits depend on signing one.
Do not confuse an authorization with a “HIPAA waiver.” Nobody can be required to waive HIPAA rights to enroll or get benefits.