Do you have to sign the HIPAA form?

The form most people mean: the privacy notice acknowledgment

Every health care provider and health plan covered by HIPAA must give you a Notice of Privacy Practices: a document explaining how they may use and share your health information and what your privacy rights are. You'll usually get it at your first visit, and you can ask for a copy at any time.

HHS explains that the law requires your doctor, hospital or other provider to ask you to confirm in writing that you received the notice — that's the form you're being asked to sign. The federal rule calls it a good-faith effort to obtain a written acknowledgment, except in an emergency, where the notice comes as soon as practical afterwards.

You don't have to sign it — and here's what happens if you don't

In HHS's own words, the law does not require you to sign the acknowledgment of receipt of the notice. If you refuse, the provider has to keep a record that you refused. Refusing doesn't stop the provider from using or sharing your information in the ways HIPAA already allows, such as for your treatment and billing.

So declining gains you little in practice, and signing costs you nothing: HHS says signing does not mean you've agreed to any special uses or disclosures of your records. The acknowledgment is a receipt, not a permission slip. If a practice tells you it can't see you unless you sign, ask for the privacy contact named in its notice.

Do you have to sign it every year?

HIPAA's rules don't ask for a yearly signature. The acknowledgment requirement is tied to the notice a provider gives at your first service. Some practices ask again each year or whenever they revise their notice, as their own routine; that's harmless, and you can always ask for the current version. A practice with a website must post its notice there, and a copy has to be available at the office.

If you agreed to get the notice by email, you can still ask for a paper copy.

What's worth reading in the notice

HHS lists what the notice must describe: how the Privacy Rule lets the provider use and disclose your information; that your written permission is needed before your records are shared for any other reason; the provider's duties to protect your privacy; your rights, including the right to complain to the provider and to HHS; and whom to contact with questions or complaints. Skim it for the contact details and for how to request copies of your records — those are the parts you're most likely to need later.

The other HIPAA form: an authorization

An authorization is a real permission. HIPAA requires one for uses and disclosures it doesn't otherwise allow — for example sending your records to a lawyer, an employer or a life insurer. HHS notes that authorizations generally aren't needed for treatment, payment or the practice's own operations.

A valid authorization has to say what will be shared, by whom, with whom, for what purpose and until when, and carry your signature and the date. It must also tell you that you can revoke it in writing and whether anything depends on your signing. Providers generally can't make your treatment depend on signing one, with narrow exceptions such as research-related treatment. Our records release guide walks through filling one in.

HIPAA forms for family members

Many practices ask whom they may talk to about your care. HHS explains that providers may share information with family or friends who are involved in your care or pay for it, unless you object — so this form mainly records your wishes. List the people you want included, and say so if there's anyone you don't.

A family member who wants copies of your records needs either your signed authorization or to be your personal representative. HHS says someone who can make health care decisions for you under a health care power of attorney is your personal representative, and for a minor child it's usually a parent or legal guardian. Once a child becomes a legal adult — at 18 in most states, though Alabama and Nebraska set 19 and Mississippi 21 — parents are no longer automatically in that role, which is why some families have the young adult sign an authorization or a health care power of attorney before college.

Signing a HIPAA form electronically

HHS allows authorizations to be signed electronically as long as the electronic signature is valid under applicable law, and it treats a faxed or electronically transmitted copy of a signed authorization as valid. If your practice emailed you the acknowledgment or an authorization as a PDF, you can open it below, sign and date it on your device, and return it through the practice's portal. We never receive the file.

Sources

• HHS: Notice of Privacy Practices
• 45 CFR 164.520: Notice of privacy practices for protected health information
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• HHS FAQ: HIPAA authorizations and electronic signatures
• HHS FAQ: Is a copy of a signed authorization valid?
• HHS: Family members and friends
• HHS: Personal representatives
• Cornell Law School (LII): Age of majority by state