--- title: "45 CFR 164.508 HIPAA: Uses and disclosures for which an authorization is required" canonical: "https://dposchool.com/hipaa/section/164.508" source: "https://www.ecfr.gov/current/title-45/section-164.508" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 164.508 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart E: Privacy of Individually Identifiable Health Information # 45 CFR 164.508 HIPAA: Uses and disclosures for which an authorization is required eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 45 CFR 164.508(a) **(a)** Standard: Authorizations for uses and disclosures—(1) Authorization required: General rule. Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization. #### 45 CFR 164.508(a)(2) **(2)** Authorization required: Psychotherapy notes. Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except: ##### 45 CFR 164.508(a)(2)(i) **(i)** To carry out the following treatment, payment, or health care operations: ###### 45 CFR 164.508(a)(2)(i)(A) **(A)** Use by the originator of the psychotherapy notes for treatment; ###### 45 CFR 164.508(a)(2)(i)(B) **(B)** Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or ###### 45 CFR 164.508(a)(2)(i)(C) **(C)** Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and ##### 45 CFR 164.508(a)(2)(ii) **(ii)** A use or disclosure that is required by § 164.502(a)(2)(ii) or permitted by § 164.512(a); § 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; § 164.512(g)(1); or § 164.512(j)(1)(i). #### 45 CFR 164.508(a)(3) **(3)** Authorization required: Marketing. (i) Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of: ###### 45 CFR 164.508(a)(3)(A) **(A)** A face-to-face communication made by a covered entity to an individual; or ###### 45 CFR 164.508(a)(3)(B) **(B)** A promotional gift of nominal value provided by the covered entity. ##### 45 CFR 164.508(a)(3)(ii) **(ii)** If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at § 164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved. #### 45 CFR 164.508(a)(4) **(4)** Authorization required: Sale of protected health information. (i) Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in § 164.501 of this subpart. (ii) Such authorization must state that the disclosure will result in remuneration to the covered entity. ### 45 CFR 164.508(b) **(b)** Implementation specifications: General requirements—(1) Valid authorizations. (i) A valid authorization is a document that meets the requirements in paragraphs (a)(3)(ii), (a)(4)(ii), (c)(1), and (c)(2) of this section, as applicable. ##### 45 CFR 164.508(b)(ii) **(ii)** A valid authorization may contain elements or information in addition to the elements required by this section, provided that such additional elements or information are not inconsistent with the elements required by this section. #### 45 CFR 164.508(b)(2) **(2)** Defective authorizations. An authorization is not valid, if the document submitted has any of the following defects: ##### 45 CFR 164.508(b)(2)(i) **(i)** The expiration date has passed or the expiration event is known by the covered entity to have occurred; ##### 45 CFR 164.508(b)(2)(ii) **(ii)** The authorization has not been filled out completely, with respect to an element described by paragraph (c) of this section, if applicable; ##### 45 CFR 164.508(b)(2)(iii) **(iii)** The authorization is known by the covered entity to have been revoked; ##### 45 CFR 164.508(b)(2)(iv) **(iv)** The authorization violates paragraph (b)(3) or (4) of this section, if applicable; ##### 45 CFR 164.508(b)(2)(v) **(v)** Any material information in the authorization is known by the covered entity to be false. #### 45 CFR 164.508(b)(3) **(3)** Compound authorizations. An authorization for use or disclosure of protected health information may not be combined with any other document to create a compound authorization, except as follows: ##### 45 CFR 164.508(b)(3)(i) **(i)** An authorization for the use or disclosure of protected health information for a research study may be combined with any other type of written permission for the same or another research study. This exception includes combining an authorization for the use or disclosure of protected health information for a research study with another authorization for the same research study, with an authorization for the creation or maintenance of a research database or repository, or with a consent to participate in research. Where a covered health care provider has conditioned the provision of research-related treatment on the provision of one of the authorizations, as permitted under paragraph (b)(4)(i) of this section, any compound authorization created under this paragraph must clearly differentiate between the conditioned and unconditioned components and provide the individual with an opportunity to opt in to the research activities described in the unconditioned authorization. ##### 45 CFR 164.508(b)(3)(ii) **(ii)** An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes. ##### 45 CFR 164.508(b)(3)(iii) **(iii)** An authorization under this section, other than an authorization for a use or disclosure of psychotherapy notes, may be combined with any other such authorization under this section, except when a covered entity has conditioned the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits under paragraph (b)(4) of this section on the provision of one of the authorizations. The prohibition in this paragraph on combining authorizations where one authorization conditions the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits under paragraph (b)(4) of this section does not apply to a compound authorization created in accordance with paragraph (b)(3)(i) of this section. #### 45 CFR 164.508(b)(4) **(4)** Prohibition on conditioning of authorizations. A covered entity may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except: ##### 45 CFR 164.508(b)(4)(i) **(i)** A covered health care provider may condition the provision of research-related treatment on provision of an authorization for the use or disclosure of protected health information for such research under this section; ##### 45 CFR 164.508(b)(4)(ii) **(ii)** A health plan may condition enrollment in the health plan or eligibility for benefits on provision of an authorization requested by the health plan prior to an individual's enrollment in the health plan, if: ###### 45 CFR 164.508(b)(4)(ii)(A) **(A)** The authorization sought is for the health plan's eligibility or enrollment determinations relating to the individual or for its underwriting or risk rating determinations; and ###### 45 CFR 164.508(b)(4)(ii)(B) **(B)** The authorization is not for a use or disclosure of psychotherapy notes under paragraph (a)(2) of this section; and ##### 45 CFR 164.508(b)(4)(iii) **(iii)** A covered entity may condition the provision of health care that is solely for the purpose of creating protected health information for disclosure to a third party on provision of an authorization for the disclosure of the protected health information to such third party. #### 45 CFR 164.508(b)(5) **(5)** Revocation of authorizations. An individual may revoke an authorization provided under this section at any time, provided that the revocation is in writing, except to the extent that: ##### 45 CFR 164.508(b)(5)(i) **(i)** The covered entity has taken action in reliance thereon; or ##### 45 CFR 164.508(b)(5)(ii) **(ii)** If the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself. #### 45 CFR 164.508(b)(6) **(6)** Documentation. A covered entity must document and retain any signed authorization under this section as required by § 164.530(j). ### 45 CFR 164.508(c) **(c)** Implementation specifications: Core elements and requirements—(1) Core elements. A valid authorization under this section must contain at least the following elements: ##### 45 CFR 164.508(c)(i) **(i)** A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. ##### 45 CFR 164.508(c)(ii) **(ii)** The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. ##### 45 CFR 164.508(c)(iii) **(iii)** The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. ##### 45 CFR 164.508(c)(iv) **(iv)** A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose. ##### 45 CFR 164.508(c)(v) **(v)** An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement “end of the research study,” “none,” or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. ##### 45 CFR 164.508(c)(vi) **(vi)** Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided. #### 45 CFR 164.508(c)(2) **(2)** Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following: ##### 45 CFR 164.508(c)(2)(i) **(i)** The individual's right to revoke the authorization in writing, and either: ###### 45 CFR 164.508(c)(2)(i)(A) **(A)** The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or ###### 45 CFR 164.508(c)(2)(i)(B) **(B)** To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by § 164.520, a reference to the covered entity's notice. ##### 45 CFR 164.508(c)(2)(ii) **(ii)** The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating either: ###### 45 CFR 164.508(c)(2)(ii)(A) **(A)** The covered entity may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization when the prohibition on conditioning of authorizations in paragraph (b)(4) of this section applies; or ###### 45 CFR 164.508(c)(2)(ii)(B) **(B)** The consequences to the individual of a refusal to sign the authorization when, in accordance with paragraph (b)(4) of this section, the covered entity can condition treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization. ##### 45 CFR 164.508(c)(2)(iii) **(iii)** The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this subpart. #### 45 CFR 164.508(c)(3) **(3)** Plain language requirement. The authorization must be written in plain language. #### 45 CFR 164.508(c)(4) **(4)** Copy to the individual. If a covered entity seeks an authorization from an individual for a use or disclosure of protected health information, the covered entity must provide the individual with a copy of the signed authorization. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[67 FR 53268, Aug. 14, 2002, as amended at 78 FR 5699, Jan. 25, 2013\] [45 CFR 164.508 on eCFR](https://www.ecfr.gov/current/title-45/section-164.508) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 164.508 Previous: [45 CFR 164.506 HIPAA: Uses and disclosures to carry out treatment, payment, or health care operations](https://dposchool.com/hipaa/section/164.506) Next: [45 CFR 164.509 HIPAA: Uses and disclosures for which an attestation is required](https://dposchool.com/hipaa/section/164.509) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents