| name | hipaa-release-authorization |
| title | HIPAA Release Authorization |
| description | Drafts HIPAA-compliant PHI release authorizations for estate-planning workflows under 45 CFR §164.508. Use when drafting release forms, healthcare POA support documents, or record-access instruments. Triggers: HIPAA release, PHI authorization, healthcare agent access, advance directive support, medical record release. |
| author | CaseMark |
| author_url | https://github.com/CaseMark/skills/tree/main/skills/legal/hipaa-release-authorization |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | trusts-and-estates |
| language | en |
HIPAA Release Authorization
Generates a 45 CFR §164.508-compliant authorization permitting designated recipients to access a patient's protected health information (PHI) from covered entities, typically in an estate-planning context.
Quick Start
Gather before drafting:
- Jurisdiction — state governs signature and witness/notary formalities
- Patient identity — legal name, DOB, contact details
- Recipients — healthcare agent, successor agent(s), other representatives
- Disclosing entities — providers, hospitals, labs, pharmacies, health plans
- PHI scope — all records or limited categories
- Purpose and duration — expiration date, event, or condition
- Representative authority (if applicable) — POA, guardianship order, court appointment
- Related documents — healthcare proxy, advance directive for terminology alignment
Required Sections
Every authorization must include these elements per §164.508:
| Section | Key requirement |
|---|
| Patient identification | Name, DOB, contact |
| Authorization statement | Voluntary, specific written consent |
| Authorized recipients | Agent names, roles, relationships — no ambiguity |
| Disclosing entities | Covered entities / record holders |
| PHI scope | Explicit categories; do not mix "all records" with narrow limits |
| Purpose | Specific estate-planning healthcare decision-making purpose |
| Expiration | Explicit end date, event, or condition |
| Required notices | Re-disclosure warning, treatment non-conditioning, right to refuse |
| Revocation | How and where written revocation is sent; prospective-only effect |
| Execution block | Patient signature first, then representative if applicable |
| Witness/notary | Only where state law requires [VERIFY] |
Draft Workflow
- Confirm inputs against the Quick Start checklist; flag any gaps.
- Select PHI scope — if client wants full-record access, state it unambiguously; otherwise enumerate categories. Sensitive categories (substance use, mental health, genetic, HIV/AIDS) require explicit inclusion [VERIFY].
