Authorization to Release Information: Rules and Penalties

An authorization to release information is a signed document that lets a named person or organization share specific private records about you with a specific recipient, for a stated purpose, until a stated date. To hold up under federal privacy laws such as HIPAA, FERPA, and the Fair Credit Reporting Act, the form has to name each of those pieces and carry your dated signature. Miss an element and the authorization is treated the same as no authorization at all.

What a Valid Authorization Must Contain

HIPAA sets the most detailed federal template, and most other consent forms track the same structure. Under 45 CFR 164.508, a valid authorization must include every one of the following:¹

The name or specific identification of the person or class of persons authorized to release the information.
The name or specific identification of the person or class of persons who may receive it.
A description of the information to be disclosed, identified in a specific and meaningful way.
A description of each purpose of the disclosure. If you initiated the authorization yourself and prefer not to state a reason, “at the request of the individual” is sufficient.
An expiration date or an expiration event tied to you or to the purpose.
Your signature and the date, or a personal representative’s signature with a description of their authority to act for you.

For substance use disorder records governed by 42 CFR Part 2, the consent form has to carry those same elements and also spell out your right to revoke and how to do it.² FERPA takes a lighter approach for student records: the written consent must be signed, dated, and identify the records, the purpose, and the recipient.³

Being Specific Enough

The “specific and meaningful” requirement is where authorizations most often fall apart. A form that says “all medical records” with no further limit is a red flag. A better description names the type of information (for example, laboratory results and radiology reports), the time period it covers, and the provider or facility that holds it. Purpose statements need the same discipline. “For legal purposes” says almost nothing; “to evaluate a long-term disability claim filed with [insurer]” confines the recipient to that use and makes the form harder to challenge later.

When Your Authorization Is Treated as Invalid

Under HIPAA, a covered entity must treat an authorization as invalid if any of the following is true:¹

Any required element is missing or incomplete.
The expiration date has passed or the expiration event has already occurred.
The entity knows you have revoked it.
The entity knows material information on the form is false.
It was combined with another document in violation of the compound authorization rules.

That last item catches organizations off guard. HIPAA generally forbids burying an authorization inside a larger form such as a treatment consent or an insurance application. The main exceptions are research authorizations, which may be combined with other research permissions, and psychotherapy note authorizations, which may only be combined with other psychotherapy note authorizations.¹

When a Specific Form Is Required

Several agencies won’t accept a generic release. If you need someone to see your federal tax records, you use IRS Form 8821, Tax Information Authorization. Form 8821 lets a designated person inspect or receive your confidential tax data but does not let them represent you or take action for you; that requires Form 2848, Power of Attorney. Form 8821 has to reach the IRS within 120 days of your signature when it’s used for something like income verification for a lender. There is no 120-day limit when the form is used to help resolve a matter directly with the IRS. The IRS also won’t record future tax periods on its system beyond three years past the year the form is received.⁴

The Social Security Administration uses its own consent form, SSA-3288. Medical record requests on that form are valid for 90 days; non-medical requests are valid for one year.⁵

Employment background checks have their own rules. Before an employer can pull a consumer report on you, the Fair Credit Reporting Act requires a clear written disclosure that a report may be obtained and your written authorization to proceed. The disclosure has to stand alone. It cannot be folded into the job application or combined with other language, and courts have found employers noncompliant for adding extraneous text to it.⁶

Electronic Signatures

The federal E-SIGN Act gives an electronic signature the same legal effect as a handwritten one for transactions in interstate commerce, and a record cannot be denied legal effect solely because it exists in electronic form.⁷ FERPA specifically accepts electronic signatures on consent forms when the system identifies and authenticates the signer.³

The IRS is a notable exception. If you send Form 8821 by mail or fax, the signature has to be handwritten; digital, electronic, and typed-font signatures are not accepted for those methods. Electronic signatures on Form 8821 are only valid when the form is submitted through the IRS’s own online system.⁴

When No Authorization Is Needed

Not every release requires your signature, and knowing where the gaps are is part of protecting yourself. Under HIPAA, a covered entity may use or disclose your protected health information without authorization for treatment, payment, and healthcare operations. Your primary care doctor can send records to a specialist for a referral, your insurer can process a claim, and a hospital can run internal quality reviews, all without asking you to sign anything. Further exceptions exist for disclosures required by law, public health activities, judicial proceedings, and certain law enforcement purposes.⁸

Schools can release what FERPA calls “directory information” without consent. That covers items like a student’s name, address, phone number, dates of attendance, and degree earned, as long as the school has publicly identified what it treats as directory information and given students a chance to opt out.⁹

Financial privacy under the Gramm-Leach-Bliley Act works on the opposite default. Rather than requiring your affirmative consent to share, GLBA requires financial institutions to notify you of their sharing practices and give you the right to opt out of disclosures to nonaffiliated third parties.¹⁰ If you don’t opt out, certain sharing happens without any signed form. The default is disclosure, not privacy.

How to Revoke an Authorization

You can revoke a HIPAA authorization at any time by submitting a written revocation to the covered entity that holds the information.¹ The rule requires you to send it to the covered entity; it doesn’t require you to also notify the recipient, but doing so is a reasonable precaution if you want to close both ends.

Revocation is not retroactive. If the covered entity already released your information before your written revocation arrived, that earlier release stays lawful. If the entity took action in reliance on the authorization before you pulled it, the revocation doesn’t undo that action. The same principle governs Part 2 substance use disorder consents: any revocation only affects disclosures not yet made.²

Penalties for Unauthorized Disclosure

What happens when someone releases your information without a valid authorization depends on which law was broken and whether the disclosure was accidental or deliberate.

HIPAA Civil Penalties

The Department of Health and Human Services enforces HIPAA through a tiered civil penalty structure that scales with culpability. As of 2026, the per-violation ranges are:¹¹

Didn’t know and couldn’t have known: $145 to $73,011 per violation.
Reasonable cause, not willful neglect: $1,461 to $73,011 per violation.
Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation.
Willful neglect, not corrected within 30 days: $73,011 to $2,190,294 per violation.

All tiers are subject to a calendar-year cap of $2,190,294 for all violations of the same provision. One breach that touches many patients can generate very large aggregate penalties because each affected record may count as its own violation.

HIPAA Criminal Penalties

Deliberate violations can bring criminal prosecution under 42 U.S.C. § 1320d-6, with penalties that climb based on intent:¹²

Knowing violation: up to $50,000 in fines and one year in prison.
Obtained under false pretenses: up to $100,000 in fines and five years in prison.
Intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm: up to $250,000 in fines and ten years in prison.

FCRA Background Check Violations

An employer that pulls a consumer report without the required standalone disclosure and your written authorization is exposed to liability under the FCRA. You can pursue actual damages, and for willful violations, statutory damages and attorney’s fees.⁶

Before You Sign

Read every field. Confirm the description of information matches what you actually want released and nothing more. Check the expiration date or event; a form that says “no expiration” is not valid under HIPAA outside limited research contexts. Make sure the recipient is named specifically enough that the holder can verify who’s requesting the records. Keep a copy, note the expiration date, and if you no longer need the access to continue, send a written revocation to the entity holding the information rather than letting it sit.

1
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
2
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
3
eCFR. 34 CFR 99.30 – Under What Conditions Is Prior Consent Required to Disclose Information
4
Internal Revenue Service. Instructions for Form 8821 – Tax Information Authorization
5
Social Security Administration. Consent for Release of Information – Form SSA-3288
6
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
7
Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity
8
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules
9
Protecting Student Privacy. May an Educational Agency or Institution Disclose Directory Information Without Prior Consent
10
Federal Trade Commission. Gramm-Leach-Bliley Act
11
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
12
GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information