A third-party authorization form is a written document that lets a named person or organization access your private records, or communicate with an institution about your account, without giving them power to make decisions for you. Federal agencies use these forms to satisfy the Privacy Act of 1974, which bars disclosure of your records without prior written consent. The form sets who can see what, for how long, and for what purpose.
Which Form You Actually Need
There is no single universal authorization. Tax matters, healthcare, and mortgage servicing each have their own forms, and submitting the wrong one wastes weeks.
Tax Authorizations
The IRS offers three levels of third-party access, and the differences are significant.
The simplest is the third-party designee checkbox on your tax return, such as the one on Form 1040. Checking it lets the IRS discuss the processing of that specific return with the person you name, including refund status. That authority expires one year from the return’s due date, regardless of extensions. Gift tax returns (Form 709) are the exception, expiring three years from the filing date.1Internal Revenue Service. Topic No. 312, Disclosure Authorizations
For broader access, Form 8821 (Tax Information Authorization) lets you authorize any individual or organization to inspect and receive your confidential tax information for specific tax types and periods.2Internal Revenue Service. About Form 8821, Tax Information Authorization The designee does not need to be a licensed tax professional. But Form 8821 is viewing access only. Your designee cannot represent you before the IRS, negotiate on your behalf, or sign anything for you.
Form 2848 (Power of Attorney and Declaration of Representative) authorizes an eligible individual to represent you before the IRS. That includes receiving your confidential information, signing returns, and acting on your behalf in hearings or disputes.3Internal Revenue Service. About Form 2848, Power of Attorney and Declaration of Representative Unlike Form 8821, the person named on Form 2848 must be someone eligible to practice before the IRS, such as an attorney, CPA, or enrolled agent.
Healthcare Authorizations
Healthcare authorizations are governed by the HIPAA Privacy Rule. Federal regulations require them to include a description of the health information being shared, the names of who can share and who can receive it, the purpose of the disclosure, an expiration date or expiration event, and your signature with the date.4eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required The expiration requirement is strict. An authorization might say “one year from the date signed” or “upon termination of enrollment in the health plan,” but it cannot be open-ended.5U.S. Department of Health and Human Services. Must an Authorization Include an Expiration Date
You control the scope. You can authorize release of your full medical record or limit disclosure to a single visit. Providers will reject forms that use vague phrases like “all records” without identifying the specific information or provider involved.
Financial and Mortgage Authorizations
Banks and mortgage servicers have their own forms. The Consumer Financial Protection Bureau published a model third-party authorization form for mortgage servicing with fields for your loan account number and tax identification number.6Consumer Financial Protection Bureau. Model Third-Party Authorization Form These forms let a housing counselor, attorney, or family member communicate with your servicer about your account. A servicer may still decline a form that does not meet its requirements, and federal rules require written notice if that happens.
What Goes on the Form
Most authorizations ask for the same core information. Errors here are the leading cause of rejections.
- Your full legal name, current mailing address, date of birth, and taxpayer identification number such as a Social Security Number or Employer Identification Number.
- The third party’s full name and address, and for tax forms, their CAF number or PTIN if they are a tax professional.
- Scope of access: specific account numbers, tax years, types of tax, or categories of records. “All accounts” without a list will typically be sent back.
- Purpose. HIPAA authorizations require a stated purpose. Tax forms require you to identify the specific tax matters and periods.
- Expiration. Either a date or a triggering event. HIPAA requires one; tax authorizations default to IRS-set durations.
- Signature and date. A handwritten or valid electronic signature, and the date you signed.
Cross-reference every number against your most recent statements or tax documents before submitting. A transposed digit in a Social Security Number or account number will delay processing, and some institutions treat a mismatch as grounds for outright rejection.
Healthcare forms face an added layer of scrutiny: if the form does not meet HIPAA’s core element requirements, the provider cannot legally honor it.4eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
How It Differs From a Power of Attorney
People confuse these constantly, and the distinction has real consequences. A standard third-party authorization gives someone permission to view your records or receive information. It does not let them make decisions, sign documents, negotiate settlements, or take legal action for you. It is a window into the account, not the keys.
A power of attorney goes further. It authorizes your agent to act on your behalf, which can include signing contracts, managing bank accounts, making healthcare decisions, or representing you in legal proceedings. Because the stakes are higher, powers of attorney come with stricter execution requirements. Many states require notarization, witnesses, or specific statutory language. Some states have adopted versions of the Uniform Power of Attorney Act, which restricts agents from performing certain sensitive actions, like changing estate plans, unless the document explicitly grants that authority.
The IRS forms mirror the distinction precisely. Form 8821 lets your designee see your tax information. Form 2848 lets your representative act on your behalf before the IRS. Filing the wrong one means either granting more authority than you intended or leaving your representative unable to do what you need.1Internal Revenue Service. Topic No. 312, Disclosure Authorizations
Submitting the Form
Follow the delivery instructions printed on the form itself. Sending it to the wrong office can mean it sits unprocessed for weeks.
Many institutions now accept authorizations through secure online portals. The IRS offers a digital option through its Tax Pro Account, and authorizations submitted that way usually record immediately to the Centralized Authorization File.7Internal Revenue Service. Instructions for Form 8821 Paper submissions take longer because they require manual data entry. If you mail a form, use certified mail with return receipt so you have proof of delivery. Some agencies still accept fax; always include a cover sheet with your name, account identifiers, and page count.
Mortgage servicers operate on federal response timelines. A servicer must acknowledge receipt of an information request within five business days. It then has 10 business days to identify the loan owner if that is what you asked, or 30 business days for other information requests, with a possible 15-business-day extension if the servicer notifies you and explains why.8Consumer Financial Protection Bureau. Regulation X – 1024.36 Requests for Information
How Long an Authorization Lasts
Authorizations do not run forever, and the rules depend on the type.
The IRS third-party designee checkbox expires one year from the return’s due date. Form 8821 authorizations stay on the Centralized Authorization File until you revoke them or file a new Form 8821 that replaces the prior one. The IRS also recognizes oral tax information authorizations, which remain valid until revoked or withdrawn.9Internal Revenue Service. Other Third-Party Authorization
HIPAA authorizations must contain an expiration date or event by law, and a provider cannot accept one that lacks it.5U.S. Department of Health and Human Services. Must an Authorization Include an Expiration Date Financial institution forms vary, but many include a default duration, often 12 months, in the printed terms. Read the fine print before signing so you know when access lapses.
Authorization of any kind ends when the person who signed it dies. Authority over the person’s affairs then passes to the executor of the estate or a court-appointed personal representative.
Revoking an Authorization
You can revoke a third-party authorization at any time. The process varies by institution, but the core requirement is the same: a clear written statement of revocation delivered to the right office.
IRS Revocations
For Form 8821, you have two options. Write “REVOKE” across the top of the original authorization, add a current signature and date below the original signature, and submit it. If you do not have the original, send a written notice naming the designee, listing the tax matters and periods affected, signed and dated. To revoke all access rather than specific periods, write “revoke all years/periods” instead of listing each one.7Internal Revenue Service. Instructions for Form 8821
There is also an automatic revocation. When you file a new Form 8821 without checking the box on line 5, the IRS automatically revokes all prior tax information authorizations on file. To keep an existing authorization in place while adding a new one, attach a copy of the one you want to retain and check that box.7Internal Revenue Service. Instructions for Form 8821
Healthcare Revocations
The HIPAA Privacy Rule requires every authorization form to state your right to revoke and describe the revocation process. That process must appear on the authorization itself or in the provider’s Notice of Privacy Practices, which the authorization can reference.10U.S. Department of Health and Human Services. Can an Individual Revoke His or Her Authorization In practice, this usually means a signed and dated written notice to the provider’s privacy officer.
Financial Institution Revocations
Banks and mortgage servicers generally accept a signed letter stating your full name, account number, and a clear instruction withdrawing all permissions previously granted to the named third party. Send the letter to the same department that processed the original authorization so the records get updated.
One limit applies across the board. Revoking an authorization stops future disclosures, but it does not undo information already shared while the authorization was active. If your designee received tax transcripts or medical records before revocation, those disclosures remain valid.
Electronic Signatures
Federal law treats electronic signatures as legally equivalent to handwritten ones. Under the E-SIGN Act, a signature or record cannot be denied legal effect solely because it is in electronic form.11Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity The electronic record still has to be capable of being retained and accurately reproduced by all parties. A signature scrawled on a phone screen and texted to a bank may not clear that bar.
Before an institution can deliver records to you electronically rather than on paper, it must inform you of your right to receive paper copies, your right to withdraw consent to electronic delivery, and the hardware and software needed to access the records. You must affirmatively consent, and that consent must reasonably demonstrate you can access electronic documents in the format the institution uses. Not every institution accepts electronic signatures on authorization forms, so check with the specific agency or company before assuming a digital submission will be honored.