A third party authorization form is a signed document that gives a specific person or organization permission to access your information or handle certain tasks on your behalf with a company, agency, or institution. You sign one because privacy laws stop the organization from talking to anyone but you until it has your written consent on file. The form names who can act for you, spells out what they can do, and sets a date when the permission ends.
Three parties are always involved. You are the first party. The organization holding your information or controlling your account, such as a hospital, bank, or government agency, is the second. The person or company you want to step in, whether that is a family member, accountant, attorney, or housing counselor, is the third. The form links them by documenting your consent, so the organization knows it can legally share information or take instructions from someone who is not you.
Federal privacy rules are what make these forms necessary in the first place. HIPAA governs health information, Section 6103 of the Internal Revenue Code protects tax records, and parallel rules cover financial accounts. Without a signed authorization, the organization will refuse to speak with anyone else no matter how urgent your situation.
Where You’ll Be Asked To Sign One
The form looks different in every setting, but the function is the same.
Healthcare
HIPAA requires a valid written authorization before a provider can share your protected health information with anyone you name, whether that is a relative coordinating your care or a lawyer handling an injury claim. The authorization has to describe the specific information being released, name the recipient, state the purpose, and include an expiration date or event. It also has to tell you that you can revoke it and warn that the recipient may not be bound by HIPAA once the information is in their hands.1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
The IRS
The IRS offers tiered access. The Third Party Designee checkbox on your tax return lets one person discuss the processing of that return, and it expires one year from the return’s due date.2Internal Revenue Service. Topic No. 312, Disclosure Authorizations Form 8821 lets any individual, firm, or organization you name inspect or receive your confidential tax information for the tax types and periods you specify.3Internal Revenue Service. About Form 8821, Tax Information Authorization If you need someone to actually represent you, argue your position, or sign documents, that requires Form 2848, which is a power of attorney rather than an information authorization.4Internal Revenue Service. Power of Attorney and Other Authorizations
Mortgage Servicers and Banks
Your mortgage servicer will not discuss your loan with a housing counselor or attorney without a third-party authorization on file.5Consumer Financial Protection Bureau. Allowing a Third Party to Work With Your Mortgage Company The CFPB’s model form for mortgage servicers expires one year from the date you sign it, and the servicer can still contact you directly even after you authorize someone else.6Consumer Financial Protection Bureau. Borrower Authorization of Third Party Banks, credit unions, and investment firms use their own versions, each with its own rules on what the form must contain and how to submit it.
Social Security
To let someone help with a Social Security claim, you file Form SSA-1696 appointing a representative. The appointment has to be in writing and submitted to your local Social Security office.7Social Security Administration. Form SSA-1696 – Appointment of Representative
What a Valid Form Has To Contain
Formats vary, but the elements are consistent. HIPAA’s requirements are the most detailed and work as a general template for what any strong authorization should include:1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
- Your full name and contact information, the name of the organization holding your data, and the name and contact details of the person you are authorizing.
- A specific description of what information can be shared or what actions the third party can take. Phrases like “any and all records” can expose far more than you intend.
- The purpose of the disclosure. In healthcare, “at my request” is acceptable when you initiate the authorization yourself.
- An expiration date or triggering event. Some forms use a calendar date, others tie the end to something like the close of a legal case or completion of treatment.
- Your signature and the date. If a legal representative is signing for you, the form should describe their authority to do so.
Most of these forms do not need to be notarized. A standard signature is enough in the vast majority of settings, including HIPAA authorizations, IRS forms, and mortgage servicer forms. Some organizations ask for notarization on higher-stakes transactions, but that is the exception.
How It Differs From a Power of Attorney
These two documents get confused often, and the difference matters. A third-party authorization is narrow: it lets someone view your information or carry out specific, limited tasks with one organization. A power of attorney is broader, granting authority to make decisions and act on your behalf, often across multiple institutions and accounts.
The IRS pairing shows the gap clearly. Form 8821 lets your designee inspect and receive tax information, but they cannot represent you, negotiate, or sign anything. Form 2848 lets an authorized representative do all of that.4Internal Revenue Service. Power of Attorney and Other Authorizations At a bank, a third-party authorization might let someone call and ask about a balance; a financial power of attorney could let the same person withdraw funds or invest your money. If the person only needs information or help with a specific task, the authorization form is the appropriate and safer choice.
Keeping the Authorization Narrow
The most common mistake is signing a form that is broader than it needs to be. An authorization that covers “any and all” records or has no expiration date can hand the third party access well beyond what you had in mind.
Insurance companies are an example worth watching for. After an accident, the other driver’s insurer may ask you to sign a medical authorization that reaches every provider you have ever seen rather than only those connected to your injury. They may also request an employment authorization that opens your entire personnel file at current and past employers. Signing without narrowing the scope can give the insurer material to minimize or deny your claim.
A few habits make a real difference:
- Cross out or modify language that says “any and all.” Specify the records, accounts, or information the third party can see.
- Set a specific expiration date or event. If the form has no expiration field, write one in.
- Read the whole form before signing. Watch for a “full release” buried in what looks like a routine authorization, because signing a release can permanently end your right to pursue a claim.
- Keep a copy of everything you sign. You will need it to revoke the authorization or to dispute what was disclosed.
How To Revoke an Authorization
You can revoke a third-party authorization after you sign it, but revocation does not undo disclosures or actions already taken while it was in effect. The procedure depends on the organization.
For a HIPAA authorization, submit a written revocation to the healthcare provider or other covered entity. It takes effect when the organization receives it and does not apply to information already disclosed in reliance on the original.8eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
For a Form 8821, write “REVOKE” across the top of the original, add your current signature and date beneath the original signature, and send it to the IRS. If you no longer have a copy of the original, send a written notification that names the designee, lists the tax matters and periods, and includes your signature and date. Filing a new Form 8821 automatically revokes all prior authorizations on file unless you tell the IRS to keep an earlier one in place.9Internal Revenue Service. Instructions for Form 8821, Tax Information Authorization
For a mortgage servicer, the CFPB’s model form lets you cancel by writing to the servicer or by submitting a new authorization naming a different third party.6Consumer Financial Protection Bureau. Borrower Authorization of Third Party For banks, utilities, and other organizations, ask about their revocation process directly. Put the revocation in writing even if a phone call is said to be enough, so you have a record of when the authorization ended.
Filling It Out Without Errors
Most problems come from rushing. Make sure every name matches official identification exactly, because a mismatch between “Robert” on the form and “Bob” on an ID is enough to get it rejected. Use the third party’s full legal name as well.
Be as specific as the form allows about scope. Instead of authorizing “all financial records,” list the account numbers, the kinds of information that can be shared, and the actions the third party is allowed to take. If the pre-printed language is broader than you want, cross out what does not apply, initial the changes, and keep a copy showing the modifications.
Submission varies. Some organizations accept uploads through a secure portal; others require a mailed original, in-person delivery, or fax. The CFPB’s model mortgage form, for example, should reach the servicer no later than 90 days after you sign it.6Consumer Financial Protection Bureau. Borrower Authorization of Third Party Processing can take anywhere from the same day to several business days. Follow up if you do not get confirmation within a reasonable window, and keep a signed copy for your own records.