What HIPAA forms are required?


Editorial team Published on

The HIPAA Privacy Rule does not require a universal stack of paperwork, but healthcare providers and covered entities typically use three main documents to stay compliant:

1. Notice of Privacy Practices (NPP)

  • What it is: A written document that explains to patients how their Protected Health Information (PHI) may be used and disclosed by the provider, as well as what rights the patient has over their records.
  • When it is required: Providers must give the NPP to patients on their first service delivery date or initial office visit.
  • Action needed: Providers must make a good-faith effort to obtain a written acknowledgment of receipt from the patient (or document the reason if the patient refuses to sign).

2. HIPAA Authorization Form (Release Form)

  • What it is: A specific permission slip signed by a patient to allow the sharing of PHI for reasons outside of routine treatment, payment, or healthcare operations (TPO). Examples include sending records to an employer, a school, an attorney, or a family member, or using data for marketing or research.
  • When it is required: Whenever you plan to disclose PHI to a third party for non-routine purposes. (Note: A signed authorization is not required for routine treatment, coordinating care with a specialist, or billing an insurance company).
  • Required elements: To be legally valid, it must be written in plain language, include a description of the info to be shared, name the recipient/disclosing party, state the purpose, include an expiration date or event, and feature the patient's signature and date.

3. Business Associate Agreement (BAA)

  • What it is: A legally binding contract between a covered entity (like a doctor's office or health plan) and a third-party vendor (like an IT provider, cloud storage company, or billing service) that handles PHI on their behalf.
  • When it is required: Before sharing any PHI with an outside vendor or contractor who performs services involving that data.

Note: While many offices ask patients to sign a general Patient Consent Form for routine treatment or payment, federal HIPAA rules actually permit (but do not strictly mandate) a separate consent form for standard TPO—though many state laws or malpractice insurers still require them.