Authorization To Share Personal Health Information Aspi

Use a Authorization To Share Personal Health Information ASPI template to make your document workflow more streamlined.

What this health authorization does

Authorization To Share Personal Health Information Aspi is a patient permission record identifying which personal health information may be disclosed, to whom, for what purpose, and for how long. The patient or legally authorized representative reviews those limits and signs the document. A provider or other covered entity then uses the completed authorization to document consent before releasing the specified information. HIPAA’s authorization rules require meaningful scope and purpose details; signNow provides the electronic workflow, signature evidence, and audit trail, but the organization remains responsible for accurate content and lawful disclosure.

Healthcare providers

Healthcare providers use this authorization to capture a patient’s permission before disclosing specified records to a named recipient. Staff should verify the information scope, purpose, expiration, representative authority, and required HIPAA language before sending the document for signature.

Patients and representatives

Patients and authorized representatives review the disclosure purpose, recipient, information categories, expiration, and revocation instructions before signing. They should receive a reproducible copy and understand that the authorization governs only the information and recipient identified in the document.

How this health authorization works

The authorization moves from document preparation through consent, signing, and controlled retention for the named health information recipient.

Upload form: Upload the authorization document to signNow.
Prepare fields: Review detected fields and add missing consent fields.
Assign signers: Assign the patient and recipient signing roles.
Store record: Complete signatures and retain the audit trail.

Complete this authorization in signNow

Prepare the authorization’s disclosure scope and signer details before sending it through signNow for an auditable electronic signature.

Upload form:
Upload the completed authorization template.
Review fields:
Check patient and recipient fields.
Add fields:
Add signatures, dates, and consent fields.
Send document:
Send through a secure invitation.
Retain evidence:
Store the signed PDF and audit trail.

Privacy and disclosure pitfalls

Listing an overly broad recipient can disclose personal health information beyond the patient’s intended purpose.
Leaving expiration or purpose fields incomplete weakens the record of the patient’s informed consent.
Sending the signed authorization to an unintended email address exposes protected information and consent details.
Allowing unrestricted template access can let unauthorized staff alter recipient, purpose, or disclosure fields.

be ready to get more

Get legally-binding signatures now!

Start free trial

Request a call

Best ROI. Our customers achieve an average 7x ROI within the first six months.
Scales with your use cases. From SMBs to mid-market, airSlate SignNow delivers results for businesses of all sizes.
Intuitive UI and API. Sign and send documents from your apps in minutes.

Setting	Recommendation
Authentication method	Email invitation with SMS verification
Signature type	Electronic signature with patient intent
Audit trail	Export completed audit trail
Document retention	6 years under HIPAA 45 CFR 164.530(j)
Encryption and provisioning	AES-256 with role-based user access

Platform requirements for signing

Use Chrome, Firefox, Safari, or Edge on Windows or macOS. signNow mobile apps support signing on iOS and Android, while encrypted connections use TLS 1.2 or TLS 1.3.

Browser support Chrome, Firefox, Safari, and Edge
Operating systems Windows, macOS, iOS, and Android
Secure connection TLS 1.2 or 1.3 required

Healthcare organizations should use managed devices, role-based accounts, and controlled access to completed authorizations. Enterprise deployments may connect signNow with identity, storage, or records systems through available integrations and API capabilities. Confirm device management, session controls, and retention policies before exposing PHI.

Connect authorization workflows to systems

Connect signNow with healthcare records, cloud storage, and business systems to route completed authorizations without rekeying recipient or document details.

Field preparation

Upload the authorization and review signNow’s detected fields, then add missing patient, recipient, purpose, expiration, signature, and date fields before sending.

Signer routing

Assign the patient or authorized representative as signer and route the completed authorization to the named healthcare recipient or internal records team.

Audit trail

Capture signer actions, timestamps, and document history in an audit trail that can accompany the signed authorization during compliance review.

Signer authentication

Use SMS verification or stronger authentication options when the organization’s risk assessment requires more than an email invitation.

Secure retention

Store completed authorizations with controlled access and encryption while applying the retention period required for the underlying HIPAA record.

System integration

Connect signNow with storage and healthcare operations systems to reduce manual copying of recipient and document information after signing.

Security and health data protection

HIPAA protection:

HIPAA compliance requires BAA

Transit encryption:

TLS 1.2/1.3 protects transit

Stored encryption:

AES-256 protects stored records

Security certification:

SOC 2 Type II certified

Information security:

ISO 27001 certified controls

Electronic signatures:

ESIGN and UETA compliant

Authorization retention schedule

Retain the authorization according to the rule governing the underlying disclosure record, and apply longer state requirements when they control.

6 years from creation or last effective date

HIPAA 45 CFR 164.530(j) governs covered-entity documentation retention.

3 years from tax filing

IRC §6501(a) applies only when the authorization accompanies federal tax records.

3 years after hire or one year after termination

8 CFR §274a.2(b)(2)(i)(A) applies only when linked to Form I-9 records.

3 years for payroll records

29 CFR §516.5 applies only when retained with FLSA payroll records.

Longer period under state law

State law may require longer retention for healthcare records or authorizations.

Record-keeping practices for authorizations

Preserve the patient’s authorization, signature evidence, access history, and disclosure controls as one reviewable record.

Apply the governing retention period

Retain the signed authorization and audit trail together for six years from creation or the last effective date when HIPAA 45 CFR 164.530(j) governs. Apply a longer state or clinical-record period when required, and document the controlling policy.

Export the audit trail

Export the completed audit trail after signing and preserve it with the PDF. The record should show signer actions, timestamps, authentication events, and document history supporting the patient’s consent and the disclosed information scope.

Limit access to completed records

Restrict access to authorized workforce members using role-based permissions. Store the authorization in encrypted systems, monitor downloads, and avoid sending completed records through unsecured personal email or unapproved messaging applications.

Validate scope before disclosure

Review recipient, purpose, information categories, expiration, and representative authority before release. A signature alone does not correct an authorization that omits required scope or permits disclosure beyond the patient’s stated purpose.

Risks of incomplete authorization

Unauthorized disclosure

Disclosure beyond authorization scope

Consent gap

Missing signer consent

Recipient ambiguity

Unclear recipient identity

Evidence weakness

Incomplete authorization record

Authorization form troubleshooting

Resolve field, signer, plan, and retention questions before releasing this patient authorization for disclosure.

Business includes legally binding eSignatures, templates, and audit trails for this authorization. Business Premium adds bulk send and kiosk mode, while Enterprise adds advanced signer authentication. A HIPAA workflow requires signNow’s HIPAA-compliant configuration and a business associate agreement where signNow processes PHI.

The authorization can be signed electronically when the patient demonstrates intent, consents to electronic records, can access the record, and the completed record remains reproducible. ESIGN and applicable state law, including UETA or New York ESRA, govern electronic execution.

Use signNow’s field editor to identify patient, recipient, purpose, information scope, expiration, signature, and date fields. Auto-detection can identify fillable areas, but the sender must verify every field against the authorization’s required content before sending.

A signer can often complete the document without a signNow account through the secure invitation. Add SMS authentication when identity assurance is needed, and confirm the patient’s electronic-record access and consent before signing.

Business provides audit trails; Business Premium adds bulk send and kiosk mode; Enterprise adds advanced signer authentication. Subscription plans include 100 signature invites per user annually, with plan-specific overage fees, so confirm volume before deployment.

HIPAA requires covered entities to retain required policies, procedures, and related documentation for six years from creation or the last effective date under 45 CFR 164.530(j). Apply longer state or clinical-record rules when they govern the underlying authorization.

28M+Documents signed

13+Years in business

4.6/5Average G2 rating

BE READY TO GET MORE

Get this form now!

If you believe that this page should be taken down, please follow our DMCA take-down process.