45 CFR § 164.508
Uses and disclosures for which an authorization is required
When you need written authorization, and the separate rule for psychotherapy notes.
Read the full official text on eCFRResearched and written by Larry Osakwe · Last verified August 4, 2026
Checked against 45 CFR 164.508 via eCFR. Not a lawyer, not a certified compliance professional, and not affiliated with HHS.
What 164.508 actually says
164.508 covers the disclosures HIPAA does not already permit, which is where your authorization form comes from. Treatment, payment and health care operations generally do not need one. Almost everything else does.
Paragraph (a)(2) is why mental-health clinicians end up on this section. Psychotherapy notes require their own authorization, and it cannot be bundled into a general records release. The heightened protection depends on keeping those notes separate from the rest of the record; commingle them and they are ordinary PHI.
The paragraphs above are our plain-English reading. The blocks below are quoted verbatim from the regulation.
The text that matters
Authorization required: Psychotherapy notes. Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except: (i) To carry out the following treatment, payment, or health care operations: (A) Use by the originator of the psychotherapy notes for treatment;
Quoted from 45 CFR § 164.508. US federal regulations are not subject to copyright. Retrieved from eCFR and last checked August 4, 2026.
What this section means you must hold
The regulation states obligations. This is the paperwork those obligations translate into, which is the part the regulation itself leaves you to work out.
| The obligation | What you produce for it |
|---|---|
| Hold a compliant authorization form for disclosures outside treatment, payment and operations | A patient authorization form, plus the rights-request forms |
| If you keep psychotherapy notes, keep them separate and authorize them separately | A distinct authorization that is not combined with the general release, and a filing practice that keeps the notes apart |
Where practices get 164.508 wrong
Releasing process notes on a general records request. The separate-authorization rule only protects notes you actually kept separate, so the filing decision and the legal protection are the same decision. Practices discover this when a subpoena arrives.
Other sections people look up
45 CFR § 160.103
Definitions
45 CFR § 164.504(e)
Uses and disclosures: Organizational requirements
45 CFR § 164.520
Notice of privacy practices for protected health information
45 CFR § 164.308
Administrative safeguards
Educational summaries of federal regulations, not legal advice and not a determination about any specific practice. Where our reading and the regulation differ, the regulation controls; the eCFR link above is authoritative.
Get every document, done for you
Preview the binder free. Your binder is built to order and delivered within 30 days, with a full refund anytime before then.
See the binder and pricing