Which items must be included for an authorization to be valid under HIPAA privacy rules? (variant wording)

• A. A description of each purpose of the requested use or disclosure.
• B. A description of the information to be used or disclosed.
• C. An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure.
• D. All of the above.

Answer: (D)

The main idea here is that a HIPAA authorization must clearly specify three essential elements so the patient knows what data is being shared, why it’s being shared, and for how long the permission lasts. First, it must describe the information to be used or disclosed. This tells exactly what PHI could be released. Second, it must describe the purposes of the use or disclosure, so there’s transparency about why the data is being shared. Third, it must include an expiration date or an expiration event related to the individual or the purpose, ensuring the authorization doesn’t remain in effect indefinitely. Because each of these elements is required, the option that includes all three is the correct one. In practice, there are additional requirements too—such as identifying who may disclose and to whom the information will go, and obtaining the individual’s signature—but those items aren’t addressed by the choices here.