On this page
A HIPAA consent form is a patient's written permission for a covered entity to use and disclose their health information for treatment, payment and health care operations, and under the Privacy Rule it is optional: covered entities that ask for consent “have complete discretion to design a process that best suits their needs” (HHS). It is not a HIPAA authorization, which the rule requires for uses such as most marketing and which must contain the elements in 45 CFR 164.508(c). Curve Compliance, whose HIPAA intake forms, Curve Forms, keep privacy consent and marketing consent as separate checkboxes, checked each rule on eCFR and HHS on November 2, 2026.
Book a call. Collecting consent online? Curve Forms are hosted by Curve under the BAA Curve signs on every plan, and form answers are never sent to ad platforms. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What a HIPAA consent form is
The rule's text is short: “A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations” (45 CFR 164.506(b)(1)). HHS's summary adds that obtaining consent “is optional under the Privacy Rule for all covered entities,” and that “The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent” (HHS).
So HIPAA never makes you collect consent for treatment, payment or operations. The rule already permits those uses (45 CFR 164.506(a)); see HIPAA TPO. State law is a separate layer. HIPAA does not override a state privacy law that is more stringent (45 CFR 160.203(b)), so a state can require consent where HIPAA does not. Which state rules apply to your practice is a question to talk to your counsel about.
Consent, authorization and the notice of privacy practices
These documents are easy to mix up. Each does a different job:
| Document | Required by HIPAA? | What it covers | Rule |
|---|---|---|---|
| Consent | No, optional | Treatment, payment and health care operations | 45 CFR 164.506(b); HHS FAQ |
| Authorization (often called a release form) | Yes, for uses and disclosures the rule doesn't otherwise permit | The specific information, recipient and purpose named on it | 45 CFR 164.508 |
| Notice of privacy practices | Yes, for most covered entities | How the practice may use and disclose PHI, and patients' rights | 45 CFR 164.520 |
| Notice acknowledgment | A good faith effort, for providers with a direct treatment relationship | The patient confirms they received the notice | 45 CFR 164.520(c)(2)(ii) |
| Cookie banner | Not a HIPAA document | The website's cookie and tracking choices | HHS tracking bulletin |
HHS describes the authorization as “a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual” (HHS). The HIPAA release form checklist walks through its required elements, and the notice of privacy practices guide covers the notice.
What a sample consent form includes
Because HHS leaves the content to you, HIPAA sets no required list for consent. If you use a consent form, these are the parts the rule gives you reason to include, with the rule behind each:
| Part of the form | What it says | Rule behind it |
|---|---|---|
| Scope | Permission to use and disclose PHI for treatment, payment and health care operations | 164.506(b)(1) |
| Limit | That this consent does not stand in for an authorization where one is required | 164.506(b)(2) |
| Notice | Where to find the notice of privacy practices, and a line acknowledging the patient received it | 164.520(c)(2)(ii) |
| Restrictions | That the patient may ask the practice to restrict uses and disclosures for treatment, payment and operations, and that the practice need not agree, except a restriction on disclosures to a health plan for payment or health care operations, not otherwise required by law, about care paid for in full | 164.522(a)(1) |
| Who signs | The patient, or a personal representative, whom the rule treats as the patient | 164.502(g)(1) |
| Signature, date and how to withdraw | Your choice: HHS leaves the design of the consent process to the covered entity | HHS FAQ |
Keep marketing out of it. An authorization “may not be combined with any other document to create a compound authorization,” apart from listed exceptions (45 CFR 164.508(b)(3)), so a marketing authorization can't be folded into a consent form.
When consent is not enough
The rule closes the gap itself. Consent “shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508, is required” (45 CFR 164.506(b)(2)). HHS puts it this way: “Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization” (HHS). Three uses always need an authorization, apart from narrow exceptions:
- Psychotherapy notes (45 CFR 164.508(a)(2)).
- Marketing, except face-to-face communications and promotional gifts of nominal value (45 CFR 164.508(a)(3)).
- A sale of PHI (45 CFR 164.508(a)(4)).
Online forms: privacy and marketing consent checkboxes
Online intake adds two things a paper form doesn't have: the website around the form, and the tools that run on that page. For the website, a covered entity with a web site about its services “must prominently post its notice on the web site and make the notice available electronically through the web site” (45 CFR 164.520(c)(3)(i)); a link next to the consent checkbox keeps it in view. For the tools, HHS's tracking bulletin says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). A consent checkbox does not change what a page's pixels send.
Curve Forms handle the form side. Forms are hosted by Curve under the BAA Curve signs on every plan, so submissions never pass through a third-party form tool, and each form can carry separate checkboxes for privacy consent and marketing consent. Form events such as a completed submission reach Meta, Google Ads and your other destinations server-side through your event mappings, while form answers, page titles and free text are never sent. See what makes an intake form HIPAA compliant and the patient intake form template.
Cookie banners are not HIPAA authorization
HHS is direct: “Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization.” Where no Privacy Rule permission applies, or the vendor is not a business associate, “the individuals' HIPAA-compliant authorizations are required before the PHI is disclosed to the vendor” (HHS). The same page notes that a federal court vacated part of the bulletin on June 20, 2024, the part about IP addresses on unauthenticated public pages about health conditions or providers. See cookie banners vs HIPAA authorization and consent management vs HIPAA authorization.
How Curve Compliance helps
Curve Compliance helps on both sides of an online consent flow. Curve Forms host the form under the BAA Curve signs on every plan, with separate privacy consent and marketing consent checkboxes, logic that shows or hides fields based on earlier answers, and a log of every view or export of submissions. On the tracking side, Curve replaces browser ad pixels with one script, sends conversions server-side and strips PHI before data reaches an ad platform. Curve also offers consent management for your website's cookie choices.
Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry). Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: 45 CFR 164.506; 45 CFR 164.508; 45 CFR 164.502; 45 CFR 164.520; 45 CFR 164.522; 45 CFR 160.203; HHS, Summary of the HIPAA Privacy Rule; HHS, consent vs authorization; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What is a HIPAA consent form?
A patient's written permission for a provider to use and disclose their health information for treatment, payment and health care operations. HIPAA makes it optional (45 CFR 164.506(b)).
What is a consent to release information form?
Usually it means a release form, which HIPAA calls an authorization: permission to share specific information with a named recipient for a stated purpose, with the elements in 45 CFR 164.508(c). See the HIPAA release form checklist.
Is a HIPAA consent form required?
Not by HIPAA. HHS says covered entities may obtain consent for treatment, payment and health care operations but are not required to (HHS), though a more stringent state law can still apply (45 CFR 160.203(b)).
What is the difference between consent and authorization under HIPAA?
Consent is optional permission for treatment, payment and health care operations, designed however the covered entity chooses. An authorization is required for uses the rule doesn't otherwise allow, and it must name the information, recipient, purpose and expiration (HHS; 45 CFR 164.508).
Is a cookie banner a HIPAA authorization?
No. HHS says banners that ask users to accept or reject tracking technologies such as cookies are not a valid HIPAA authorization (HHS).
Can one form cover privacy consent and marketing consent?
Keep them as separate choices. Where marketing needs a HIPAA authorization, it must meet 45 CFR 164.508, including the patient's signature and date, and the rule bars combining an authorization with another document outside its listed exceptions (164.508(b)(3)). For the consent choices on an intake form, Curve Forms has separate checkboxes for privacy consent and marketing consent.
Does a HIPAA consent form need a signature?
HIPAA doesn't say, because it doesn't require consent at all; HHS leaves the content and process to the covered entity (HHS). An authorization is different: it must carry the patient's signature and date (45 CFR 164.508(c)(1)(vi)).
Talk to Curve Compliance
Book a call. Building an online intake or consent flow? Curve Forms host it under the BAA Curve signs on every plan, keep privacy consent and marketing consent separate, and never send form answers to ad platforms. Book a call with Curve.