Can this form be signed electronically?

Yes. Electronic signatures are legally valid under ESIGN (15 U.S.C. ch. 96) and UETA in adopted states, provided intent, consent, attribution, and retention requirements are met.

When is notarization required?

Notarization or witnesses are only required where state law or organizational policy mandates them; check the custodian’s acceptance rules before submitting.

How do I revoke an authorization?

Submit a written revocation to the records custodian; revocation is effective when received and processed. Keep proof of delivery and a dated confirmation.

What supporting documents are needed?

Provide photo ID and any authority documents (power of attorney, guardianship orders). Missing documents are a common cause of rejection.

How long does processing take?

Processing often completes in 3–10 business days; HIPAA-related access or disclosure requests must meet the 30-day response window in 45 CFR §164.524.

How to ensure HIPAA compliance when signing online?

Use a vendor that offers a BAA, enforces strong authentication, provides an audit trail, and stores records with TLS/AES encryption and documented retention controls.

Healthcare CoA Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE CoA FORM

Patient Information

Patient Name

Date of Birth

Gender

Address

Phone

Emergency Contact

Insurance Information

Insurance Provider

Policy Number

Group Number

Subscriber Name

Medical History (brief)

Current Medications Allergies Prior Surgeries / Chronic Conditions

Change of Authorization — Requested Action

Select the requested change to the existing authorization on file:

Add authorized person Remove authorized person Replace authorized person(s) Modify scope of authorization (limits or adds information types) Other (specify below)

Provide details of requested change (if Other or additional explanation)

Authorized Person(s) — Add / Update

Provide each person or entity to be authorized or removed. If removing a person, enter the name and indicate removal.

Authorized Person 1 — Name

Relationship

Phone

Address

Scope of Authorization for Person 1 Authorized Person 2 — Name

Relationship

Phone

Address

Scope of Authorization for Person 2

Information to Be Disclosed

Check all types of information included in this authorization. Sensitive categories require explicit initialing below to be included.

Complete medical record (all departments) Billing and payment records Laboratory and test results Radiology / imaging reports Immunization records

Sensitive categories (selecting any of these requires explicit authorization below):

Mental health / psychotherapy notes Substance abuse treatment records HIV/AIDS related information Genetic testing results

If Other, specify

Purpose of Disclosure

The purpose for which the information will be used or disclosed:

Treatment Payment Personal use Legal / administrative Research (where permitted)

If Other, specify purpose

Authorization Period

This authorization will take effect on and will expire on unless earlier revoked in writing or as specified below.

Alternatively, expire upon the following event (if applicable)

Revocation and Rights

I understand that I may revoke this authorization at any time by delivering a written revocation to the health information custodian. Revocation will not affect disclosures already made in reliance on this authorization prior to receipt of the revocation. Revocation does not apply where action has already been taken in reliance on this authorization.

I understand that information disclosed pursuant to this authorization may be subject to redisclosure by the recipient and may no longer be protected by privacy laws. The health care provider is not responsible for subsequent redisclosure by the recipient.

I understand that treatment, payment, enrollment, or eligibility for benefits may not be conditioned on signing this authorization unless allowed by law.

Sensitive Information — Explicit Authorization

By initialing and checking the boxes below I specifically authorize release of the associated sensitive information. If no initial or checkbox is provided for a sensitive category, that category will not be released.

Mental health / psychotherapy notes: Substance abuse treatment records: HIV/AIDS related information: Genetic testing results:

Certification

I certify that I am the patient or am authorized to act on behalf of the patient. By signing below I authorize the release of the specified health information in accordance with the terms of this Change of Authorization. I understand the scope, purpose, and duration of this authorization and that I may revoke it as set forth above.

Acknowledgment of Privacy

I acknowledge receipt of the provider's privacy practices and understand how my protected health information may be used and disclosed under this authorization.

Printed Name:

Signature:

Date:

Relationship to Patient (if not patient):

What the Healthcare CoA Form Is and when it’s used

The Healthcare CoA Form (Change of Authorization) documents a patient’s instruction to add, remove, or modify who may access protected health information (PHI) or make healthcare decisions on the patient’s behalf. It records the parties involved, scope of the authorization, purpose, effective and expiration dates, and explicit signature and date. Organizations use this form to ensure access requests and releases of PHI meet HIPAA requirements and to create a clear, auditable record of consent decisions for medical records, billing, and third-party disclosures.

Why a clear Healthcare CoA Form matters

A precise CoA Form reduces disputes, ensures lawful PHI disclosures under HIPAA, and documents who can act for a patient. Clear authorizations limit access errors and support timely treatment, billing, and legal compliance.

Who typically completes and relies on the CoA Form

Several roles interact with the Healthcare CoA Form depending on the use case and organizational process.

Patients and authorized representatives who request additions or changes to release or decision-making authority.
Medical records staff and privacy officers who verify identity and update access controls.
Clinicians, billing departments, and third-party payers who rely on verified authorizations for treatment and claims.

Each role has distinct responsibilities: patients provide instruction and consent, staff verify and record the change, and downstream teams act consistent with the updated authorization.

Core elements included in an effective Healthcare CoA Form

A professional CoA Form combines identity verification, a defined authorization scope, temporal limits, purpose, signature mechanics, and revocation instructions to create a legally defensible record.

Patient identity

Full legal name, date of birth, and an identifier (medical record or patient ID) to reliably match the authorization to the correct file.

Authorized parties

Names and contact details of persons or organizations being granted or removed from access; specify roles (agent, caregiver, insurer).

Scope of access

Precise description of PHI categories or actions allowed (billing, treatment notes, lab results) and any excluded items.

Effective timeframe

Start and expiration dates, or an event-based termination clause (e.g., 'until revoked in writing').

Signature and verification

Patient or authorized representative signature with date plus any required witness, notary, or authentication steps for validity.

Revocation and change process

Clear instructions for how to revoke or modify the authorization and where to submit revocation notices.

Step-by-step: completing the Healthcare CoA Form

Follow these steps in order to minimize verification delays and ensure compliance when changing authorizations.

01

Prepare documents: Gather ID and supporting authority documents.
02

Complete form: Fill patient and recipient fields accurately.
03

Authenticate signer: Confirm identity via required method.
04

Submit and record: Send to the medical records office and retain receipt.

Configuring an online CoA workflow

Standardize the digital workflow to enforce authentication, capture audit trails, and route approvals automatically.

Field	Configuration
Authentication method	Email + SMS code or KBA for higher assurance
Audit trail settings	Capture IP, timestamp, and signer email
Template locking	Freeze key fields to prevent accidental edits
Storage and retention	Save signed PDF to secure records repository

Where to submit the completed CoA Form

After signing, send the form to the appropriate custodians and keep a verified copy for compliance and patient records.

Medical records: Primary recipient for updating access and chart notes.
Privacy office: For verification, audit, and retention tracking.
Billing department: If authorization affects insurance or payment responsibilities.
Patient copy: Provide a dated signed copy to the patient or authorized representative.

Digital signing and distribution considerations

Choose platforms that support strong authentication, secure storage, and an accessible audit trail for PHI disclosures.

Authentication: Use multi-factor or knowledge-based checks for higher assurance
Integrations: Connect to EHR, Google Drive, or document management systems
Security: TLS in transit and AES-256 at rest

Key timeframes and regulatory response windows

Certain deadlines affect processing and regulatory obligations; plan requests and verifications accordingly to avoid noncompliance or delays.

HIPAA access response:

30 days to respond to access or disclosure requests (45 CFR §164.524)

Processing expectation:

Internal processing typically 3–10 business days depending on verification workload

Retention trigger:

Retention starts on the date the signed form is received and recorded

Revocation effect:

Revocations are effective when received and processed by the custodian

State-specific steps:

Some states require witnesses or notarization before acceptance

Typical processing milestones for a change of authorization

This sequential view identifies the common stages from form submission to final confirmation in the medical record.

01

Submission received

Form intake and preliminary completeness check

02

Identity verification

Confirm signer identity and supporting documents

03

Record update

Update EHR access lists and document the change

04

Confirmation sent

Provide signed confirmation to the patient and stakeholders

Common errors that delay or invalidate a CoA change

Using nicknames or incomplete legal names that fail to match the medical record.
Failing to attach required supporting documents such as power of attorney or guardianship orders.
Leaving scope ambiguous (for example, saying 'all records' without limits or purpose).
Not following state witness or notarization requirements when they apply, causing rejection.

Risks and potential consequences of incorrect authorizations

HIPAA violation: Civil fines and corrective actions.

Unauthorized disclosure: Privacy breach and mitigation obligations.

Delayed care: Access denials can impede treatment.

Invalid authorization: Operational rejection and re-submission required.

Legal exposure: Potential civil liability for wrongful disclosure.

Recordkeeping gaps: Noncompliance during audits or litigation.

eSignature vendor comparison for Healthcare CoA workflows

Basic vendor differences matter for HIPAA, bulk sending, and envelope limits. The table summarizes common buying criteria across major providers with signNow first.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Frequently asked questions about the Healthcare CoA Form

Answers address legality, electronic signing, notarization, revocation, and documentation to help avoid processing delays and compliance issues.

Need help? Contact support

Can this form be signed electronically?
Yes. Electronic signatures are legally valid under ESIGN (15 U.S.C. ch. 96) and UETA in adopted states, provided intent, consent, attribution, and retention requirements are met.
When is notarization required?
Notarization or witnesses are only required where state law or organizational policy mandates them; check the custodian’s acceptance rules before submitting.
How do I revoke an authorization?
Submit a written revocation to the records custodian; revocation is effective when received and processed. Keep proof of delivery and a dated confirmation.
What supporting documents are needed?
Provide photo ID and any authority documents (power of attorney, guardianship orders). Missing documents are a common cause of rejection.
How long does processing take?
Processing often completes in 3–10 business days; HIPAA-related access or disclosure requests must meet the 30-day response window in 45 CFR §164.524.
How to ensure HIPAA compliance when signing online?
Use a vendor that offers a BAA, enforces strong authentication, provides an audit trail, and stores records with TLS/AES encryption and documented retention controls.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now