What you are actually signing when you authorise a disclosure
An authorisation is the document that moves your health information from a protected environment to somewhere it may not be protected at all. It deserves more attention than the thirty seconds most people give it, because its scope is entirely negotiable before you sign and entirely fixed afterwards.
Anatomy
Six elements a valid authorisation must contain
An authorisation missing any of these is defective. Reading for them takes under a minute and is the difference between a targeted disclosure and an open-ended one.
- A specific description of the information
- “My ESA letter dated 4 March” is specific. “My health records” is not.
- The person or entity making the disclosure
- Named, not implied.
- The person or entity receiving it
- A named landlord or property manager, rather than a category of recipients.
- The purpose
- “To support a reasonable accommodation request” rather than “as required”.
- An expiry date or event
- A date, or an event such as the conclusion of the tenancy application.
- Your signature and the date
- Together with a statement of your right to revoke.
Narrowing a broad authorisation
A form handed to you is a starting position, not a fixed requirement. You are entitled to strike out what is unnecessary and sign the narrowed version — and in the housing context the narrowed version is almost always sufficient.
“Any and all medical records”
“The assistance animal letter dated [date] only”
“To the property management company and its agents”
“To [named person], leasing manager at [address]”
“Valid until revoked”
“Expires 90 days from signature”
Without your signature
Disclosures that do not require authorisation
Treatment, payment and operations
The internal functions that make the evaluation possible at all.
Court order or lawful subpoena
Limited to what the order specifies, and documented.
Serious and imminent safety risk
A narrow exception, not a general one.
Regulatory oversight
Lawful audit by bodies supervising licensed clinicians.
Note what is absent from that list: your landlord, your employer, your university and your family. None of them can obtain your information by asking.
Frequently asked
Can I revoke an authorisation after signing?
Yes, in writing, and it takes effect when received. It does not reverse disclosures already made in reliance on it while it was valid.
Can I authorise disclosure of only part of my record?
Yes. You may limit an authorisation to a specific document, such as the letter alone, and exclude intake responses and clinical notes.
Is a verbal authorisation enough?
Not for a third-party disclosure of this kind. A valid authorisation is written, signed, dated and contains the required elements.
What if a landlord gives me their own authorisation form?
Read it for the six elements and narrow anything broader than the purpose requires. You are entitled to amend it before signing rather than accept it as drafted.
Does an authorisation expire automatically?
A valid one states an expiry date or event. Once that passes it can no longer be relied on, and a fresh authorisation would be required.
Can my information be shared if I simply do not respond to a request?
No. Silence is not authorisation. Absent one of the narrow legal exceptions, a disclosure to a third party requires your affirmative written permission.
Your privacy is not an afterthought here
Start a free evaluation and see exactly what your landlord will — and will not — receive.
Start free evaluation All privacy topics