An insurer requests the applicant's attending-physician records to underwrite a life application. Under HIPAA Privacy Rule 45 CFR §164.508, a valid authorization permitting the physician to disclose protected health information (PHI) to the insurer MUST include all of the following EXCEPT:

Why this is the answer

45 CFR §164.508(c) sets out the 'core elements' and 'required statements' of a valid HIPAA authorization to disclose PHI. Core elements include: a specific description of the PHI; the persons/classes authorized to disclose; the recipients; the purpose; an expiration date or event; and the individual's dated signature (with personal-representative authority where applicable). Required statements include the right to revoke (and exceptions), the inability/ability to condition treatment on authorization, and the potential for re-disclosure no longer protected by HIPAA. Notarization is NOT a required element. Insurers commonly use a form that satisfies §164.508 and that permits disclosure to underwriters, reinsurers, and the MIB.