The Privacy Rule does not specify who may draft the Authorization, so a researcher could draft it regardless of whether the researcher is a covered entity. However, in order to have a Privacy Rule-compliant Authorization, it must be written in plain language and contain the core elements and required statements, and a signed copy must be provided to the individual signing it if the covered entity itself is seeking the Authorization. The companion piece Sample Authorization Language contains language that illustrates the inclusion of core elements and required statements. NOTE: If an Authorization permits disclosure of the individual’s PHI to.
