Patient consent form PDF.

The artifact is the form. The compliance lives in the workflow around it.

A patient testimonial, an identifiable before/after image, and a case study that names a specific clinical narrative each disclose Protected Health Information by confirming the treatment relationship. 45 CFR 164.508 requires written authorization before the covered entity uses or discloses PHI for marketing ¹ . The form is the carrier. A template PDF downloaded from a stock-form repository does not, by itself, satisfy the standard; the authorization is specific to the use, and the description has to be specific and meaningful to the disclosure at hand.

The workflow that produces the compliant record runs the form through five surfaces. The practice authors a per-use description (the quoted text in a testimonial; the clinical narrative in a case study). The patient reads, asks questions, and signs. The covered entity retains the signed PDF alongside the patient record. The covered entity tracks revocation status and stops the disclosure where revocation reaches it before the disclosure is irrevocably made. The retention runs at least six years from the date of the authorization or the date when it last was in effect under 45 CFR 164.530(j) ⁵ . The PDF without the workflow is a half-measure; the workflow without the PDF is undocumentable.

Each element binds the disclosure. Missing any one invalidates the authorization.

A valid authorization carries five core elements under 45 CFR 164.508(c): a specific and meaningful description of the information to be used or disclosed, the persons authorized to make the use or disclosure, the persons to whom the covered entity may make the use or disclosure, a description of each purpose, and an expiration date or expiration event ¹ . The form additionally carries the patient's right-to-revoke statement, a statement that treatment cannot be conditioned on signing, the redisclosure-risk statement, and the patient's signature plus date.

For a marketing testimonial the description names the quoted statement, the publication surfaces (the practice's website, social channels, email marketing), and the duration of the use. For a case study the description names the clinical narrative disclosed (presenting complaint, diagnostic workup, procedure performed, outcome), the publication surfaces (a peer-reviewed journal, conference proceedings, the practice's editorial section), and the duration. Two separate use classes mean two separate authorizations. A single per-patient form covering "any future marketing use" fails the specificity standard; OCR has pursued resolution agreements against practices relying on broad intake releases for marketing-specific disclosures ² .

An adjacent path. Not a substitute for the authorization workflow.

45 CFR 164.501 defines marketing for HIPAA purposes and carves out exceptions that do not require per-recipient authorization ³ . A covered entity's communication describing a health-related product or service provided by the covered entity itself sits inside the exception: a hospital announcing the arrival of a new orthopedic group via patient mailing, a clinic announcing the acquisition of a new MRI machine via email, a refill reminder for a previously dispensed prescription, a referral coordination communication for a treatment relationship. The exception holds as long as the covered entity does not receive direct or indirect remuneration from a third party to make the communication.

The exception covers a different surface than the testimonial or case-study disclosure. A practice-announcement email about a new physician is exempt; a quoted patient testimonial naming that physician's care is not. A refill reminder is exempt; a case study describing the patient's prescription course is not. The two paths run in parallel: the §164.501 exception applies to the practice-announcement surface, and the §164.508 authorization applies to the testimonial and case-study surface. The PDF template for a testimonial cannot be reframed as a §164.501-exempt communication; the use determines the path.

Strip the identifiers cleanly and the authorization requirement falls away.

Information that has been de-identified per the standards in 45 CFR 164.514 is not PHI ⁴ . Safe Harbor de-identification requires removing the 18 listed identifiers (name, address, dates of service, contact information, biometric identifiers, photographic images of the face, distinguishing marks, and the rest of the listed set) and the covered entity not having actual knowledge that the remaining information could be used to identify the individual alone or in combination with other available information. The Expert Determination pathway uses a qualified statistician to certify the residual re-identification risk is very small.

A de-identified case study can ship without the authorization workflow. The practical engineering: a single-patient case study with a rare presentation is harder to de-identify than it looks. A quoted profile of "a 47-year-old female patient presenting with bilateral X" at a community-sized practice in a small-population region has a small-cell population pool that can re-identify the patient by triangulation against publicly-known practice demographics. The architectural pattern: authorization-by-default for individually-quoted testimonials and named-case studies, de-identification reserved for aggregate-statistic content where the population size is large enough to support it.

The patient-consent-form-pdf workflow sits inside the broader medical SEO services at Praxis as the per-use mechanism that lets the practice surface real patient outcomes without crossing the §164.508 line. The form is the artifact; the workflow around it is the substance.