HIPAA Authorization. Right of Access. Permits, but does not require, a covered entity to disclose PHI.. Requires a covered entity to disclose PHI, except where an exception applies. Requires a number of elements and statements, which include a description of who is authorized to make the disclosure and receive the PHI, a specific and meaningful description of the PHI, a description of the ....