An Authorization is a document signed by a person to allow disclosure of their protected health information (PHI) to somebody outside the covered entity that stores the PHI. If you need access to your subjects' PHI you will need a signed Authorization from each subject that explains clearly to the subject what PHI you need to access, how you will use it, and who will see this information.