To complete a HIPAA release form, fill in seven pieces of information on the provider’s form (or your own): your identifying details, the provider who holds the records, the person or organization receiving them, a specific description of the records, the purpose of the release, an expiration date or event, and your signature and the date you signed. Every field matters. If any required element is missing, the provider can reject the form as defective and you will have to start over.
Start With the Right Form
Most providers give you their own release form, either at the front desk or through a patient portal. Using the provider’s form is usually the fastest path, because it already contains the required legal notices in the right places.
You can also draft your own authorization. Providers must accept it as long as it contains every required element and notice under federal law.1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required If you go that route, work from the checklist below and don’t skip the required statements about revocation, conditioning, and redisclosure.
A release form is not the same as the general consent to treat you sign at check-in. The consent covers routine uses of your information inside that practice. A release (formally, a HIPAA authorization) is a standalone document that authorizes one specific disclosure to one specific recipient for one specific purpose.1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
Fill In Each Required Field
Work through the form in order. Every field below is required by federal regulation, and leaving any one blank makes the whole authorization invalid.1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
Your Identifying Information
Write your full legal name, date of birth, and current contact information in the patient section. If you are signing for someone else as their personal representative, put the patient’s information in this section and your own details in the signature block, with a short description of your legal authority (for example, “healthcare power of attorney dated March 2024”).
Who Holds the Records
Enter the name of the healthcare provider, hospital, clinic, or facility that has the records you want released. Use the full legal name of the practice or organization, not just a doctor’s name, so the records department can route the request internally.
Who Will Receive the Records
Enter the full name, organization, and mailing address of whoever should receive the information. Be specific enough that the provider can actually deliver the records. If they are going to your attorney, include the firm name and address; if they are going to another doctor, include the practice address and, if possible, a fax number or secure email.
Description of the Information
Describe the specific health information you want released. Broad phrases like “all medical records” technically satisfy the rule, but narrower descriptions get processed faster and often cost less. If you need only lab results from a specific visit, say so. If you need records from a date range, write the start and end dates. Check any boxes the form offers for particular record types (imaging, visit notes, discharge summaries, immunization history).
Purpose
State why you want the records released. Common purposes include transferring care to a new provider, supporting a legal claim, processing an insurance application, or personal review. If none of those fit or you would rather not explain, “at the request of the individual” is an acceptable purpose under the rule.
Expiration Date or Event
Enter either a specific calendar date or a triggering event, such as “conclusion of my legal case” or “end of open enrollment.” An authorization with no expiration is defective. Pick a date that gives the provider enough processing time without leaving the release open indefinitely.
Signature and Date
Sign the form and write the date you signed. An unsigned or undated form is automatically rejected. If a personal representative signs, the form must also describe that person’s authority to act on your behalf.
Required Notices on the Form
The form itself has to contain three written statements about your rights. If you are using the provider’s form, these are usually pre-printed. If you are drafting your own, add them:1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
- A statement that you can revoke the authorization in writing at any time, and either instructions on how to do so or a reference to the provider’s privacy notice.
- A statement about whether the provider can condition treatment, payment, enrollment, or benefits on your signing. In most cases the answer is no, and the form must say so.
- A statement warning that once the recipient has the information, federal privacy protections may no longer apply and the recipient could share it further.
Signing on Someone Else’s Behalf
Federal law recognizes personal representatives who can sign a release when the patient cannot act for themselves or when the records belong to someone else. Your authority under the Privacy Rule mirrors whatever authority you hold under state law, so the scope of what you can access depends on the underlying legal document.2U.S. Department of Health & Human Services. Personal Representatives
For an adult who cannot act for themselves, a healthcare power of attorney, a court-appointed guardianship, or a general or durable power of attorney covering healthcare decisions qualifies you to sign.
For a deceased person, an executor, administrator of the estate, or next of kin with legal authority can sign. This authority does not need to specifically include healthcare decision-making.
For a minor child, a parent or guardian generally signs as the child’s personal representative.3U.S. Department of Health & Human Services. The HIPAA Privacy Rule and Parental Access to Minor Childrens Medical Records Three exceptions limit that access: the minor lawfully consented to the care independently, the child received care at the direction of a court or court-appointed person, or the parent agreed the child and provider could have a confidential relationship. Providers also have discretion to deny a parent access if they reasonably believe the child has been or may be subject to abuse, neglect, or domestic violence and that access could endanger the child.
Whichever category applies, attach or reference the legal document that gives you authority, and include a short description of it in the signature block.
Extra Forms for Sensitive Records
A standard HIPAA release does not cover every kind of record. Two categories need their own separate forms.
Psychotherapy notes, the personal notes a therapist keeps separate from your main chart, receive heightened protection. A provider needs a separate, standalone authorization to release them, and that authorization cannot be combined with an authorization for any other type of record.4U.S. Department of Health & Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health If you want both general medical records and psychotherapy notes released, sign two forms. Psychotherapy notes are different from the mental health information kept in your regular medical record, such as diagnoses, treatment plans, and medication lists, which follow the standard rules.
Records from federally assisted substance use disorder treatment programs are governed by a separate regulation, 42 CFR Part 2, which adds its own consent requirements on top of HIPAA.5eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records Ask the treatment program for its own consent form; a standard HIPAA release will not be enough.
What Gets a Form Rejected
Before submitting, check the form against every one of these defects. Any of them lets the provider refuse to process it:1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
- The expiration date has passed or the triggering event has already happened.
- A required element is missing, whether that is the recipient’s name, the record description, the purpose, the expiration, or the signature and date.
- You already revoked the authorization in writing.
- A psychotherapy notes authorization was combined with a general records authorization.
- The provider knows material information on the form is false.
The most common problem is a blank field. Run through the checklist above one more time before you sign.
Submitting the Form
Hand-deliver the signed form to the provider’s office, mail it, fax it, or upload it through a secure patient portal. Providers can accept a scanned PDF or an electronically signed form.6U.S. Department of Health & Human Services. Individuals Right under HIPAA to Access their Health Information Keep a copy for yourself regardless of how you send it.
If you want the records sent directly to a third party rather than to you, your written request must be signed and must clearly identify the recipient and where to send the information.
Expect the provider to verify your identity. Federal rules require reasonable steps, but the specific method (photo ID, portal login, security questions) is up to the provider. Verification cannot create unreasonable barriers or delays to your access.
How Long It Should Take
The provider must act on your request within 30 calendar days of receiving it. If it cannot meet that deadline, it may take a one-time 30-day extension, but only by sending you a written explanation and expected completion date inside the original 30-day window.7U.S. Department of Health & Human Services. How Timely Must a Covered Entity Be in Responding to Individuals Requests for Access to Their PHI Reference the 30-day rule when you follow up.
What You Might Pay
Providers can charge a reasonable, cost-based fee for copying records. The fee can cover labor for copying, supplies (paper or a USB drive if you ask for one), and postage. It cannot include the cost of searching for records or general system overhead.6U.S. Department of Health & Human Services. Individuals Right under HIPAA to Access their Health Information
For electronic copies of records the provider already keeps electronically, many providers use a flat fee capped at $6.50 that covers labor, supplies, and postage combined. Requesting records electronically is almost always cheaper than paper. If the provider maintains your records electronically and you request an electronic copy, the provider must produce it in the format you ask for if that format is reasonably producible.
Revoking the Form Later
You can cancel any HIPAA authorization at any time by sending the provider a written revocation.1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required Identify the specific authorization you are revoking (including the date you originally signed it) and state clearly that you are revoking it. The revocation only applies going forward. Any information the provider released while the authorization was still valid stays released.