A permission to discuss medical information form — formally a HIPAA authorization under 45 CFR § 164.508 — is what you sign to let a healthcare provider share or discuss your protected health information with a specific person or organization, whether that’s an attorney, a family member, an insurer, or another doctor. To be legally valid, the form has to contain a defined set of elements, name a specific recipient, carry an expiration, and be signed by you or someone with legal authority to act for you. Miss one required piece and the provider must reject it.
Make Sure You Need an Authorization, Not an Access Request
HIPAA has two separate paths to move records, and picking the wrong one costs time.
An authorization under 45 CFR § 164.508 permits a provider to send your information to a third party. It does not force the provider to act on any federal deadline, and there is no federal cap on what the provider can charge for the copies produced.
A right of access request under 45 CFR § 164.524 is how you get your own records for yourself. The provider must act within 30 days (with one possible 30-day extension if they explain the delay in writing), and fees are limited to reasonable, cost-based charges.
If your goal is simply to obtain a copy for yourself, use an access request. If you need records or discussions directed to someone else, an authorization is the correct form.
What the Form Must Contain
The federal regulation lists the elements a valid authorization must include. A provider can reject the form outright if any are missing.
- A specific, meaningful description of the information being released. “All cardiology records from January 2024 through December 2025” works; “my medical records” does not. You can limit the release to lab results, imaging, discharge summaries, or another defined category.
- The name or specific identification of the person or entity authorized to make the disclosure — usually the provider or facility holding the records.
- The name or specific identification of the person or organization who will receive the information.
- A description of the purpose. If you’d rather not state one, “at the request of the individual” is enough.
- An expiration date or event. A calendar date works, and so does an event like “conclusion of my personal injury claim.” Open-ended authorizations are defective.
- Your signature and the date. If a personal representative signs, the form must describe that person’s authority.
The form also has to carry three required notices: that you can revoke the authorization in writing and how to do so; whether the provider may condition treatment or benefits on your signing (in most cases, they cannot); and a warning that once information reaches the recipient, it may be re-disclosed and may no longer be protected by federal privacy rules.
One point of confusion worth flagging: the regulation does not require your Social Security number. It calls for your name “or other specific identification.” Many provider forms include an SSN or medical record number field to help locate your chart, but if you’d prefer not to write it in, ask whether a patient ID or date of birth will do.
Who Can Sign When the Patient Cannot
Usually you sign your own form. HIPAA also recognizes several situations in which someone else is authorized to sign as your personal representative.
Adults Who Cannot Act for Themselves
A healthcare power of attorney, guardianship, or similar state-law authority makes you the patient’s personal representative, and the provider must give you the same access the patient would have. Expect the records department to ask for a copy of the legal document establishing your role.
Minor Children
Parents and legal guardians generally act as personal representatives for unemancipated minors. There are limited exceptions. A parent may not access records for a specific episode of care if the minor lawfully consented to that care on their own (common for reproductive health, STI testing, mental health, or substance use treatment in many states), if a court directed the treatment, or if the parent agreed to a confidential relationship between the minor and the provider. Those exceptions cover only the specific confidential service; the rest of the child’s records remain accessible to the parent.
Deceased Patients
An executor, administrator, or other person with legal authority over the estate can sign. HIPAA protections stay in place for 50 years after the date of death, so even old records still require a proper authorization.
Sensitive Records That Need Extra Care
Some categories of health information carry additional rules, and a standard authorization form may not be enough on its own.
Psychotherapy Notes
A therapist’s personal session notes, kept separate from the main medical record, require their own standalone authorization. You cannot combine a psychotherapy notes authorization with an authorization for any other type of health information on the same form. If a provider hands you a single document covering both, that form is defective for the psychotherapy portion. Ask for a separate one.
Substance Use Disorder Records
Records from federally assisted substance use disorder treatment programs have historically been governed by 42 CFR Part 2, which imposed stricter consent rules than HIPAA. A final rule taking effect in 2026 aligns these records more closely with HIPAA by allowing a single consent for treatment, payment, and healthcare operations. Even under the updated rule, these records generally cannot be used as evidence in civil, criminal, or administrative proceedings against the patient without the patient’s consent or a court order.
Genetic Information
The Genetic Information Nondiscrimination Act prohibits group health plans from collecting genetic information, including family medical history, for underwriting. A plan cannot ask you to authorize release of genetic test results to set premiums or determine eligibility. Plans may request genetic test results only to process a specific claim for benefits, and only the minimum necessary.
Submitting the Form
Once every field is filled in and signed, deliver the authorization to the provider’s Health Information Management or Medical Records department. Most facilities accept it through the patient portal (which creates an automatic timestamp), in person (ask for a date-stamped copy), by certified mail with return receipt, or by secure fax directly to the records department.
Because an authorization only permits release, there is no federal deadline for the provider to act. In practice, turnaround runs from a few business days to a few weeks. If you need records quickly, call the records office after submitting and ask about their timeline. Fees vary by provider and by state law, so ask for an estimate before copying starts.
What Makes an Authorization Defective
A provider must refuse to act on a defective form. The regulation identifies five conditions:
- The expiration date has passed, or the expiration event has already occurred.
- A required element or mandatory notice is missing.
- You previously submitted a written revocation and the provider knows about it.
- The form improperly combines a psychotherapy notes authorization with a general records authorization, or otherwise violates the compound-authorization rules.
- The provider knows that key information on the form is false.
The most common rejection is an incomplete form: a missing signature, no expiration date, or a vague description of the records requested. Read back through the required elements before you submit. Five minutes of review beats a rejection letter two weeks later.
Revoking the Authorization Later
You can cancel an authorization you’ve already signed. The revocation must be in writing and sent to the provider that holds the original. Address it to the privacy officer or records department, identify the authorization by signing date and recipient, and state that all future disclosures under it must stop.
Revocation does not undo disclosures that already happened. Anything released while the authorization was active remains valid. A narrow exception exists for authorizations obtained as a condition of insurance coverage: if other law gives the insurer the right to contest a claim or the policy itself, the insurer may continue to rely on the authorization even after you revoke.
Send the revocation by a method that creates a paper trail, and keep your copy permanently.
State Rules That May Add Requirements
Federal HIPAA rules set a floor. Many states add requirements on top. Some limit how long an authorization can stay valid: Maine caps duration at 30 months, Minnesota defaults to one year, and Nebraska limits insurance-related authorizations to 24 months. Others require specific disclosure language, use of a state-issued template, or additional consent procedures for mental health records. When state law is more protective of patient privacy than HIPAA, state law controls. If you’re unsure whether your state adds anything, ask the provider’s records department; they work with the local rules every day.
If the Provider Refuses a Valid Form
If a provider improperly refuses to release records or ignores a valid authorization, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights through the OCR Complaint Portal at ocrportal.hhs.gov or in writing. You must include your name and contact information, since anonymous complaints are not investigated. Lack of patient access to protected health information is one of the most frequently alleged issues the office receives.