How to Complete the Blue Cross Blue Shield Release of Information Form

The Blue Cross Blue Shield release of information form is the written authorization that lets your BCBS plan share your protected health information with a person, provider, or organization you name. Federal privacy law requires that authorization before any disclosure, and the form has to carry specific elements set out in 45 CFR 164.508.¹ BCBS is not a single national insurer. It is a federation of 34 independent, locally operated companies, so the layout and submission instructions differ by plan even though every version collects the same core information.²

Find Your Plan’s Form

Start with your member ID card. The first three characters of the ID number map to a specific local BCBS company. On BCBS.com, an interactive tool lets you enter those characters or your ZIP code to reach your company’s website and member portal.³ From there, look under “Forms” or “Member Resources.” Some plans post a fillable version online; others offer a PDF to print. If you can’t find it, call the Member Services number on the back of your card and ask for a copy by mail or email.

What Every Form Requires

A valid HIPAA authorization has six core elements. Leaving any one blank gives the insurer grounds to send the form back, so pull everything together before you start writing.¹

Your full legal name, date of birth, and address exactly as they appear on your member ID card, plus the ID number itself. Plans label that number differently (Member ID, Subscriber ID, Contract Number), but any of those is what the form is asking for.⁴
A specific description of the information you want released. Most forms offer checkboxes (claim history, billing, enrollment, care management, appeals) plus a write-in field.⁵
Who is authorized to release the information. This is usually pre-filled with your BCBS plan’s name.
Who will receive the information: the full name and mailing address of the person, provider, or organization.⁴
The purpose of the disclosure. If you simply want your own records sent somewhere and don’t want to say more, “at the request of the individual” is enough.¹
An expiration date or triggering event (such as the conclusion of a lawsuit). Leave it blank and most BCBS plans default to one year from the signature date.⁵
Your signature and the date. The form is not valid without one. If someone else signs for you, the form also has to describe that person’s legal authority.

Deciding How Much to Release

You decide the scope. An authorization can cover all protected health information, or it can be narrowed to a single provider visit on a specific date. BCBS of Alabama’s form, for example, lets you authorize everything, limit the release to a particular condition or provider, or describe a specific accident and injury.⁴ Blue Cross of Minnesota groups the options into categories like claim information, appeal information, billing, enrollment, and care management.⁵

Be specific enough that the insurer can pull the right records, but not so narrow that you end up filing a second form. For a personal injury claim, authorizing all claims, billing, and care management records tied to a date range usually works better than listing claim numbers you may not have.

How to Submit It

Submission channels vary by plan. Mail and fax are the two methods that virtually every BCBS company accepts. BCBS of Michigan directs members to mail completed forms to its Detroit office or fax them to a dedicated number, and states that it cannot accept the information by phone or email.⁶ Some plans allow secure uploads through the member portal, but don’t assume that option exists until you’ve confirmed it.

The mailing address and fax number are on the form itself or in the instructions that come with it. Keep a copy of what you send. If you fax it, print the transmission confirmation page. None of the BCBS forms reviewed guarantee a processing timeline, so build in a buffer if records are due by a particular date, and consider a follow-up call a week or two after you submit.

If the Form Is Rejected

If anything required is missing, expect to be contacted for a corrected form. BCBS of Michigan’s instructions say staff will reach out and request a new form entirely rather than fix the one on file.⁶ If you believe your authorization is valid and the insurer still refuses to release records, you can file a privacy complaint with the U.S. Department of Health and Human Services Office for Civil Rights within 180 days of learning about the violation.⁷

Records That Need a Different Form

Two kinds of health information don’t ride on a standard BCBS authorization.

Psychotherapy Notes

A therapist’s private session notes, kept separate from your general chart, require their own standalone authorization. Federal law forbids combining an authorization for psychotherapy notes with one for any other type of health information on the same form.⁸ If you want both psychotherapy notes and claims data released, that’s two separate forms. Even with authorization, only certain disclosures of psychotherapy notes are permitted; routine treatment, payment, and operations uses typically are not.⁹

Substance Use Disorder Treatment Records

Records from substance use disorder treatment programs are governed by 42 CFR Part 2, a separate set of federal privacy rules with their own consent requirements and additional elements beyond a standard HIPAA authorization.¹⁰ A standard BCBS form alone may not be enough. If your release involves SUD treatment records, contact your BCBS plan and the treatment program to confirm which form to use.

Signing for Someone Else

A parent or legal guardian generally signs for a minor child. HIPAA treats a parent as the child’s personal representative with authority to authorize release of the child’s information.¹¹ Once the child reaches the age of majority (18 in most states, 19 or 21 in a few), that default authority ends and the now-adult child signs for themselves. A covered entity may also refuse to treat a parent as the personal representative if it reasonably believes the child has been or may be subjected to domestic violence, abuse, or neglect by that parent and that access could endanger the child.¹² State laws can also give minors independent authority over certain care, such as reproductive or mental health treatment, which limits parental access to those specific records.

For another adult, you can sign if you hold a health care power of attorney, a court-appointed guardianship, or a durable power of attorney that covers health care decisions. Your authority extends only to information within the scope of your legal document, and you should attach a copy of that document to the form so the insurer can verify it.¹¹

For a deceased member, the personal representative is whoever has legal authority over the decedent or the estate, typically an executor or estate administrator named in probate.¹³ A power of attorney does not survive the person’s death, so an executor who relied on one previously will need letters testamentary or a court order. Send a copy of the death certificate and your appointment documentation with the form. HIPAA protections on a deceased person’s records last for 50 years after death.

Canceling or Changing an Authorization You Already Signed

You can revoke a signed authorization at any time by sending a written notice to your BCBS plan. Blue Cross of Minnesota tells members to send written notice to the company directly.⁵ Blue Cross of Alabama asks that revocations go to its Privacy Office at a specific mailing address.⁴ Independence Blue Cross directs members to contact Member Services for instructions on submitting the written revocation.¹⁴ Check your own plan’s form for its specific method.

Revocation only works going forward. Information the insurer already shared while the authorization was active stays disclosed, and the insurer has no liability for releases made in good faith before it received your written cancellation.⁵ If you never revoke and didn’t set an earlier expiration, the authorization lapses on its own, typically one year after you signed it. Your plan generally cannot condition treatment, payment, enrollment, or benefits on whether you sign in the first place, with narrow exceptions for research-related treatment and certain pre-enrollment underwriting situations.⁸

1
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
2
Blue Cross Blue Shield of Michigan. Blue Cross Blue Shield Association
3
Blue Cross Blue Shield. BCBS Member Login – Find Your Blue Cross Blue Shield Account
4
Blue Cross and Blue Shield of Alabama. Authorization for Disclosure of Protected Health Information
5
Blue Cross and Blue Shield of Minnesota. Authorization for Disclosure of Health Information
6
Blue Cross Blue Shield of Michigan. Member Consent for Release of Protected Health Information
7
HHS.gov. How to File a Health Information Privacy or Security Complaint
8
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
9
U.S. Department of Health and Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health
10
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
11
U.S. Department of Health and Human Services. Guidance – Personal Representatives
12
U.S. Department of Health and Human Services. Personal Representatives and Minors
13
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information – General Rules
14
Independence Blue Cross. Authorization for Release of Information Form