How to Fill Out a Medical Release of Information Form: Fees and Revoking

To fill out a medical release of information form, get the current authorization form from the provider that holds your records, complete every required field (your identifying information, who is releasing the records, who is receiving them, exactly which records, the purpose, an expiration date, and your signature), confirm the form carries the three HIPAA-required notice statements, and send it to the facility’s health information management department. The form is governed by 45 CFR § 164.508, which sets the minimum elements that make an authorization legally valid.¹ If any required element is missing, the provider can and should reject the form.

Get the Right Form First

Start with the specific facility that holds the records you want released. Each provider has its own version of the authorization, with internal tracking fields, department names, and record identifiers built in. A generic form downloaded from an unrelated website may technically meet HIPAA’s minimum requirements but still get bounced because it lacks the facility’s internal fields or the specific opt-in checkboxes state law requires.

Most hospitals and large practices post their authorization form on the patient portal or on the website under a heading like “Medical Records” or “Health Information.” Smaller offices may hand it to you at the front desk or route you to the health information management department. If you’re releasing records from a substance use disorder treatment program, ask specifically for that program’s 42 CFR Part 2 consent form, not a general HIPAA authorization. A standard HIPAA form does not satisfy Part 2’s stricter requirements, and the program should refuse to process it.²

Filling Out Each Section

Work through the form section by section. Rushing invites mismatches that stall the request for weeks.

Patient information. Enter your full legal name, date of birth, and any patient or medical record number the facility uses. A mismatch between the name on the form and the name in the provider’s system is one of the most common reasons requests get delayed. HIPAA does not require your Social Security number; some facility forms ask for it as an internal identifier, but the federal rule only requires enough information to identify you.
Disclosing party. This is the healthcare provider or facility holding your records. On facility-specific forms it is usually pre-printed.
Recipient. Provide the full name, mailing address, fax number, or secure email for the person or organization getting the records. Add a department or attention line if it applies. “My attorney” is too vague; write the firm name and a specific contact person.
Information to disclose. The form must describe the records in a “specific and meaningful fashion.” Rather than checking “all medical records,” list the record types (radiology reports, discharge summaries, immunization records), dates of service, or treating departments. If the form has separate checkboxes for sensitive categories such as HIV/AIDS records, psychotherapy notes, substance use disorder records, or genetic testing, mark them deliberately. Many states require an explicit opt-in for these categories, and leaving them blank means they won’t be released.
Purpose. Say why the records are being shared. “Insurance claim,” “legal proceedings,” and “continuity of care with new provider” are common. If you don’t want to state a reason, “at the request of the individual” is sufficient when you initiate the authorization yourself.
Expiration. Pick a specific date or describe a triggering event such as “upon resolution of the claim.” Six months to one year from signing is common for insurance and legal matters. Do not leave this blank. An open-ended authorization with no expiration is not valid.
Signature and date. Sign and date the form yourself. If someone else is signing as your representative, the form must also describe that person’s authority to act for you, and you should attach proof of that authority.

Required Language to Check Before Signing

Before you sign, read the fine print. Beyond the fields you fill in, the authorization must include three statements that put you on notice of your rights.¹

A statement of your right to revoke the authorization in writing, along with either the exceptions to that right or a reference to the provider’s Notice of Privacy Practices where those exceptions are explained.
A statement about whether the provider can condition treatment on your signing. In most situations, a provider cannot refuse to treat you if you decline.
A statement warning that once records are disclosed, the recipient may re-disclose them and they may no longer be protected by federal privacy rules.

If any of the three is missing, ask the facility for an updated form. Submitting a defective authorization wastes everyone’s time, and a careful health information management department will reject it anyway.

Who Signs When the Patient Can’t

A competent adult signs the form for themselves. For a minor child, a parent or legal guardian signs in most situations. Some states allow minors to consent independently to certain sensitive services (reproductive health, mental health treatment, substance use counseling), and in those cases the minor may also control the release of those specific records. Age thresholds vary by state, generally falling between twelve and the age of majority.

When a patient cannot sign because of incapacity, the person holding healthcare power of attorney or a court-appointed guardian signs instead. Expect to provide proof: a copy of the power of attorney document or letters of guardianship from the probate court. Without that documentation, providers will deny the request.

For a deceased patient, the executor or administrator of the estate acts as the personal representative with full authority to authorize disclosure.³ The executor provides a certificate of appointment from the probate court. If no executor has been appointed, state law determines who may act, often the next of kin, who may need to submit a notarized written request confirming there is no appointed executor and identifying themselves as the closest living relative.

Special Records That Need a Separate Form

Two categories of records will not travel on a general authorization, and it is worth checking before you sign.

Psychotherapy notes get stronger protection than other medical records. HIPAA defines them narrowly as notes recorded by a mental health professional documenting the contents of a counseling session, kept separate from the rest of your medical record.⁴ Medication records, session start and stop times, treatment plans, diagnoses, and progress notes are not psychotherapy notes even when they come from a mental health provider. An authorization to release psychotherapy notes cannot be combined with any other authorization. If a provider hands you a single form bundling psychotherapy notes with your general records, that authorization is defective under federal law. Ask for two separate forms.

Records from federally assisted substance use disorder treatment programs fall under 42 CFR Part 2, a separate and stricter regulation. A Part 2 consent form must include your name, a specific description of the information, the identity of the recipients, the purpose, an expiration date or event, your right to revoke, and your signature. It must also carry a re-disclosure statement noting that even when records are shared with a covered entity for treatment, payment, or healthcare operations, they still cannot be used in civil, criminal, administrative, or legislative proceedings against you.²

Submitting the Form

Send the completed form to the provider’s health information management department, not to your doctor’s office directly, unless the practice is small enough that the same staff handles both. Most facilities accept submissions through a secure patient portal, by fax to a dedicated medical records line, or by certified mail. The portal is usually the fastest route for electronic records.

Under the HIPAA Privacy Rule, when you are directing your own records to yourself or to a third party on your behalf, the provider must act on the request within 30 calendar days. If more time is needed, the provider may take one additional 30-day extension, but only after notifying you in writing with the reason for the delay and the expected completion date.⁵ When a third party submits an authorization to obtain your records directly, the regulation does not set a hard deadline, though most facilities process these on a similar schedule.

Fees You May Be Charged

Providers may charge a reasonable, cost-based fee for copies. Under federal rules, the fee can include only four categories: labor for copying (once the records are already identified and ready), supplies for creating the copy (paper, toner, or a USB drive if you request portable media), postage if you want the copies mailed, and the cost of preparing a summary if you agree to one in advance.⁶ The provider cannot bill you for time spent searching for, retrieving, or reviewing records, even if state law would allow it.

What you actually pay varies. Some facilities charge a flat rate for electronic copies; others charge per page. State caps on per-page fees range from under a dollar to several dollars. Ask for the fee schedule before submitting the form. If you request an electronic copy sent by email or portal, the cost is typically lower, and the provider cannot require you to buy a USB drive or CD instead.

If You Change Your Mind

You can revoke any authorization you have signed, at any time, by submitting a written revocation to the provider. An oral request over the phone generally will not do it. Put it in writing, identify which authorization you are revoking (include the date you signed and the recipient’s name), and send it to the same health information management department that processed the original. Once the provider receives your revocation, it must stop any further disclosures under that authorization.¹

Revocation does not undo disclosures already made. If the provider sent records to the recipient before your revocation arrived, that disclosure was valid and cannot be clawed back. The provider may also continue relying on the original authorization to finish tasks already underway, such as completing a billing cycle that began while the authorization was active.

1
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
2
eCFR. 42 CFR 2.31 – Consent Requirements
3
U.S. Department of Health and Human Services. Personal Representatives
4
U.S. Department of Health and Human Services. Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information
5
U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI
6
U.S. Department of Health and Human Services. May a Covered Entity Charge Individuals a Fee for Providing the Individual With a Copy of Their PHI