How to Fill Out an Authorization for Release of Information

To fill out an authorization for release of information correctly, complete six fields that appear on nearly every version of the form: a specific description of the records, the name of the person or organization holding them, the name of the person or organization receiving them, the purpose of the disclosure, an expiration date or event, and your signature with the date. Miss any one and the form is invalid, and the records department will send it back.

The form is short, but the details are unforgiving. Here is how to work through it section by section, plus the situations where a standard form is not enough.

The Six Required Fields Under HIPAA

Federal privacy law sets the minimum contents for a healthcare authorization. A valid HIPAA authorization must include all six of these:¹

A specific, meaningful description of the information. “All medical records” is too vague. “Office visit notes and lab results from January 2024 through June 2025” works.
The name or other identification of the person or organization authorized to release the records.
The name or other identification of the person or organization receiving them.
The purpose of the disclosure. If you are initiating the request and prefer not to explain, “at the request of the individual” is enough.
An expiration date or event, such as “expires December 31, 2026” or “upon resolution of the insurance claim.”
Your signature and the date. If a personal representative signs for you, the form must describe that person’s legal authority.

A valid HIPAA form must also tell you three things: your right to revoke in writing, whether the provider can refuse to treat you if you decline to sign, and the fact that once disclosed, the information may lose federal privacy protection. Most pre-printed forms already include this language. If you are using a generic template, check that these statements are somewhere on the page.

One relief: HIPAA does not require the form to be notarized or witnessed, and providers can accept it by fax or email.²

Filling Out the Form Section by Section

Most forms follow the same layout whether they come from a hospital, an insurer, or a government agency such as Social Security.

Your Personal Information

Enter your full legal name, date of birth, and any identifier tied to the records. For medical records, that is usually a patient ID or medical record number. For Social Security records, you need your full Social Security number.³ Include your current address and phone number so the releasing party can reach you with questions.

Who Releases and Who Receives

Two separate blanks. For the releasing party, write the full name of the provider, agency, or institution and their address. For the recipient, do the same. If the records are going to an attorney, include the attorney’s name, the firm name, and the mailing address. Leave no room for confusion about where the file should land.

Describing the Records

This is where most forms fail. Vague requests slow everything down, and some agencies reject them outright. The Social Security Administration explicitly refuses blanket requests for “any and all records” or “the entire file.”³ Instead, name the record types and set date ranges: “cardiology office visit notes from March 2024 to March 2025,” “benefit award letters from 2023,” “complete academic transcript.” If the form has checkboxes, use them, and fill in every date range the form asks for.

Stating the Purpose

One line is enough. Common examples: “for coordination of care,” “for disability determination,” “for insurance claim processing,” “for legal proceedings.” If you started the request yourself and simply want your records sent somewhere, “at the request of the individual” satisfies HIPAA.¹

Setting an Expiration

Every authorization needs an end point. Use a calendar date or an event tied to your situation. Do not leave the field blank. An authorization with no expiration is defective under HIPAA and the provider may refuse to act on it.¹ When in doubt, one year from the signature date is a common, practical choice.

Signing and Dating

Sign with your legal signature and write the current date. An unsigned form has no legal effect. If someone else is signing for you, keep reading.

Signing on Behalf of Someone Else

HIPAA recognizes “personal representatives” who can exercise the same rights as the person whose records are at issue. Note the relationship and legal basis on the form, and attach supporting paperwork if the recipient asks for it.

Children

For an unemancipated minor, a parent, legal guardian, or other person acting in a parental role usually qualifies as the personal representative. Two exceptions matter: if the minor lawfully consented to the treatment on their own, or if a court or other law authorizes confidentiality between the minor and provider, the parent may not have the right to access those specific records.⁴ State laws differ on which services minors can consent to independently.

Incapacitated Adults

If an adult cannot make healthcare decisions, the person with legal authority under applicable law, such as someone holding a healthcare power of attorney or a court-appointed guardian, acts as the personal representative.⁴ Attach a copy of the power of attorney or guardianship order.

Deceased Individuals

For someone who has died, the executor or administrator of the estate, or another person with legal authority under state law, can sign. Health information for deceased individuals stays protected under HIPAA for 50 years after death, so the authorization process still applies during that time.⁵ Letters testamentary or a similar court document should travel with the form.

When a Standard Form Is Not Enough

Some record categories carry extra protections that a general authorization does not cover.

Psychotherapy Notes

A therapist’s personal session notes, kept separate from the main chart, need their own standalone authorization. Federal rules prohibit combining an authorization for psychotherapy notes with an authorization for any other type of health information.¹ If you need both general treatment records and psychotherapy notes, expect to sign two forms.

Substance Use Disorder Treatment Records

Records from substance use disorder programs fall under 42 CFR Part 2, which is stricter than HIPAA. A valid Part 2 consent must include the patient’s name, a specific description of the information, the parties making and receiving the disclosure, the purpose, the patient’s right to revoke in writing, an expiration date or event, and the patient’s signature and date.⁶ Each disclosure must also carry a written notice warning the recipient that the records are federally protected and that a general release form does not authorize further sharing. If you are handed a generic form for these records, ask for one that specifically meets the Part 2 requirements.

Educational Records Use a Different Law

If you are releasing academic transcripts, disciplinary records, or other education records, the governing law is FERPA rather than HIPAA. The consent must specify which records may be disclosed, state the purpose, and identify the party or class of parties who will receive them. For students under 18, a parent signs. Once the student turns 18 or enrolls in a postsecondary institution, the right transfers to the student. Electronic signatures are acceptable if the system authenticates the signer, and the school must provide you a copy of the records disclosed if you ask.⁷

Getting the Form Where It Needs to Go

Once the form is filled out and signed, deliver it to the organization that holds the records. Options include hand delivery to the records department, mail with tracking, fax with a confirmation page, or upload through a secure patient portal if one is available. Whatever route you pick, confirm receipt. A form sitting in an unmonitored fax queue helps no one.

Why Forms Get Rejected

A provider must refuse to act on a defective authorization. Under HIPAA, the form is invalid if:¹

The expiration date has passed or the expiration event has already happened.
Any of the six core elements is missing or incomplete.
The provider knows you have submitted a written revocation.
The form improperly combines psychotherapy notes with other records, or violates the rule against conditioning treatment on signing.
The provider knows something material on the form is false.

These are not technicalities. Honoring a defective authorization exposes the provider to a HIPAA violation, so records departments review the forms carefully. When a form comes back, look at the core elements first. Most of the time the problem is a missing date range, a vague description of the records, or a blank expiration field.

Canceling an Authorization Later

You can revoke an authorization you already signed. The revocation must be in writing, and it takes effect when the organization holding the records actually receives it, not when you mail it.⁸ Send it the same way you would send the authorization itself, and keep proof of delivery.

Revocation does not undo disclosures that already occurred. If the provider released your records last week on a valid authorization, revoking today does not pull them back. The same limitation applies where the authorization was a condition of obtaining insurance coverage and the insurer has a legal right to contest a claim.⁸

1
eCFR. 45 CFR 164.508
2
HHS.gov. Authorizations
3
Social Security Administration. Consent for Release of Information – SSA-3288
4
eCFR. 45 CFR 164.502
5
HHS.gov. Health Information of Deceased Individuals
6
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
7
eCFR. 34 CFR 99.30
8
HHS.gov. Can an individual revoke his or her authorization?