The Verisma medical records request form is a HIPAA-compliant authorization that tells a hospital or health system to release your protected health information to whoever you name on it. Fill in the patient block, the recipient, the records and date range you want, a purpose, an expiration date, and your signature; attach proof of authority if you are signing for someone else; then submit it through the Verisma Request App, by mail, or by fax to the facility’s health information management (HIM) department. An incomplete form gets rejected and restarts a clock that already runs up to 30 days.
Gather This Before You Start
You’ll move faster if you have a few things in hand. The form asks for your medical record number, which appears on discharge papers, billing statements, or in your patient portal. Having the correct number keeps your file from getting confused with another patient’s when the facility stores records for thousands of people with similar names. You also need the full name and mailing address of whoever will receive the records: yourself, your attorney, a new physician, or an insurance company.
If you are filling out the form on behalf of another person, bring documentation that proves your legal authority. A healthcare power of attorney, a court-appointed guardianship order, or an executor appointment letter all qualify. The form requires a personal representative who signs to describe the basis for that authority, which is a federal requirement under HIPAA’s authorization rules.
Patient and Recipient Information
The top of the Verisma Generic Authorization Form collects the patient’s full legal name, date of birth, medical record number, mailing address, phone number, and either an email address or fax number for follow-up. It does not ask for a Social Security number. Check spelling and date formatting against your ID or hospital paperwork; even one transposed digit in the medical record number can hold up the request.
Below the patient block you name two parties: the provider or facility releasing the records, and the person or organization receiving them. Write out the recipient’s full name, phone number, and mailing address. If records are going to a law firm or an insurer, use the entity’s official name rather than an individual contact, so the release isn’t questioned later.
Which Records and What Dates
The form uses a checkbox grid covering the common record types: history and physical, discharge summary, operative reports, laboratory reports, radiology reports, EKG/EEG reports, pathology reports, progress notes, clinic records, billing records, ER records, therapy notes, consultation reports, cardiac testing, immunization records, and behavioral health or psychiatric care notes. There is also an “Entire Medical Record” option that covers everything within the dates you specify.
Fill in the dates of service as precisely as you can. A narrow window costs less and arrives faster than a blanket request for years of records. If you need everything up to today, the form treats the word “Present” as the date you sign.
A one-line field asks the purpose of the disclosure. If you are the patient requesting your own records, “at the request of the individual” is enough under federal rules. If you have a specific reason, such as a disability claim, a second opinion, or litigation, stating it helps the facility pull the right documents and pick the right delivery format.
Delivery Format
Three delivery methods appear on the form: paper, CD or DVD, and secure email. Not every facility supports every option, and the form notes that availability varies by location. Secure email is usually the fastest and cheapest path and may qualify for a reduced fee. Paper means waiting on physical mail and paying postage on top of copying charges.
Sensitive Records and Psychotherapy Notes
The form carries a notice that your authorization may cover sensitive categories unless you specifically restrict them. Those categories are psychological or psychiatric conditions, drug and alcohol abuse diagnosis or treatment, HIV/AIDS diagnosis or testing, sexually transmitted disease diagnosis or testing, and genetic testing. A blank line lets you list restrictions, such as “exclude all substance abuse treatment records.”
Two rules matter here. Psychotherapy notes, the private session-by-session notes a therapist keeps separate from the main chart, require their own standalone authorization; federal regulations prohibit combining a psychotherapy notes authorization with an authorization for any other type of health information. If you need those notes, plan on a second form. Many states also layer extra consent requirements on top of HIPAA for HIV/AIDS and substance abuse records, so expect the facility to flag those categories if your state’s rules are stricter.
Signature, Expiration, and Representative Authority
A valid HIPAA authorization needs your signature and the date you signed. That is the federal baseline; HIPAA does not require a witness or notarization. Some facilities add a witness line to their own version as an extra precaution, but leaving it blank does not invalidate the authorization under federal law. If a personal representative signs instead of the patient, the form must also describe the representative’s authority, for example “healthcare power of attorney dated March 2024.”
You must include an expiration date or an expiration event. This can be a calendar date, such as “December 31, 2026,” or a triggering event, such as “upon resolution of my personal injury claim.” A window of 90 days to one year is common and keeps the authorization from lingering. Leaving the expiration blank makes the form defective under HIPAA’s core-element requirements, and the facility can reject it on that basis.
How to Submit the Form
You have a few submission options depending on the facility. The Verisma Request App is an online portal that lets you upload a scanned or photographed copy of the signed authorization along with any supporting documents. The portal also handles tracking, payment, and digital delivery of the records. If you are not sure whether your facility uses the app, call the HIM department and ask for the direct link.
For paper submissions, mail the completed form and attachments to the address the HIM department provides. Use certified mail or another trackable method; you are sending documents that identify personal health details and you want proof of delivery. Fax works at many facilities, but confirm the fax number directly with the HIM office rather than trusting a number found online, since an outdated number could route your information to the wrong place.
What It Costs
Federal rules allow providers to charge a reasonable, cost-based fee covering only the labor for copying, supplies (paper or electronic media), and postage if you asked for mailing. Providers cannot charge you for time spent searching for or retrieving records from storage.
When you request an electronic copy of records already stored electronically, facilities may charge a flat fee of no more than $6.50 for the entire request, covering labor, supplies, and postage combined. This flat-fee alternative exists so facilities don’t have to calculate actual costs for every digital request. Not every facility uses it; some calculate actual costs, which may be lower or higher. Either way, the fee has to stay reasonable and cost-based.
Paper copies usually cost more. Per-page rates and search fees vary by state, with per-page charges generally falling between $0.25 and roughly $1.00, and flat search or retrieval fees ranging from around $5 to $25 where states allow them. You will typically receive an invoice before the records ship, and payment is expected before release.
How Long It Takes
A covered entity must act on your request within 30 days of receiving it. “Act” means either providing the records or sending a written denial explaining why. If the facility cannot meet the deadline, it may extend the window by one additional 30-day period, but only by sending you a written notice with the reason for the delay and the date by which it will respond. Only one extension is allowed per request.
Straightforward requests for recent electronic records often come back in a week or two. Older records stored off-site take longer. If you haven’t heard anything after three weeks, contact the HIM department or check your status through the Verisma Request App.
If Your Request Is Denied or Ignored
Facilities can deny access to certain categories of information without giving you a chance to appeal. Those unreviewable denials cover psychotherapy notes, information compiled in anticipation of a lawsuit, and, in correctional settings, records whose release would jeopardize safety or security. If your request is denied for a reason outside those categories, the facility must give you a written explanation and tell you how to request a review.
A provider that ignores your request or delays without justification may be violating federal access rules. The HHS Office for Civil Rights runs a Right of Access Initiative targeting providers who fail to hand over records on time and has resolved more than 25 enforcement actions under it, resulting in corrective action plans and financial settlements. If you believe a facility is stonewalling you, you can file a complaint with OCR through the HHS website.
Revoking or Narrowing an Authorization
You can revoke your authorization at any time by submitting a written revocation to the facility. The revocation takes effect when the facility receives it, but it cannot undo disclosures already made while the authorization was active. If you only want to narrow the scope, say you originally authorized your entire record but now only need lab results, submit a new, narrower authorization and revoke the old one in the same mailing.
The Verisma form reminds you of the right to revoke and notes one exception: if the authorization was a condition of obtaining insurance coverage, the insurer may retain the right to contest a claim or the policy even after revocation. For most patient-initiated requests, a short written statement identifying the original authorization and stating that you revoke it is all you need.