HIPAA Authorization Form: Release of Medical Records
Complete guide to HIPAA authorization forms for releasing protected health information. Learn required elements, legal standards, and step-by-step instructions.
We load the current PDF and find the fillable fields automatically.
2
Fill & sign
Type your answers and add a legally binding e-signature in your browser.
3
Download or send
Download the finished PDF or email it to others to sign — free.
HIPAA Authorization Form: Release of Medical Records
What is a HIPAA Authorization Form?
A HIPAA authorization form is a legal document that gives a covered entity (healthcare provider, health plan, or healthcare clearinghouse) permission to use or disclose a patient's protected health information (PHI) for purposes beyond treatment, payment, or healthcare operations. Under the Health Insurance Portability and Accountability Act (HIPAA), patients have the right to control who sees their medical information.
When is a HIPAA Authorization Required?
An authorization is required when:
Secondary use requests: A patient wants their records sent to an insurance company, employer, or third party
Research participation: Medical records are needed for clinical trials or research studies
Legal matters: An attorney or court requests medical records
Family or friend access: A patient wants someone else to receive copies of their records
Life insurance: Records are needed for underwriting purposes
Workers' compensation: Occupational injury records are requested by insurers
An authorization is NOT required for:
Treatment, payment, or healthcare operations
Court-ordered disclosures (subpoenas)
Public health activities (disease reporting)
Law enforcement requests (limited circumstances)
Abuse/neglect reporting
Required Elements (45 CFR 164.508)
A valid HIPAA authorization must include:
1. Specific Description of Information to Release
Names of specific conditions or dates of service
Example: "All records related to orthopedic surgery performed on [date]"
Avoid vague language like "all medical records"
2. Recipient Information
Full name and address of the person/organization receiving the records
Be specific if multiple providers are involved
3. Purpose of Disclosure
State the specific reason for releasing information
Example: "For independent medical evaluation for workers' compensation claim"
Cannot be open-ended ("for any purpose")
4. Expiration Date or Event
Must specify when authorization expires
Can be date-specific (e.g., "December 31, 2026") or event-specific (e.g., "upon completion of legal proceedings")
If no expiration, authorization may still be valid but should have a reasonable timeframe
5. Patient Statement
Must include language stating the patient understands they can revoke the authorization
Example: "I understand I may revoke this authorization at any time by providing written notice to the healthcare provider"
6. Signature and Date
Patient's signature (or legal representative if patient lacks capacity)
Parent/guardian for minors (varies by state)
Date must be included
7. Authorization Validity
Statement that authorization is valid even if patient refuses treatment
Step-by-Step Guide to Completing a HIPAA Authorization
Step 1: Gather Information
Patient name, date of birth, and medical record number
Specific dates or conditions related to records needed
Complete contact information for recipient
Step 2: Choose the Right Type
Standard authorization: For routine record releases
Psychotherapy notes: Requires separate authorization
Substance abuse records: May require special authorization under 42 CFR Part 2
Step 3: Complete Required Fields
Fill in all required sections with specific, clear information:
Patient Name: [Full Legal Name]
Date of Birth: [MM/DD/YYYY]
Medical Record Number: [if applicable]
I authorize [Provider Name] to disclose the following health information:
- Specific records: [describe dates/conditions]
- Record type: [medical records, lab results, imaging, etc.]
To: [Recipient Name and Organization]
Address: [Complete Mailing Address]
For the purpose of: [State specific purpose]
This authorization will expire on: [Date or event]
Step 4: Review for Accuracy
Verify all names are spelled correctly
Confirm dates are accurate
Check that purpose is specific and appropriate
Ensure expiration date is reasonable
Step 5: Sign and Date
Patient must sign and date in original ink (or electronic signature if provider accepts)
Obtain witness signature if required by state law
Keep a copy for your records
Step 6: Submit
Provide to the healthcare provider maintaining the records
Keep a copy for your file
Allow 10-30 business days for processing
Common Scenarios
Scenario 1: Releasing Records to an Attorney
Purpose: Legal representation in personal injury claim
Required: Specific incident date, clear statement that purpose is legal proceedings
Tip: Attorney's office will often provide their own authorization form
Scenario 2: Medical Records for Employment
Purpose: Employer requires medical clearance
Required: Specific limitations on what employer can see (some providers may redact certain information)
Tip: Be specific about what information is necessary
Scenario 3: Records for Second Opinion
Purpose: Consultation with specialist
Recipient: New physician's name and address
Tip: May be able to use more informal authorization if new physician will request directly
Scenario 4: Insurance Company Disclosure
Purpose: Health insurance underwriting or claims processing
Required: Insurance company name and claim number
Tip: Often insurance companies will provide their own form
Patient Rights Under HIPAA
Right to Access
You can request copies of your medical records
Right to Amend
You can request corrections to inaccurate information
Right to Revoke
You can cancel an authorization at any time by written request
Revocation does not apply to disclosures already made
Right to Accounting of Disclosures
You can request a list of who has accessed your records
Right to Confidentiality
Your medical information must be kept private
Providers must use minimum necessary standard
What NOT to Do
Don't authorize blanket releases: Avoid "all information" authorizations without limiting to specific records
Don't use indefinite expiration dates: Set reasonable timeframes (typically 1-2 years)
Don't rely on verbal permission: Must be in writing per HIPAA
Don't share your authorization: Each disclosure requires separate authorization
Don't ignore your copies: Keep copies of all authorizations for your records
Processing Timeline
Timeline
Typical
Simple requests
5-10 business days
Standard requests
10-30 business days
Complex records
30-60 business days
Emergency requests
1-2 business days (call provider directly)
Fees
Healthcare providers can charge reasonable fees for copying records:
Typically $0.25-$1.00 per page for copies
Actual postage costs
Some providers waive fees for electronic copies
Request fee estimate before authorizing release
FAQ
Q: How long is a HIPAA authorization valid?
A: The authorization remains valid until the specified expiration date or event. You should update authorization every 1-2 years for ongoing needs.
Q: Can I revoke an authorization?
A: Yes. Write to the healthcare provider and request revocation. It takes effect immediately for future disclosures, but doesn't affect past ones.
Q: What if the provider won't sign my authorization?
A: They may require their own form or need clarification on the purpose. Ask what specific information they need modified.
Q: Who can sign for a minor's authorization?
A: Parents or legal guardians can sign. Some states allow minors to authorize their own treatment at certain ages.
Q: Can I authorize someone to pick up my records?
A: Yes, but the recipient may need to show ID and authorization. Include recipient's name and relationship on the form.
Q: Are electronic authorizations valid?
A: Yes, if the provider accepts electronic signatures. Use DocuSign, Adobe Sign, or platform provided by the healthcare provider.
Q: What's the difference between authorization and consent?
A: Consent is for treatment; authorization is for releasing information to third parties.