HIPAA release form: free authorization template with every required element

In the regulation’s words, a HIPAA authorization is the patient’s written permission for a use or disclosure that the Privacy Rule does not already allow. People call it a HIPAA release form, a medical records release or an authorization to disclose. HHS describes it as a detailed document, usually for purposes other than treatment, payment or health care operations, or for sending records to a third party the patient picks (HHS, Difference between consent and authorization under the Privacy Rule).

There is no single official federal form. The rule lists what a valid authorization must contain instead: six core elements and three required statements, written in plain language (45 CFR 164.508, Uses and disclosures for which an authorization is required). Hospitals, law firms and insurers each print their own layout, and a few states publish their own version.

By contrast, consent under HIPAA is an optional permission a provider may collect for treatment, payment and operations, and it cannot stand in for an authorization when one is required (HHS, Difference between consent and authorization under the Privacy Rule).

The patient signs it, or a personal representative with legal authority to act for the patient. The form itself usually comes from whoever wants the records: a law firm, a life insurer, an employer’s leave administrator, or the hospital’s records department. The provider holding the records checks it against the federal elements before releasing anything.

1. Ask the records department of the provider or plan whether it requires its own form; many do.
2. If not, use the template below and fill in one form per provider that holds records.
3. Describe the records specifically, with a date range and record types, and name the recipient in full.
4. Pick an expiration date or event, sign, date, and keep a copy for yourself.
5. Send it to the records department with a cover note, or hand it to the person who asked for it.

• A form with the expiration line left blank: an incomplete core element makes the authorization invalid.
• Psychotherapy notes bundled into a general release instead of a separate authorization.
• A recipient described as “anyone who asks” rather than a named person, firm or class of persons.
• A representative’s signature with no description of the authority to sign, such as a guardianship order.
• Using an authorization when the patient only wants their own copy, which is a right-of-access request.

A provider that receives your form reads it against a fixed list. Each line below is a box on the template, with the paragraph of the regulation it answers (45 CFR 164.508, Uses and disclosures for which an authorization is required).

• You may add other lines, such as a phone number or a delivery preference, as long as they do not contradict the required elements (45 CFR 164.508, Uses and disclosures for which an authorization is required).
• When a provider asks you to sign, it must give you a copy of the signed authorization (45 CFR 164.508, Uses and disclosures for which an authorization is required).
• Conditioning is allowed in three cases: research-related treatment, a health plan’s enrollment or underwriting before you join, and an exam done only to create information for a third party, such as a life insurance exam (45 CFR 164.508, Uses and disclosures for which an authorization is required).

Many requests stall because someone asks for an authorization the rule never required. Five situations go without one.

• Treatment, payment and operations: a provider may disclose records for another provider’s treatment without your signature (45 CFR 164.506, Uses and disclosures to carry out treatment, payment, or health care operations).
• Your own copy: you file a right-of-access request, and the provider must act within 30 days, with one extension of up to 30 days (45 CFR 164.524, Access of individuals to protected health information).
• Sending an electronic copy of your electronic health record to someone else: a signed written request naming the person obliges the provider to send it (HHS, Notice on the right of access after Ciox Health v. Azar (2020)). Since a 2020 court ruling, paper or non-EHR records sent to a third party need an authorization, and the access fee limit does not apply to them (HHS, Notice on the right of access after Ciox Health v. Azar (2020)).
• Family and friends involved in your care: a provider may share what is directly relevant to their involvement, subject to your chance to object (45 CFR 164.510(b), Involvement in the individual’s care).
• Court cases: a court order, or a subpoena with the assurances the rule describes, can reach records without your authorization (45 CFR 164.512(e), Disclosures for judicial and administrative proceedings).

Psychotherapy notes are a therapist’s separate notes from counseling sessions, kept apart from the rest of the chart. Almost any use or disclosure of them needs an authorization, and that authorization may only be combined with another one for psychotherapy notes (45 CFR 164.508, Uses and disclosures for which an authorization is required).

So the template below excludes them by default. Write a second, separate form if the recipient truly needs them.

Other records, such as substance use treatment, HIV test results or genetic information, often carry extra state or federal consent rules. The template gives each its own initial line so the patient opts in line by line; check the rules of the state where the provider sits.

A federally assisted substance use disorder program may require its own consent under 42 CFR Part 2, and that consent has its own list of elements (42 CFR 2.31, Consent requirements for substance use disorder records). SUD counseling notes need a separate consent, and a consent for use in a lawsuit cannot be combined with one for any other purpose (42 CFR 2.31, Consent requirements for substance use disorder records).

Federal rules set no maximum length. You choose a date or an event, as long as it relates to you or to the purpose (45 CFR 164.508, Uses and disclosures for which an authorization is required). Some states cap it; California, for example, limits most authorizations to a year unless the signer asks for a later date (California Civil Code 56.11).

You can revoke at any time in writing, with two exceptions (45 CFR 164.508, Uses and disclosures for which an authorization is required). Revoking does not undo what the provider already did in reliance on the form. And if you signed to get insurance coverage, other law may still let the insurer contest a claim or the policy (45 CFR 164.508, Uses and disclosures for which an authorization is required).

1. Check the expiration: a passed date or a known expiration event voids the form (45 CFR 164.508, Uses and disclosures for which an authorization is required).
2. Check that every core element is filled in; a blank one voids it (45 CFR 164.508, Uses and disclosures for which an authorization is required).
3. Check that you have not received a revocation (45 CFR 164.508, Uses and disclosures for which an authorization is required).
4. Check that nothing on it is known to be false (45 CFR 164.508, Uses and disclosures for which an authorization is required).

A personal representative is a person the law lets act for the patient in health care matters, and the provider treats them as the patient for these forms (45 CFR 164.502(g), Personal representatives). Examples include a parent of a minor, a court-appointed guardian, or a health care power of attorney.

For a patient who has died, an executor or administrator of the estate fills this role (45 CFR 164.502(g), Personal representatives). The representative signs, then describes their authority on the form, and attaches the paper that proves it (45 CFR 164.508, Uses and disclosures for which an authorization is required).

A law firm, insurer or benefits team saves weeks by sending a form that passes the first read. Send one authorization per provider, ask the client for a photo ID so the signature can be matched, and list the exact records you need.

State law can add its own layer. Read the New York and California versions before sending to providers there, and the attorney version for litigation.

• 45 CFR 164.508, Uses and disclosures for which an authorization is required: Lists the core elements and required statements, the defects that void an authorization, the psychotherapy notes rule, revocation in writing and the copy to the individual.
• 45 CFR 164.524, Access of individuals to protected health information: A provider must act on an access request within 30 days, with one extension of up to 30 days.
• HHS, Notice on the right of access after Ciox Health v. Azar (2020): A January 23, 2020 court order limited the third-party directive to electronic copies of an electronic health record, and the access fee limit does not apply to requests to send records to a third party.
• 42 CFR 2.31, Consent requirements for substance use disorder records: A Part 2 consent must carry its own listed elements; SUD counseling notes need a separate consent; a consent for use in legal proceedings cannot be combined with any other consent.
• 45 CFR 164.506, Uses and disclosures to carry out treatment, payment, or health care operations: A covered entity may disclose protected health information for the treatment activities of a health care provider.
• 45 CFR 164.510(b), Involvement in the individual’s care: A covered entity may share information directly relevant to a family member’s or friend’s involvement in care, subject to the individual’s opportunity to object.
• 45 CFR 164.512(e), Disclosures for judicial and administrative proceedings: A covered entity may disclose in response to a court order, or to a subpoena with satisfactory assurances of notice or a qualified protective order.
• 45 CFR 164.502(g), Personal representatives: A person with legal authority to make health care decisions, or an executor or administrator for a deceased individual, is treated as the individual.
• HHS, Difference between consent and authorization under the Privacy Rule: An authorization is a detailed document required for disclosures not otherwise allowed; voluntary consent for treatment, payment and operations is not sufficient where an authorization is required.
• California Civil Code 56.11: A California authorization must limit its duration to one year or less unless the signer requests a later specific date, with exceptions for clinical trials and research.