HIPAA release form for attorneys: getting a client’s medical records

Personal injury, workers’ compensation, disability, malpractice and estate lawyers all need medical records, and the provider cannot send them to the firm on the lawyer’s word. The firm needs the client’s signed authorization naming the firm as recipient, or another route the Privacy Rule allows.

The authorization is the usual tool. It must describe the records specifically, name who discloses and who receives them, state a purpose and an end date or event, and carry the client’s signature and date (45 CFR 164.508, Authorizations).

In a firm’s file, a records custodian is the person or department at the provider that keeps the records and answers the request. Writing one authorization per custodian keeps each request clean and easy to track.

The firm drafts it, usually a paralegal at intake, and the client signs. If the client cannot sign, a personal representative signs instead, such as a guardian, or the executor or administrator of a deceased client’s estate (45 CFR 164.502(g), Personal representatives). The firm then sends it to each provider with a cover note and logs what comes back.

1. At intake, list every provider the client saw for the injury and in the relevant years before it.
2. Prepare one authorization per provider from the template below, naming the firm and the responsible attorney.
3. Have the client sign, give the client a copy, and keep the original in the matter file.
4. Send each authorization with a cover note giving the matter reference and the format you want.
5. Log the send date, follow-ups, fees paid and the date the records arrive.

• One authorization listing many providers, so each custodian has to work out which lines apply to it.
• Psychotherapy notes requested on the general authorization instead of a separate form (45 CFR 164.508, Authorizations).
• An end date that falls before the case will likely close, forcing a second signature mid-case.
• Asking for “all records” when the claim only needs a date range, which slows the custodian down.
• A state statutory form needed for a malpractice notice, replaced by the firm’s own authorization.

Pick the route before drafting anything. Each one has its own signer and its own rules for the provider. A qualified protective order is a court order or a stipulation of the parties that bars using the records outside the litigation and requires their return or destruction at the end (45 CFR 164.512(e), Judicial and administrative proceedings).

• An access request comes with a deadline: the provider acts within 30 days, with one extension of up to 30 days (45 CFR 164.524, Right of access).
• Both limits come from a 2020 court ruling, Ciox Health v. Azar: the client can direct only electronic copies of an EHR to the firm, and the fee cap covers only the client’s own copies (HHS, Notice on the right of access after Ciox Health v. Azar (2020)).

Name the record types the case needs; custodians fill specific requests faster than vague ones. A personal injury file usually needs the items below.

• Medical records for the injury: office notes, emergency department records, operative reports, therapy notes.
• Itemized billing records, which prove damages separately from the chart.
• Imaging reports, and the images themselves on disc when an expert will read them.
• Pharmacy records and health plan claims for the same period.
• A records certification or business records affidavit when the records may be used at trial.

Substance use disorder records from a federally assisted program need a consent that meets 42 CFR 2.31 (42 CFR 2.31, Consent requirements for substance use disorder records). A consent for use in a lawsuit cannot be combined with a consent for any other purpose, and SUD counseling notes need their own (42 CFR 2.31, Consent requirements for substance use disorder records).

Federal rules let the end point be an event tied to the purpose, so “conclusion of the matter” works under HIPAA (45 CFR 164.508, Authorizations). Some states are stricter: California limits most authorizations to one year unless the signer asks for a specific later date (California Civil Code 56.11).

Keep the purpose short and true, for example “evaluation and prosecution of my claim against [party]”. When the client starts the request and gives no reason, “at the request of the individual” is enough (45 CFR 164.508, Authorizations).

Some states print their own form for litigation, and using anything else can cost time. Texas requires the authorization in Civil Practice and Remedies Code 74.052 with notice of a health care liability claim; the Texas page walks through it (Texas Civil Practice and Remedies Code 74.052).

Florida voids a medical negligence presuit notice that arrives without the authorization printed in section 766.1065 (Florida Statutes 766.1065). New York courts publish OCA Form 960 for litigation requests, explained on the New York page.

Signing at intake saves a second meeting. Collect the provider list, a photo ID to compare signatures, and the signed authorizations in one pass, then start the requests the same week.

A tracking log is a per-provider record of what was sent, when, what it cost and what came back. It shows at a glance which custodian needs a call. The law firm client intake checklist lists the other papers to gather.

• 45 CFR 164.508, Authorizations: Core elements and statements, the “at the request of the individual” purpose, event-based expiration, and the separate authorization for psychotherapy notes.
• 45 CFR 164.524, Right of access: A provider must act on an access request within 30 days, with one 30-day extension.
• HHS, Notice on the right of access after Ciox Health v. Azar (2020): Since January 23, 2020, the third-party directive covers only electronic copies of an electronic health record, and the access fee limit does not apply to requests to send records to a third party.
• 42 CFR 2.31, Consent requirements for substance use disorder records: A Part 2 consent must carry its own listed elements; SUD counseling notes need a separate consent; a consent for use in legal proceedings cannot be combined with any other consent.
• 45 CFR 164.512(e), Judicial and administrative proceedings: Disclosure in response to a court order, or to a subpoena or discovery request with satisfactory assurance of notice or a qualified protective order.
• 45 CFR 164.502(g), Personal representatives: An executor, administrator or other person with authority for a deceased individual’s estate is treated as the personal representative.
• California Civil Code 56.11: A California authorization lasts one year or less unless the signer requests a specific later date.
• Texas Civil Practice and Remedies Code 74.052: Notice of a health care liability claim must be accompanied by the statutory authorization form.
• Florida Statutes 766.1065: A medical negligence presuit notice is void if the statutory authorization does not accompany it.