# HIPAA release form for attorneys: getting a client’s medical records

[Home](/) / [Document guides](/documents) / [HIPAA release form](/documents/hipaa-release-form) / For attorneys

By [Arthur Teboul](/authors/arthur-teboul), Founder, DokuTrak. Published 2026-11-06, updated 2026-11-06.

> **In brief:** A HIPAA release form for an attorney is an authorization the client signs so a provider can send medical and billing records to the law firm named on it. It needs the federal core elements, and psychotherapy notes need a separate one ([45 CFR 164.508, Authorizations](https://www.law.cornell.edu/cfr/text/45/164.508)); a subpoena or the client’s own access request are the other routes ([45 CFR 164.512(e), Judicial and administrative proceedings](https://www.law.cornell.edu/cfr/text/45/164.512)).

## What is a HIPAA release form for an attorney?

Personal injury, workers’ compensation, disability, malpractice and estate lawyers all need medical records, and the provider cannot send them to the firm on the lawyer’s word. The firm needs the client’s signed authorization naming the firm as recipient, or another route the Privacy Rule allows.

The authorization is the usual tool. It must describe the records specifically, name who discloses and who receives them, state a purpose and an end date or event, and carry the client’s signature and date ([45 CFR 164.508, Authorizations](https://www.law.cornell.edu/cfr/text/45/164.508)).

In a firm’s file, a **records custodian** is the person or department at the provider that keeps the records and answers the request. Writing one authorization per custodian keeps each request clean and easy to track.

## Who sends it, and when

The firm drafts it, usually a paralegal at intake, and the client signs. If the client cannot sign, a personal representative signs instead, such as a guardian, or the executor or administrator of a deceased client’s estate ([45 CFR 164.502(g), Personal representatives](https://www.law.cornell.edu/cfr/text/45/164.502)). The firm then sends it to each provider with a cover note and logs what comes back.

## Where to get a HIPAA release form for an attorney

1. At intake, list every provider the client saw for the injury and in the relevant years before it.
2. Prepare one authorization per provider from the template below, naming the firm and the responsible attorney.
3. Have the client sign, give the client a copy, and keep the original in the matter file.
4. Send each authorization with a cover note giving the matter reference and the format you want.
5. Log the send date, follow-ups, fees paid and the date the records arrive.

## Wrong files people send instead

- One authorization listing many providers, so each custodian has to work out which lines apply to it.
- Psychotherapy notes requested on the general authorization instead of a separate form ([45 CFR 164.508, Authorizations](https://www.law.cornell.edu/cfr/text/45/164.508)).
- An end date that falls before the case will likely close, forcing a second signature mid-case.
- Asking for “all records” when the claim only needs a date range, which slows the custodian down.
- A state statutory form needed for a malpractice notice, replaced by the firm’s own authorization.

## Three routes to a client’s records

Pick the route before drafting anything. Each one has its own signer and its own rules for the provider. A **qualified protective order** is a court order or a stipulation of the parties that bars using the records outside the litigation and requires their return or destruction at the end ([45 CFR 164.512(e), Judicial and administrative proceedings](https://www.law.cornell.edu/cfr/text/45/164.512)).

- An access request comes with a deadline: the provider acts within 30 days, with one extension of up to 30 days ([45 CFR 164.524, Right of access](https://www.law.cornell.edu/cfr/text/45/164.524)).
- Both limits come from a 2020 court ruling, Ciox Health v. Azar: the client can direct only electronic copies of an EHR to the firm, and the fee cap covers only the client’s own copies ([HHS, Notice on the right of access after Ciox Health v. Azar (2020)](https://www.hhs.gov/hipaa/court-order-right-of-access/index.html)).

| Route | Who signs | What the rule says |
| --- | --- | --- |
| Authorization naming the firm | Client or personal representative | Must carry the core elements and required statements ([45 CFR 164.508, Authorizations](https://www.law.cornell.edu/cfr/text/45/164.508)) |
| Client’s access request sent to the firm | Client, in writing | Provider must send an electronic copy of records held in an EHR to the person the client names in a signed written request; paper and non-EHR records need an authorization instead ([45 CFR 164.524, Right of access](https://www.law.cornell.edu/cfr/text/45/164.524)) ([HHS, Notice on the right of access after Ciox Health v. Azar (2020)](https://www.hhs.gov/hipaa/court-order-right-of-access/index.html)) |
| Court order | Court or tribunal | Provider discloses only what the order expressly authorizes ([45 CFR 164.512(e), Judicial and administrative proceedings](https://www.law.cornell.edu/cfr/text/45/164.512)) |
| Subpoena or discovery request without an order | Requesting party | Needs satisfactory assurance of notice to the patient or of efforts to secure a qualified protective order ([45 CFR 164.512(e), Judicial and administrative proceedings](https://www.law.cornell.edu/cfr/text/45/164.512)) |

## What to ask the provider for

Name the record types the case needs; custodians fill specific requests faster than vague ones. A personal injury file usually needs the items below.

- Medical records for the injury: office notes, emergency department records, operative reports, therapy notes.
- Itemized billing records, which prove damages separately from the chart.
- Imaging reports, and the images themselves on disc when an expert will read them.
- Pharmacy records and health plan claims for the same period.
- A records certification or business records affidavit when the records may be used at trial.

## Setting the end date and scope

Substance use disorder records from a federally assisted program need a consent that meets 42 CFR 2.31 ([42 CFR 2.31, Consent requirements for substance use disorder records](https://www.law.cornell.edu/cfr/text/42/2.31)). A consent for use in a lawsuit cannot be combined with a consent for any other purpose, and SUD counseling notes need their own ([42 CFR 2.31, Consent requirements for substance use disorder records](https://www.law.cornell.edu/cfr/text/42/2.31)).

Federal rules let the end point be an event tied to the purpose, so “conclusion of the matter” works under HIPAA ([45 CFR 164.508, Authorizations](https://www.law.cornell.edu/cfr/text/45/164.508)). Some states are stricter: California limits most authorizations to one year unless the signer asks for a specific later date ([California Civil Code 56.11](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.11)).

Keep the purpose short and true, for example “evaluation and prosecution of my claim against [party]”. When the client starts the request and gives no reason, “at the request of the individual” is enough ([45 CFR 164.508, Authorizations](https://www.law.cornell.edu/cfr/text/45/164.508)).

## State forms that replace the firm’s template

Some states print their own form for litigation, and using anything else can cost time. Texas requires the authorization in Civil Practice and Remedies Code 74.052 with notice of a health care liability claim; the [Texas page](/documents/hipaa-release-form/texas) walks through it ([Texas Civil Practice and Remedies Code 74.052](https://statutes.capitol.texas.gov/Docs/CP/htm/CP.74.htm)).

Florida voids a medical negligence presuit notice that arrives without the authorization printed in section 766.1065 ([Florida Statutes 766.1065](https://www.flsenate.gov/Laws/Statutes/2026/766.1065)). New York courts publish OCA Form 960 for litigation requests, explained on the [New York page](/documents/hipaa-release-form/new-york).

## Building the release into client intake

Signing at intake saves a second meeting. Collect the provider list, a photo ID to compare signatures, and the signed authorizations in one pass, then start the requests the same week.

A **tracking log** is a per-provider record of what was sent, when, what it cost and what came back. It shows at a glance which custodian needs a call. The [law firm client intake checklist](/tools/document-checklist/law-firm-client-intake) lists the other papers to gather.

## The template: Client authorization to release records to a law firm

**Not advice.** This page is general information, not tax, legal or HR advice. Rules change: check the cited source and ask your own professional before you rely on it. Last reviewed October 25, 2026.

Prepare one per provider at intake. The client signs and keeps a copy; the firm sends the original with its cover note. Check the state rules first: Texas, Florida and New York have their own litigation forms. This template follows the federal elements; state law and the provider’s own form may add requirements, and it is not legal advice.

```text
AUTHORIZATION TO RELEASE HEALTH AND BILLING RECORDS TO COUNSEL
Client (patient): [Full name] | Date of birth: [MM/DD/YYYY] | Address: [ ]
Provider holding the records: [Provider name, records department address, phone or fax]
Law firm receiving the records: [Firm name], attention [Responsible attorney], [address], [phone], matter [reference]

Records to release
All of the following for dates of service from [start date] through the present: medical records, emergency and hospital records, operative and therapy notes, itemized billing statements, imaging reports, and pharmacy records. This release does not include psychotherapy notes.

Imaging (optional)
Please also provide the images themselves for [study and date] on disc or as an electronic file.

Specially protected records (optional)
I include only what I initial: [Initials] substance use disorder treatment [Initials] HIV test results [Initials] mental health records [Initials] genetic information. SUD counseling notes and psychotherapy notes are not included. Records of a federally assisted substance use disorder program need a separate consent that meets 42 CFR 2.31.

Purpose
The firm will use these records to evaluate and pursue my claim arising from [incident and date], and for no other purpose.

Duration
This authorization remains valid until [date] or the conclusion of this matter, whichever comes first.

Revocation
I may revoke this authorization by written notice to the provider at the address above, effective except for records it released in reliance on it before receiving my notice, and except where I signed it to obtain insurance coverage and other law gives the insurer the right to contest a claim under the policy or the policy itself.

Acknowledgments
My care, payment, plan enrollment and benefits eligibility are not conditioned on this signature. Records the firm receives could be redisclosed and might lose federal privacy protection. I have received a copy of this authorization.

Certification (optional)
Please include a signed records certification or affidavit of the custodian.

Client signature: ____________________  Date: [MM/DD/YYYY]
If signed by a representative: [Name], as [guardian / executor / administrator / attorney-in-fact], proof of authority attached
Firm use only: sent [date] | follow-up [date] | received [date] | pages [ ] | fee [ ]
```

Download: [Word](https://dokutrak.com/downloads/pseo-v2/f6-document-guides/hipaa-release-form/for-attorneys.docx) · [PDF](https://dokutrak.com/downloads/pseo-v2/f6-document-guides/hipaa-release-form/for-attorneys.pdf)

## Questions people ask

### Can a lawyer get medical records without the client’s consent?

Yes, in litigation, through a court order or a subpoena with the assurances the Privacy Rule describes, such as notice to the patient or a qualified protective order ([45 CFR 164.512(e), Judicial and administrative proceedings](https://www.law.cornell.edu/cfr/text/45/164.512)). Otherwise the client signs an authorization.

### Should the firm use an authorization or the client’s access request?

An access request directing copies to the firm works for electronic health records only, and carries a federal deadline of 30 days with one extension ([45 CFR 164.524, Right of access](https://www.law.cornell.edu/cfr/text/45/164.524)) ([HHS, Notice on the right of access after Ciox Health v. Azar (2020)](https://www.hhs.gov/hipaa/court-order-right-of-access/index.html)). The access fee limit does not apply to it ([HHS, Notice on the right of access after Ciox Health v. Azar (2020)](https://www.hhs.gov/hipaa/court-order-right-of-access/index.html)). An authorization has no federal deadline but covers paper records and broader purposes.

### Who signs for a deceased client?

The executor or administrator of the estate, or another person with authority under applicable law, who is treated as the client’s personal representative ([45 CFR 164.502(g), Personal representatives](https://www.law.cornell.edu/cfr/text/45/164.502)). Attach the letters or court order that shows the authority.

## Sources

- [45 CFR 164.508, Authorizations](https://www.law.cornell.edu/cfr/text/45/164.508): Core elements and statements, the “at the request of the individual” purpose, event-based expiration, and the separate authorization for psychotherapy notes.
- [45 CFR 164.524, Right of access](https://www.law.cornell.edu/cfr/text/45/164.524): A provider must act on an access request within 30 days, with one 30-day extension.
- [HHS, Notice on the right of access after Ciox Health v. Azar (2020)](https://www.hhs.gov/hipaa/court-order-right-of-access/index.html): Since January 23, 2020, the third-party directive covers only electronic copies of an electronic health record, and the access fee limit does not apply to requests to send records to a third party.
- [42 CFR 2.31, Consent requirements for substance use disorder records](https://www.law.cornell.edu/cfr/text/42/2.31): A Part 2 consent must carry its own listed elements; SUD counseling notes need a separate consent; a consent for use in legal proceedings cannot be combined with any other consent.
- [45 CFR 164.512(e), Judicial and administrative proceedings](https://www.law.cornell.edu/cfr/text/45/164.512): Disclosure in response to a court order, or to a subpoena or discovery request with satisfactory assurance of notice or a qualified protective order.
- [45 CFR 164.502(g), Personal representatives](https://www.law.cornell.edu/cfr/text/45/164.502): An executor, administrator or other person with authority for a deceased individual’s estate is treated as the personal representative.
- [California Civil Code 56.11](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.11): A California authorization lasts one year or less unless the signer requests a specific later date.
- [Texas Civil Practice and Remedies Code 74.052](https://statutes.capitol.texas.gov/Docs/CP/htm/CP.74.htm): Notice of a health care liability claim must be accompanied by the statutory authorization form.
- [Florida Statutes 766.1065](https://www.flsenate.gov/Laws/Statutes/2026/766.1065): A medical negligence presuit notice is void if the statutory authorization does not accompany it.

## More on this topic

- [HIPAA release form](/documents/hipaa-release-form)
- [California HIPAA release form](/documents/hipaa-release-form/california)
- [Florida HIPAA release form](/documents/hipaa-release-form/florida)
- [Law firm client intake checklist](/tools/document-checklist/law-firm-client-intake)
- [Contingency Fee Engagement Letter Template (Rule 1.5(c))](/templates/engagement-letters/contingency-fee)

## About the author

Arthur Teboul (Founder, DokuTrak) is building DokuTrak after watching professionals lose hours chasing clients for documents over email. [Arthur Teboul](/authors/arthur-teboul).

How this page was made (methodology): it is built from the primary sources listed under Sources, and every rule and figure on it links to the source it comes from. Last updated October 25, 2026. Spotted an error or a rule that changed? [Contact us](/contact).