Under HIPAA, your medical records cannot follow you anywhere, to a new doctor, your attorney, your insurer, or even your spouse, without your written authorization. Providers are strict about it because the rule has teeth: a disclosure without a valid authorization is a federal privacy violation. The medical records release form is that authorization, and HIPAA prescribes exactly what it must contain to be valid.
This form includes every element the regulation requires: a specific description of the records, the releasing provider, the named recipient, the purpose, an expiration date, and your revocation and non-conditioning rights. It also handles specially protected categories, mental health, substance use, HIV, and genetic information, which need an express choice.
What makes a release HIPAA-valid
The HIPAA Privacy Rule (45 CFR 164.508) lists core elements and required statements for every authorization. Miss one and the provider must reject the form. The core elements: a meaningful description of the information to be disclosed; who may disclose it; who receives it; the purpose; an expiration date or event; and the patient's dated signature (or a personal representative's, with their authority stated). The required statements: the right to revoke in writing, the fact that treatment cannot be conditioned on signing, and the warning that the recipient may redisclose the information beyond HIPAA's reach.
- Be specific about scope. "Complete record" is valid, but a date range or named records gets processed faster and discloses less.
- Name the recipient precisely. Records go only where the form says; a wrong suite number can bounce a release for weeks.
- Pick a sensible expiration. Long enough to cover follow-ups (90 days to one year is common practice), short enough that a forgotten form is not an open tap.
Specially protected records: mental health, substance use, HIV
Some categories carry protection beyond ordinary HIPAA. Psychotherapy notes, the therapist's own session notes kept separate from the chart, always require their own standalone authorization and are excluded from a general release. Substance use disorder treatment records from federally assisted programs are governed by 42 CFR Part 2, which requires specific consent language. Many states add their own consent rules for HIV/STD status, mental health, and genetic information. This form makes the inclusion or exclusion of these categories an explicit choice, and providers holding Part 2 or psychotherapy records may still ask you to complete their own program-specific form, which is normal and correct.
Redisclosure is the real privacy risk
Once records reach the recipient, HIPAA generally stops protecting them: an attorney, employer, or family member who receives your records may share them further without violating HIPAA. Release the minimum that serves the purpose, especially for sensitive categories.
Frequently asked questions
Who can sign a release for someone else?
A personal representative: the parent or guardian of a minor (with exceptions for care minors may consent to themselves), a court-appointed guardian, an agent under a healthcare power of attorney acting within its scope, or the executor of a deceased patient's estate. Attach proof of authority, since providers must verify it.
How long does the provider have to send the records?
For your own access requests, HIPAA requires action within 30 days, extendable once by 30 days with written notice. For third-party authorizations there is no fixed federal deadline, though many states impose one; in practice, releases to other providers move in days to a few weeks.
Can the provider charge for copies?
Yes, but only a reasonable, cost-based fee for your own records: labor for copying, supplies, and postage. Flat per-page rates set by state law apply mainly to third-party requests. Electronic copies of electronic records are typically the cheapest and fastest option to request.
Can I revoke the authorization after signing?
Yes, at any time, in writing to the provider holding the records. Revocation stops future disclosures but cannot undo what was already sent in reliance on the form. This form states the revocation right expressly, as HIPAA requires.
Does this form cover mental health and substance use records?
Only if you choose to include them, and with limits: psychotherapy notes always need their own separate authorization, and substance use treatment records under 42 CFR Part 2 require specific consent that the treating program may want on its own form. The form's sensitive-information option handles the choice honestly.