What Is a Medical Records Release Form?
A medical records release form — often called a HIPAA authorization, an authorization for use and disclosure of protected health information, or simply a records release — is a legal document that gives a healthcare provider permission to disclose your medical information to a person or organization you specify. Without a valid authorization, the federal HIPAA Privacy Rule prohibits providers from sharing your records for almost any purpose other than treatment, payment, and healthcare operations. The form is the gatekeeper that turns your private records into something another doctor, an insurance company, an attorney, or a family member can lawfully receive.
HIPAA — the Health Insurance Portability and Accountability Act of 1996 — is the federal statute that creates a national baseline of privacy protection for patients. Its Privacy Rule (45 CFR Part 164) applies to nearly every healthcare provider, health plan, and healthcare clearinghouse in the United States, plus their business associates. The Privacy Rule lists the categories of disclosures that may be made without authorization (treatment, payment, healthcare operations, public health reporting, law enforcement in limited circumstances, and a few others) and requires a written authorization for everything else. A valid authorization must satisfy the specific elements set out in 45 CFR 164.508(c), and providers who release records without a valid authorization face civil penalties from the HHS Office for Civil Rights.
The release form serves multiple practical purposes. When you switch primary care doctors, the new doctor needs your complete medical history to provide informed care. When you file an insurance claim, the insurer needs supporting medical documentation. When you bring a personal injury lawsuit, your attorney needs your medical records as evidence. When you apply for disability benefits, the Social Security Administration or a private disability insurer needs detailed documentation of your condition. When a spouse, adult child, or caregiver needs access to your records to coordinate your care, they need authorization. Each of these situations is a separate disclosure that requires a separate (or carefully drafted broad) authorization.
Mental health records, substance use disorder records, HIV and AIDS information, genetic information, and reproductive health records receive heightened protection under federal and state law. Psychotherapy notes are subject to a special HIPAA rule that requires a separate authorization and prohibits combining them with the release of other records. Substance use disorder records covered by 42 CFR Part 2 require an authorization with even more specific language than standard HIPAA requires. Authorizations for these categories should be drafted carefully or executed as stand-alone documents to ensure they meet the heightened requirements and are accepted by the disclosing provider.
Whether you are switching doctors, requesting your own chart, sharing records with a family caregiver, or supporting a legal or insurance matter, our attorney-reviewed templates produce a HIPAA-compliant authorization that any provider in any state will accept. Each template includes the required statutory elements, optional language for mental health and substance abuse records, electronic format options, and a clean revocation procedure.
HIPAA Compliant
Satisfies every required element of 45 CFR 164.508(c)
Electronic or Paper
Receive records via portal, email, USB drive, or printed copy
Universally Accepted
Recognized by every covered entity in all 50 states
Records Release Form Preview
Below is a visual preview of the sections in a complete HIPAA authorization. Your finished document will be fully formatted, professionally styled, and customized for your situation, the records you want released, and your state.
Authorization for Release of Medical Records
HIPAA-Compliant Authorization (45 CFR 164.508)
Section 1: Patient Information
Section 2: Disclosing Provider
Section 3: Recipient
Section 4: Records to Disclose
Section 5: Purpose & Format
Section 6: Signature
Patient Signature & Date
When You Need a Records Release
A medical records release is appropriate any time you want a healthcare provider to share your protected health information with someone else. The most common scenarios are below.
Switching Providers
Transfer your complete medical history to a new doctor or specialist
Second Opinion
Send relevant records to another provider for an independent review
Insurance Claim
Authorize disclosure of records to a health insurer for benefits or appeals
Disability or Workers Comp
Provide records to government agencies and disability evaluators
Personal Injury Lawsuit
Release records to your attorney or opposing counsel during litigation
Family Member Access
Authorize a spouse, child, or designated relative to receive your records
Mental Health Records
Special-handling release for psychiatric, therapy, and substance-use records
Personal Copy
Request your own complete medical chart from a current or former provider
Records Release vs Other Documents
A medical records release is one of several documents that govern access to your health information. Understanding the differences ensures you use the right tool for the right situation.
Records Release vs HIPAA Authorization
A medical records release is a HIPAA authorization. The names are used interchangeably, and any release form that complies with 45 CFR 164.508 is technically a HIPAA authorization. Some practices use the term medical records release for a request to receive your own records and HIPAA authorization for a release to a third party, but the underlying legal instrument is the same.
Records Release vs Medical Power of Attorney
Records Release
- - Authorizes disclosure of records
- - One-time or limited-period use
- - No decision-making authority
Medical POA
- - Authorizes treatment decisions
- - Activates upon incapacity
- - Includes record access plus authority to act
Use both if needed: A medical POA covers decision-making during incapacity; a records release covers ongoing day-to-day record sharing for caregivers and family members.
Records Release vs Psychotherapy Notes Authorization
Psychotherapy notes — separately maintained notes from a counseling session — receive special protection under HIPAA. A standard records release does not cover psychotherapy notes; you need a separate authorization for those, and it cannot be combined with the release of any other records. Substance use disorder records governed by 42 CFR Part 2 also require special-purpose authorizations.
How to Create a Records Release: Step-by-Step
A HIPAA-compliant authorization is straightforward, but every required element matters. Follow the steps below to produce a release that any covered entity will accept on the first try.
Identify the patient
Begin with your full legal name, date of birth, current address, phone number, and email address. If you are signing on behalf of someone else (a minor child, an incapacitated adult, or a deceased patient), identify that person and your legal authority to sign (parent, guardian, healthcare power of attorney, executor, etc.). Attach a copy of the supporting document if your authority is not obvious from the relationship.
Identify the disclosing provider
Name the specific provider that holds the records you want released. Include the practice name, the address where records are maintained, the phone number for the medical records department, and the fax number or email if known. If the records are held by a hospital, list both the hospital name and the relevant department or floor. Each provider you want to release records from needs its own separate authorization — you cannot use one form to cover multiple unrelated providers.
Identify the recipient
Name the specific person or entity that will receive the records. For another provider, list the doctor's name, practice name, and address. For an attorney, list the attorney's name, firm, and address. For an insurance company, list the carrier name, claims department, and any reference number for the matter. For yourself, list your own name and the address where you want the records sent. Vague descriptions (any treating physician) are not HIPAA-compliant and will be rejected.
Describe the records to be released
Be specific. You can request your complete chart, all records from a specific date range, all records related to a specific condition, or only certain categories (lab results, imaging, medications). Specific descriptions are easier for providers to fulfill, faster to process, and reduce the risk of unnecessary disclosure. If you have sensitive records (mental health, substance abuse, HIV) that you do not want included, exclude them explicitly.
State the purpose of the disclosure
HIPAA requires the authorization to describe each purpose of the requested disclosure. Common purposes include continuity of care, second opinion, insurance claim, disability evaluation, legal proceedings, personal use, and research participation. The statement at the request of the individual is also acceptable when you are requesting records for any reason of your own. Be honest about the purpose — providers may decline to release records for an inappropriate stated purpose.
Choose the format
Specify how you want the records delivered. Options include electronic transmission to your patient portal, secure email, USB drive, paper copies by mail, paper copies for in-person pickup, fax, or direct transmission to another provider via a health information exchange. If the records are maintained electronically and you request them in electronic format, federal law requires the provider to honor that request if it is readily producible.
Set an expiration date
HIPAA requires every authorization to include an expiration date or expiration event. Use a specific date (often 6 months or 1 year from signing) or a specific event (the conclusion of my disability claim, the end of my lawsuit). Open-ended authorizations (no expiration) are not permitted under HIPAA. If you need ongoing record sharing for a chronic condition, plan to renew the authorization periodically.
Include the required statements
HIPAA mandates several specific statements that must appear in every authorization: a statement of your right to revoke and how to revoke; a statement that disclosure to a non-covered-entity recipient may result in further redisclosure; and a statement that treatment, payment, enrollment, and eligibility for benefits cannot be conditioned on signing the authorization (with limited exceptions). Our templates include all required statements automatically.
Sign and date the form
The patient (or authorized representative) must sign and date the form. Notarization is not required by HIPAA but is sometimes requested by providers for sensitive records or after-death disclosures. If a representative is signing, the signature line should include the representative's name, relationship to the patient, and a brief description of the legal authority to sign.
Submit and follow up
Send the completed form to the provider's medical records department. Most providers accept submissions by mail, fax, secure email, or in-person delivery; some have online portals. Federal law requires a response within 30 days, with one possible 30-day extension. If you have not heard back within 30 days, follow up in writing. If a provider unjustly denies access, you can file a complaint with the HHS Office for Civil Rights.
Key Components of a Records Release
HIPAA requires specific elements in every authorization. The components below are the ones every release form must contain to be legally valid.
Patient Identification
Full legal name, date of birth, address, and contact information.
Disclosing Provider
The specific healthcare provider that holds the records.
Recipient
The specific person or entity that will receive the records.
Records Description
A specific, meaningful description of the records to be disclosed.
Purpose Statement
The reason for the disclosure, or the at the request of the individual statement.
Expiration
A specific date or event when the authorization expires.
Format Preference
Electronic, paper, fax, portal, or direct transmission.
Revocation Rights
A statement of your right to revoke in writing.
Redisclosure Notice
A warning that the recipient may further redisclose the information.
Sensitive Records Carve-Out
Optional handling of mental health, substance abuse, HIV, and genetic records.
The HIPAA Privacy Rule
The HIPAA Privacy Rule is the federal regulation that governs how your protected health information may be used and disclosed. Below are the key provisions every patient should understand.
Covered Entities
HIPAA applies to health plans, healthcare clearinghouses, and most healthcare providers (including doctors, hospitals, clinics, dentists, pharmacies, nursing homes, and home health agencies). It also applies to business associates who handle PHI on behalf of a covered entity. Non-covered entities such as employers, schools, and many fitness apps are not directly governed by HIPAA.
Protected Health Information
PHI includes any health information that identifies you or could reasonably be used to identify you, including your name, dates of service, addresses, phone numbers, email addresses, social security number, medical record number, and the substance of your medical care.
Right of Access
Under 45 CFR 164.524, you have the right to inspect and obtain a copy of your own PHI. Providers must respond within 30 days, may charge only a reasonable cost-based fee, and must provide records in your requested format if it is readily producible.
Authorization Requirements
Under 45 CFR 164.508, disclosures for purposes other than treatment, payment, and healthcare operations require a written authorization with specific required elements. Our templates include every element required by the regulation.
Special Categories
Psychotherapy notes, substance use disorder records (42 CFR Part 2), HIV/AIDS records, and genetic information receive heightened protection and require special-handling authorizations.
Legal Requirements
Every HIPAA-compliant records release must satisfy the following requirements set out in 45 CFR 164.508(c).
- Specific Records. A meaningful description of the information to be disclosed.
- Specific Discloser. The provider authorized to make the disclosure.
- Specific Recipient. The person or entity authorized to receive the information.
- Purpose. A description of each purpose of the disclosure.
- Expiration. A date or event that ends the authorization.
- Signature & Date. The patient or representative must sign and date.
- Right to Revoke. A statement of the right to revoke in writing.
- Redisclosure Warning. Notice that information may be redisclosed.
- Anti-Conditioning. Statement that treatment cannot be conditioned on signing.
Sample Authorization
Below is a condensed preview of our HIPAA authorization template.
AUTHORIZATION FOR RELEASE OF MEDICAL RECORDS
Pursuant to 45 CFR 164.508
I, [Patient Name](DOB [DOB]), hereby authorize [Disclosing Provider]to release the protected health information described below to[Recipient].
1. RECORDS
The records to be released are: [Description]. Date range: [Range].
2. PURPOSE
The purpose of this disclosure is: [Purpose].
3. EXPIRATION
This authorization expires on[Expiration Date]or upon the following event:[Event].
4. RIGHT TO REVOKE
I understand that I may revoke this authorization in writing at any time by delivering written notice to the disclosing provider, except to the extent action has already been taken in reliance on the authorization.
5. REDISCLOSURE
I understand that information disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by federal privacy regulations.
6. NO CONDITIONING
I understand that the disclosing provider may not condition treatment, payment, enrollment, or eligibility for benefits on whether I sign this authorization.
Frequently Asked Questions
Answers to the most common questions about HIPAA, records access, fees, and special categories of protected information.
Official Resources
Authoritative federal and state resources on medical records access, HIPAA, and patient rights.
HHS - HIPAA Home
U.S. Department of Health and Human Services HIPAA homepage
HHS - Your Right to Access Records
Patient guide to accessing your own medical records under HIPAA
HHS - HIPAA Combined Regulation Text
Full text of the HIPAA Privacy and Security Rules
ONC - Information Blocking
Office of the National Coordinator for Health IT rules on information blocking under the Cures Act
SAMHSA - 42 CFR Part 2 FAQ
Substance Abuse and Mental Health Services Administration guidance on Part 2 records
Medicare.gov
Federal Medicare information for beneficiaries
CMS - Centers for Medicare & Medicaid Services
Federal authority on Medicare, Medicaid, and HIPAA enforcement
HHS OCR - File a HIPAA Complaint
Office for Civil Rights complaint portal for HIPAA violations
Create your Medical Records Release Form in under 10 minutes.
Answer a few questions and download a compliant, attorney-drafted document ready for your state.