What a HIPAA authorization form is for
Doctors, hospitals, clinics and health plans can share health information for treatment, payment and health care operations without asking, but almost every other release needs the patient's written authorization. Lawyers handling an injury claim, life and disability insurers, employers, schools, family members and researchers all ask for one. The HIPAA Privacy Rule sets out exactly what the form must contain, and a form missing any of those items, or with a required item left blank, is not valid, so the provider will refuse to release the records.
This template contains every core element and required statement in 45 CFR 164.508(c): a specific description of the information with a date range and record types, the releasing and receiving parties, the purpose, the expiration date or event, the signature and the personal representative's authority, and the statements about revocation, conditioning and redisclosure. Sensitive categories such as mental health, HIV, genetic and substance use disorder information are released only if the patient initials them, as many state laws require, and psychotherapy notes are excluded because they need their own authorization. A revocation form, an office-use log and a plain guide to authorizations and access requests complete it.
When to use it
Patients can use it to send records to a lawyer, insurer, employer, school, family member or another person. Providers, clinics, dental and therapy practices and health plans can adopt it as their standard release form, and law firms and insurers can send it to clients for signature.
Use an access request instead when a patient simply wants a copy of their own records. Use a separate psychotherapy notes authorization for those notes, and a 42 CFR Part 2 consent where a federally assisted substance use disorder program requires one. Research authorizations have additional rules not covered by this form.
What's inside
The full list of sections and fields in this template, in the order they appear.
-
Patient and parties
- Patient name and date of birth
- Record number
- Who may release
- Who may receive
-
Information to be released
- Date range
- Record types
- Sensitive categories by initials
- Psychotherapy notes excluded
- Part 2 note
-
Purpose, format and expiration
- Purpose
- Delivery method
- Expiration date or event
-
Rights and signature
- Right to revoke and exceptions
- No conditioning
- Redisclosure warning
- Copy
- Personal representative's authority
-
Revocation and office use
- Revocation of Authorization
- Identity and authority checks
- Release log
- Six-year retention
-
Guidance
- Authorization or access request
- Treatment and payment sharing
Preview pages
-
Page 1 -
Page 2 -
Page 3
How to complete the form
- Identify the patient. Enter the full name, any other names used, date of birth and record number if known.
- Name who releases the records. Give the provider, facility or plan and its address.
- Name who receives them. Give the person or organization and how to reach them.
- Describe the information. Tick the record types and set the date range; avoid "all records" unless you mean it.
- Initial sensitive categories. Initial only the categories you want released.
- State the purpose. "At my request" is enough when you start the request yourself.
- Set the expiration. Enter a date or an event; the form is not valid without one.
- Sign and date it. A personal representative ticks their authority and attaches proof.
- Keep a copy. Keep the signed form, and use the revocation form if you change your mind.
Example: a completed authorization excerpt
A fictional patient, Daniel Morales, authorizes his orthopedic clinic to send records to his attorney for a car accident claim:
Release by: Lakeview Orthopedic Associates, 410 Harbor Drive, Suite 200, Tampa, Florida. Release to: Rivera & Cole, P.A. (fictional), 88 Madison Street, Tampa, Florida. Information: office and progress notes, imaging reports and images, and billing records, for treatment dates from January 15, 2026 to October 1, 2026. No sensitive categories initialled. Purpose: legal matter. Delivery: electronic copy by secure email. Expiration: December 31, 2027, or when the claim is resolved, whichever comes first.
Daniel signs and dates the form and keeps a copy. The clinic checks every section is complete, verifies his identity, sends the records and logs the release in the office-use section.
Federal rules to know
These are the federal rules this form is built around.
- Authorization required (45 CFR 164.508(a)). Most uses and disclosures outside treatment, payment and health care operations need a valid authorization.
- Core elements (164.508(c)(1)). Specific description, who discloses, who receives, purpose, expiration, and signature and date with any representative's authority.
- Required statements (164.508(c)(2)). Right to revoke and its exceptions, conditioning of treatment or benefits, and potential redisclosure.
- Plain language and copy (164.508(c)(3) and (4)). Written in plain language; a copy to the individual when the covered entity asked for the authorization.
- Defective authorizations (164.508(b)(2)). Expired, incomplete, revoked, improperly combined or known to be false.
- Psychotherapy notes (164.508(a)(2) and (b)(3)(ii)). A separate authorization, combinable only with another for psychotherapy notes.
- Retention (164.530(j)). Six years from creation or last effective date.
- Right of access (164.524). A patient's own copy within 30 days, with one extension, at a reasonable, cost-based fee.
- State law and 42 CFR Part 2. Stricter state rules and federal substance use disorder program rules may also apply.
Mistakes that get release requests rejected
Providers reject authorizations that leave the expiration blank, describe the information as vaguely as "any and all records" without dates, omit the recipient's details, are signed by a relative with no description of their authority, are older than the expiration date, or bundle psychotherapy notes with other records. Completing every section of this form, initialling only the sensitive categories you intend, and attaching proof of a representative's authority avoids each of them.
Frequently asked questions
What must a HIPAA authorization include?
Under 45 CFR 164.508(c), a specific description of the information, who may disclose it, who may receive it, the purpose, an expiration date or event, and the signature and date of the individual or their personal representative with a description of the representative's authority. It must also state the right to revoke, whether treatment or benefits can be conditioned on signing, and that information may be redisclosed and lose HIPAA protection.
When does a HIPAA authorization expire?
On the date or event written on the form. HIPAA does not set a maximum period, but the form must state one; an authorization with no expiration date or event is not valid. Some state laws limit how long an authorization can last.
Can a HIPAA authorization be revoked?
Yes, at any time, in writing. Revocation does not undo disclosures already made in reliance on the authorization, and an insurer may still have rights under other law if the authorization was a condition of obtaining coverage.
Are psychotherapy notes covered by a general release?
No. Psychotherapy notes need their own authorization, and that authorization can be combined only with another psychotherapy notes authorization. A general release of the medical record does not include them.
Do I need an authorization to get my own medical records?
No. Under HIPAA's right of access you can ask for your own records with a written request, and the provider generally must respond within 30 days and may charge only a reasonable, cost-based fee. An authorization is for sending your information to someone else.
