Medical Records Release Authorization (HIPAA)
HIPAA-compliant authorization for a healthcare provider to release your medical records to a third party.
Live preview
AUTHORIZATION FOR THE USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (HIPAA) ═══════════════════════════════════════════════════════════════════════ PATIENT IDENTIFICATION Name: Jordan Alex Taylor Date of birth: June 12, 1985 Address: 482 Elm Street, Apt 3B, Portland, OR 97214 Phone: +1 503 555 0118 Last 4 SSN: XX-XX-1289 ═══════════════════════════════════════════════════════════════════════ RELEASING PROVIDER (records source) Pacific NW Family Medicine — Portland, OR 925 NW 19th Ave, Portland, OR 97209 ═══════════════════════════════════════════════════════════════════════ RECIPIENT (records destination) Dr. Lin Chen — OHSU Internal Medicine 3181 SW Sam Jackson Park Rd, Portland, OR 97239 Delivery contact: fax +1 503 494 4798 (HIPAA-secure) ═══════════════════════════════════════════════════════════════════════ PURPOSE OF RELEASE Continuing care / new treating provider ═══════════════════════════════════════════════════════════════════════ RECORDS AUTHORISED FOR RELEASE All medical records, lab results, imaging reports, and provider notes from January 1, 2020 through the date of this authorization. Include immunization history and current medication list. SENSITIVE CATEGORIES — express authorisation: I authorise release of records related to: HIV / AIDS testing and treatment; mental health diagnosis and treatment; substance use disorder treatment (note: 42 CFR Part 2 requires specific consent for these); genetic testing; reproductive and sexual health. (Strike through any category you do NOT wish to release.) ═══════════════════════════════════════════════════════════════════════ DELIVERY METHOD Secure fax to recipient ═══════════════════════════════════════════════════════════════════════ EXPIRATION This authorization expires on May 4, 2027 (or earlier upon written revocation). ═══════════════════════════════════════════════════════════════════════ PATIENT RIGHTS NOTICE (required by 45 CFR §164.508) (1) I may revoke this authorization at any time by giving written notice to the releasing provider, except to the extent the provider has already acted in reliance on it. (2) Information disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by federal or state privacy law. (3) Treatment, payment, enrolment, or eligibility for benefits cannot be conditioned on whether I sign this authorization, except in narrow circumstances permitted by 45 CFR §164.508(b)(4). (4) I have the right to receive a copy of this signed authorization. ═══════════════════════════════════════════════════════════════════════ PATIENT SIGNATURE _______________________________ Date: ____________________ Jordan Alex Taylor (or personal representative) If signed by a personal representative, describe the legal authority to act for the patient (e.g. "parent of minor," "healthcare power of attorney," "court-appointed guardian"): ____________________________________________________________________ Governing state for state-law overlay: Oregon
About this template
A HIPAA medical-records release is the document healthcare providers require before sending your records to anyone other than yourself or another treating provider with continuity-of-care need. The federal HIPAA Privacy Rule (45 CFR §164.508) sets the floor: an authorization must identify the patient, the records, the recipient, the purpose, an expiration date or event, and a clear right to revoke. State law often adds requirements on top — California, New York, Texas, Florida, and others have specific forms or extra notice language. Several categories of sensitive records require either separate authorisation or specific opt-in language even within a general HIPAA release: substance use disorder treatment records under 42 CFR Part 2, HIV/AIDS records in many states, mental-health records, genetic-testing results, and reproductive/sexual-health records. A general-purpose authorisation that does not specifically address these categories may be honoured for routine records but rejected for the sensitive ones, sending you back for a second signature. Best practice: name every category you want released, and strike through any you do not. Authorisations are valid up to one year by default in many states; setting a clear expiration matching your need (e.g., "until insurance claim 2026-XX-001 closes" or a fixed calendar date) avoids over-broad releases. Once records are released to the recipient, federal HIPAA protection generally does not follow — re-disclosure is the recipient's policy. For sensitive litigation or insurance disputes, narrow the records and the recipient as much as possible.
When to use it
- Switching primary-care doctors and transferring records to the new provider.
- Insurance claim appeal — releasing records to the insurer or an external review organisation.
- Disability or Social Security application — releasing records to the adjudicator.
- Legal proceeding — releasing records to your attorney or to opposing counsel under court order.
- Personal copy of your own records (you have a right to this under HIPAA — usually a separate, simpler request form).
What to include
- Patient identification (name, DOB, address) sufficient to confirm identity.
- Releasing provider and recipient names with addresses.
- Specific records (date range, type) — not "any and all" if you can avoid it.
- Express language for each sensitive category.
- Purpose of release and expiration date.
- Signed acknowledgement of revocation right and re-disclosure risk.