HIPAA elements of a medical records release form
A medical records release form is a HIPAA authorization: the patient's written permission for a practice to disclose their records to someone else. HIPAA requires six core elements, three statements and plain language. When the covered entity requests the authorization, the patient receives a signed copy. Practices use the form for disclosures that require authorization; treatment, payment, health care operations and the patient's own access request follow different rules.
Last updated
- Core elements 6
- Required statements 3
- Governing rule 45 CFR 164.508
- Access request timing 30 days
- HIPAA documentation 6 years
What is a medical records release form?
A medical records release form records the patient's written permission for a practice to disclose records to someone else. Practices use this HIPAA authorization when the planned disclosure requires it.
HIPAA requires authorization for most uses of psychotherapy notes under 164.508(a)(2), marketing under (a)(3), and a sale of PHI under (a)(4). Staff collect the signed authorization and handle the release under the practice's process.
The patient form templates hub places this authorization among intake forms. Intake Pro supplies the signed PDF and audit trail; staff send the records through the practice's own process.
Which six core elements belong in a medical records release form?
In 45 CFR 164.508, (c)(1)(i) through (vi) list the six core elements of a medical records release form.
| Element | What the form must state | Field type in Intake Pro |
|---|---|---|
| Information, (c)(1)(i) | A specific and meaningful description of the information to be used or disclosed. | display text, text, choice |
| Who may disclose, (c)(1)(ii) | The name or other specific identification of the person or class of persons authorized to make the disclosure. | name, text |
| Recipient, (c)(1)(iii) | The name or other specific identification of the person or class of persons who will receive the information. | name, text, address |
| Purpose, (c)(1)(iv) | Each purpose. 'At the request of the individual' is sufficient when the individual starts the request. | text, choice |
| Expiration, (c)(1)(v) | An expiration date or an expiration event that relates to the individual or the purpose. | date, text |
| Signature and date, (c)(1)(vi) | The individual's signature and date, and a signing personal representative's authority to act. | signature, date, text |
This information is general. Confirm the authorization and workflow with your own counsel or compliance lead.
Which statements does a medical records release form require?
A medical records release form has three (c)(2) statements, plus plain-language and signed-copy requirements under (c)(3) and (c)(4).
| Rule | Requirement |
|---|---|
| Right to revoke, (c)(2) | States the individual's right to revoke in writing and how to do it. |
| Conditioning, (c)(2) | States whether the covered entity may condition treatment, payment, enrollment or eligibility on signing. |
| Redisclosure, (c)(2) | States that the recipient may redisclose the information and that it may no longer be protected by the Privacy Rule. |
| Plain language, (c)(3) | Uses plain language throughout the authorization. |
| Patient copy, (c)(4) | When the covered entity requests the authorization, gives the individual a copy of the signed form. |
When can a medical records release form be revoked or defective?
Under (b)(5), a patient may revoke a medical records release form in writing at any time, except to the extent the covered entity has already acted on it.
Under (b)(2), an authorization is defective if its expiration date has passed or event occurred, a required element is missing or incomplete, or it has been revoked.
It is also defective if it violates compound-authorization or conditioning rules in (b)(3) and (b)(4), or the covered entity knows material information is false.
When is a medical records release form not needed?
A medical records release form is not needed for a covered entity's own treatment, payment or health care operations. A patient's request for their own records is a separate right-of-access process.
45 CFR 164.506(c)(1) permits those uses and disclosures without authorization, except uses listed in 164.508(a)(2) through (4).
45 CFR 164.524 governs access. Under 164.524(b)(2), the covered entity acts within 30 days, with one extension of up to 30 more days if it gives a written reason and date.
Who signs a medical records release form, and when?
The patient signs and dates a medical records release form when the practice requests the authorization. A personal representative, such as a parent or guardian, may sign, with a field describing that person's authority to act.
Intake Pro supports typed or drawn signatures. HHS FAQ 554 states that an authorization may be obtained electronically, 'provided any electronic signature is valid under applicable law'. See the electronic signatures guide.
45 CFR 164.530(j) requires HIPAA documentation, including authorizations, to be kept six years from creation or last effect, whichever is later. State law, not HIPAA, sets medical-record retention periods, which vary by state.
How do you build a medical records release form in Intake Pro?
Build the medical records release form from the practice's counsel-approved wording, then collect and retain the signed authorization.
-
Start with approved wording
Counsel or the compliance lead approves the practice's authorization wording.
-
Convert or build
Convert the practice's PDF or Word file, or create the form in the form builder.
-
Add fields and signature
Add the required elements and statements, representative authority, date and signature. Use conditional questions for representative details.
-
Publish
Review and publish the online form.
-
Send or open on a kiosk
Send a private link by text or email, or use a front-desk kiosk.
-
Download and provide the copy
Staff download the signed PDF and audit trail, handle the release under the practice's process and give the patient their copy.
Questions
Can a patient revoke a medical records release form after signing?
Yes. The patient may revoke the authorization in writing at any time, except to the extent the covered entity has already acted on it. The authorization must explain the right to revoke and how to exercise it.
Does a medical records release form need an expiration?
Yes. HIPAA requires an expiration date or an expiration event that relates to the individual or the purpose of the disclosure. An authorization becomes defective when that date passes or the event occurs.
Who can sign a medical records release form for a patient?
The patient can sign, or a personal representative such as a parent or guardian can sign. When a representative signs, the authorization includes a description of that person's authority to act for the patient.
Does Intake Pro send records after a medical records release form is signed?
No. Intake Pro collects the signed authorization and provides the signed PDF and audit trail for staff to download. The practice handles the disclosure and gives the patient their copy under its own process.