If you work in healthcare, handle medical records, or visited a doctor's office, you’ve likely heard of a HIPAA release form—sometimes called a HIPAA authorization form or medical records release form. This legal document gives patients control over who can access or share their protected health information (PHI) for purposes not automatically permitted under the HIPAA Privacy Rule.

Under the HIPAA Privacy Rule, covered entities can use or disclose PHI without authorization for treatment, payment, and healthcare operations. But in other situations, such as sharing records with a third party, using PHI for marketing, or releasing sensitive test results, a HIPAA release form is required.

In this guide, we’ll explain exactly what a HIPAA release form is, when it’s needed, what it must include to be HIPAA compliant, and provide a free downloadable HIPAA release form template you can customize for your organization.

What is a HIPAA release form?

A HIPAA release form is a legal document signed by an individual to grant permission for their protected health information (PHI) to be used by authorized individuals at covered entities for specific purposes other than treatment, payment, and health care operations, or to be disclosed to specific individuals or entities.

This form may be referred to in other ways including:

• HIPAA medical release form​
• HIPAA authorization form
• HIPAA consent form
• HIPAA release of information form
• HIPAA medical records release form​
• HIPAA information release form

To better understand the HIPAA release form, you can download our illustrative HIPAA release form template, watch the quick explainer below, or keep reading for a detailed breakdown of HIPAA release form requirements.

HIPAA release form requirements

HIPAA has specific authorization requirements governing the content of a medical release form, including:

• Description of the information to be used and disclosed: A HIPAA release of information form must specify what specific information can be used and disclosed. It can be broad, allowing access to all medical records, or narrow, granting access only to specific information or for a limited period.
• The authorized person who can use or disclose the information: The form must specify who the person authorized to make the use or disclosure is.
• To whom it can be disclosed: A HIPAA compliant medical records release form must also specify the names of the individuals or entities to whom the authorized individual at the covered entity may disclose the information.
• Purpose of the disclosure: In some cases, the form must specify the purpose for which the information may be used or disclosed.
• Patient's signature: It is essential for the patient to voluntarily sign the HIPAA medical records release form. This means that they understand what information is being shared and with whom.
• Expiration Date: The HIPAA release form must contain an expiration date or event triggering the end of the authorization that relates to the individual or the purpose of the use or disclosure. This ensures that the permission granted is only valid for a specified period (unless effectively revoked in writing by the individual before that date or event).
• Revocation rights: The form should include statements advising patients of their right to revoke their authorization at any time, in writing. This means they can stop the sharing of their medical information by notifying the covered entity. Any exceptions to this right should be detailed. 

Keep in mind that the specific requirements and processes for using HIPAA release forms may vary depending on state laws and the policies of healthcare providers and organizations.

HIPAA release form PDF

A well-crafted HIPAA release form helps ensure your organization meets HIPAA requirements and avoid costly compliance mistakes.

Our printable PDF provides a generic template of a HIPAA release form that meets the requirements above. You can easily customize it to reflect your organization’s policies, the type of PHI you handle, and any additional privacy safeguards you want to put in place. Using this template can help you save time while reducing compliance risk.

When is a HIPAA release form required?

Covered entities are required to obtain patient authorization for uses and disclosures of protected health information for specific purposes, generally other than treatment, payment, and health care operations, or to disclose protected health information to a third party specified by the individual.

Healthcare providers, insurance companies, family members, and other individuals and organizations may need an individual to sign a HIPAA release of information form in order to access their medical records or discuss their health information.

For examp​​le, for a provider or health plan to engage in marketing to individuals, those individuals must have signed a HIPAA authorization form permitting the use or disclosure of their protected health information for marketing communications. (There are only two exceptions: one, if the communication occurs in a face-to-face encounter between the covered entity and the individual or two, if the communication involves a promotional gift of nominal value.)

When is a HIPAA release form not required?

Under the HIPAA Privacy Rule, covered entities are not required to obtain patient authorization for uses and disclosures of protected health information for treatment, payment, and health care operations.

For example, doctors, nurses, hospitals, laboratory technicians, and other health care providers that are covered entities can use or disclose PHI, such as X-rays, laboratory and pathology reports, diagnoses, and other medical information for treatment purposes without the patient’s authorization.

However, covered entities may choose to voluntarily obtain patient consent for uses and disclosures of PHI for these reasons (ie. treatment, payment, and health care operations). While not required, this is permitted under the HIPAA Privacy Rule.

The importance of meeting HIPAA authorization requirements

Having a HIPAA-compliant release form isn’t just about checking a box. It’s a critical safeguard that helps prevent unauthorized disclosures of PHI. This not only protects patient privacy—it also protects your organization from HIPAA violations and costly enforcement actions.

To help understand the importance of having a HIPAA compliant release form, let's look at a recent HIPAA enforcement examples in which the lack of proper authorization led to a violation.

Recent HIPAA enforcement examples based on authorization issues

Below are four examples that underscore how even one unauthorized disclosure can trigger enforcement action, corrective measures, and reputational harm—making a proper, state-compliant HIPAA release form essential.

• Large provider revises process to prevent unauthorized disclosures to employers
  A state health sciences center disclosed PHI to a patient’s employer without proper authorization. OCR found this violated the Privacy Rule and required the center to revise its authorization procedures, retrain staff, and take steps to mitigate harm to the patient.
• HMO implements valid authorization process
  An HMO sent a member’s full medical record to a disability insurance company using an authorization form that did not meet HIPAA’s requirements. OCR required the HMO to create a compliant form, update policies to ensure patient signatures are obtained on valid authorizations before any disclosure, and keep signed forms on file with the disclosed records.
• Mental health center corrects access denial
  A mental health center released a patient’s records to her auto insurance company but later denied her own request for those same records, citing potential harm. While the release was authorized, the Privacy Rule requires such denials to be eligible for review—which the center failed to offer. OCR required the center to provide the patient her records and ensure compliance with review requirements moving forward.

How to create a HIPAA compliant medical records release form

You want to make it as simple as possible for patients to fill out a HIPAA release form. Follow the steps below to create a standard HIPAA release form that’s easy for patients to understand and fill out. We've included images of the New York HIPAA Release Form for reference.

You can also download our printable HIPAA release form template to get started. 

1. Provide instructions

To start, provide instructions that will guide the patient through the process of filling out the form. You may include specific information about what to include on the form based on applicable state laws or the policies of your organization.

Here’s an example of language you might use: Please complete all sections of this HIPAA release form with accurate and up-to-date information. If any sections are inaccurate, out-of-date, or left blank, this form will be invalid and it will not be possible for your health information to be used or disclosed as requested. 

Here’s an example from the NYC HIPAA release form:

2. Name the patient and individual authorized to use or disclose their PHI

Include a statement where the patient can permit the individual or covered entity authorized to use or disclose their PHI. You may leave the field for the patient name blank and require them to print their name. 

Here’s an example of language you might use:

I,_____________________________________________, hereby authorize

[NAME OF INDIVIDUAL OR COVERED ENTITY] to share the information listed below with the person(s) or organization(s) I have specified in [SECTION NO.] in this document.

Here’s an example from the NYC HIPAA release form:

3. Describe the information

Next, specify the types of information you are requesting authorization to use or disclose. You can be specific (e.g., medical history, treatment records, laboratory results) or broad (e.g., all medical records). You may use checkboxes for this section to make it as easy and fast as possible for patients to fill out. 

Here’s an example of language you might use:

I permit the above individual or covered entity to: 

• Disclose my entire health record.
• Disclose my entire health record except for the following information [check any of the following]:
  Mental health records or psychotherapy notes
  Alcohol/drug treatment
  HIV-related information

Here’s an example from the NYC HIPAA release form:

4. Specify recipients

Next, provide a section where the patient can identify the individuals or entities to whom they are permitting disclosures of their PHI. This could be healthcare providers, family members, insurance companies, or any other organization that needs access to their medical records. 

Instruct patients to include their names and contact information.

Here’s an example of language you might use:

I give authorization for the health information detailed above in this document to be disclosed to the following individual(s) or organization(s)

Name: ________________________________________________________________

Organization: ________________________________________________________________

Address: ________________________________________________________________

Here’s an example from the NYC HIPAA release form:

5. Specify the purpose of disclosure

You may also provide a section prompting the patient to indicate the purpose for which the information will be used or disclosed. An example might be sharing information with a family member for caregiving purposes. Instruct the patient what to write if they do not wish to provide the purpose. You can also use checkboxes for this section. 

Here’s an example of language you might use:

Purpose of request: 

• At my request
• Dispute
• Referral
• Other (Specify): _____________

Here’s an example from the NYC HIPAA release form:

6. Specify the time period

Specify the time frame during which the authorization is valid. This can be a one-time release, a specific date range, or an ongoing authorization. 

Here’s an example of language you might use:

This authorization to share my health information is valid from ___________________ to ___________________.

Here’s an example from the NYC HIPAA release form:

7. Detail their revocation rights

Include statements advising patients of their right to revoke their authorization at any time.

Here’s an example of language you might use:

I understand that I am permitted to revoke this authorization to share my health data at any time and can do so by submitting a request in writing to:

[NAME]

[ORGANIZATION]

[ADDRESS]

I understand that:

• In the event that my information has already been shared by the time my authorization is revoked, it may be too late to cancel permission to share my health data.
• I understand that I do not need to give any further permission for the information detailed in [SECTION NO.] to be shared with the person(s) or organization(s) listed in section
• I understand that the failure to sign/submit this authorization or the cancellation of this authorization will not prevent me from receiving any treatment or benefits I am entitled to receive, provided this information is not required to determine if I am eligible to receive those treatments or benefits or to pay for the services I receive. 

Here’s an example from the NYC HIPAA release form:

8. Obtain the patient’s signature

Leave fields for the patient to sign and date the form. This indicates their informed and voluntary consent to release their PHI. 

Here’s an example from the NYC HIPAA release form:

Need help getting HIPAA compliant?

Using or disclosing protected health information (PHI) without a HIPAA authorization form can be a serious HIPAA violation — and this is just one example. Other common violations include failing to address security risks, downloading PHI onto unauthorized devices, and sending ePHI to a personal email account.

If you’re a covered entity (including healthcare providers, health plans, and healthcare clearinghouses) or a business associate that must comply with HIPAA regulations, Secureframe can help you verify and maintain your organization’s HIPAA compliance. 

To streamline your annual HIPAA audits, keep you compliant, and protect you from potential HIPAA violation fines, Secureframe’s platform and team of HIPAA compliance experts help you:

• create HIPAA privacy and security policies
• train employees on how to protect PHI
• manage vendors and business associates, including Gmail
• implement and monitor safeguards to prevent unauthorized use or disclosure of PHI 
• and more

For more information on how Secureframe can help you achieve and maintain HIPAA compliance, request a demo.