Medical records release authorization form (HIPAA)

A free medical records release authorization form in Word and PDF, built around the elements HIPAA requires in 45 CFR 164.508, plus when you don't need one at all.

Signed by: Patient or Personal Representative.

Download Word (.docx)Download PDF Read it on this page

When SignWren launches, you'll be able to customize this template, save it to your own account and send it for e-signature. Join the waitlist to hear first.

Free, no sign-up. Updated September 30, 2026 by Suresh Ganapathy.

A medical records release form (formally, a HIPAA authorization) is the signed permission a patient gives so a doctor, clinic or health plan can send their health information to someone who otherwise couldn’t get it: a lawyer, an employer, a life insurer, a family member. Our free template is built around the elements a valid authorization needs under 45 CFR 164.508(c), in plain language, in Word and PDF. Before you use it, check the next section, because a lot of people fill in this form when they don’t need to.

Do you actually need a medical records release form?

You need one when a covered provider or health plan is being asked to disclose your information to a third party for a purpose HIPAA doesn’t already allow. You don’t need one to get your own records.

That second point trips people up constantly. Getting a copy of your own chart is your right of access under 45 CFR 164.524, and it’s a different process. HHS puts it simply: the Privacy Rule gives you, with few exceptions, the right to inspect, review and receive a copy of your medical and billing records. The provider can require you to ask in writing, but that’s a request form, not an authorization. It has 30 days to act, with one 30-day extension if it explains the delay in writing. It can charge a reasonable, cost-based fee for copies, and HHS says it can’t refuse to give you the records because you haven’t paid your bill.

Even sending your records to someone else can sometimes run through the right of access. If you ask in writing, sign it, and clearly name the person and where to send the copy, the provider must send it to that person. Ask your provider which route they want to use.

Providers also share records with each other for treatment and payment without your authorization. If you’re simply switching doctors, the new office will often request the file for you.

So, hypothetically: Dana wants her own MRI report. She files an access request. Dana’s attorney wants her records from two hospitals for an injury claim, and the hospitals ask for a signed authorization naming the firm. That’s where this template fits.

What does our authorization template include?

Each section maps to something the regulation asks for.

Who is disclosing and who receives it. The provider or plan that holds the records, and the person or organization that gets them. Names, addresses, and how to send (mail, secure portal, fax). The rule requires both to be identified specifically.

What information. A “specific and meaningful” description. “All records” is vague; “Office visit notes, imaging reports and bills from March 1, 2025 to present” is better. There are checkboxes for common categories and a date range.

Purpose. Why it’s being disclosed: legal matter, insurance application, continuity of care, personal use. If you started the request yourself and don’t want to explain, the regulation says “at the request of the individual” is enough.

Expiration. A date or an event, such as “one year from signing” or “when my claim closes.” A release that has passed its expiration date isn’t valid.

The three required statements. Your right to revoke in writing and how to do it; whether the provider can make treatment, payment or enrollment depend on your signature (usually it can’t); and a warning that once the information reaches the recipient, it may be redisclosed and may no longer be protected by federal privacy law.

Signature and personal representative. You sign and date it. If someone signs for you (a parent of a minor, a health care agent, an executor), the form asks for a description of their authority, which the rule requires.

The regulation also says the authorization must be in plain language and that you get a copy of what you signed.

What won’t this form cover?

Psychotherapy notes. These are a therapist’s separate process notes, not the regular treatment record. HIPAA requires a specific authorization for most disclosures of them, and that authorization may only be combined with another psychotherapy notes authorization. Our template has a line that excludes them; if you need them released, use a separate form.

Substance use disorder records. Records from federally assisted substance use disorder programs are governed by 42 CFR Part 2, which has its own consent requirements (listed at section 2.31). Many of those programs will ask you to use their form.

State law. Some states add rules for HIV test results, mental health records, genetic information or minors’ records. If the records fall into one of those groups, ask the provider which form it accepts. Many hospitals simply want their own form, and it’s easier to use theirs than argue.

How do you fill in a records release and get it signed?

Call or check the website of the provider that holds the records. Ask whether they accept an outside authorization or require their own.
Fill in both parties, a specific description of the records, the purpose and an expiration.
Read the three statements, then sign and date. A personal representative fills in the authority section and attaches proof if the provider asks.
Keep a copy, and send the original the way the provider asks.

E-signatures are generally valid for an authorization, and many providers accept them. The signature isn’t where things go wrong in healthcare; where the signed form lives is. A provider that’s a HIPAA covered entity and collects these forms electronically needs a tool that will sign a business associate agreement. SignWren is not set up for HIPAA-covered data and does not sign BAAs, so a covered practice shouldn’t use it for this form. Patients sending a one-off release can download it, fill in the blanks, and sign it however the provider accepts. For background, see whether electronic signatures are legally binding.

This template is general information, not legal advice. For a specific release or dispute, talk to a lawyer licensed where you are.

The authorization to release protected health information template

Download as Word

Template from signwren.com. General information, not legal advice. Check your state's rules and adapt it before you use it.

You do not need this form to get a copy of your own records. That is a right of access request, which is a separate process. Many providers require their own authorization form; ask first. Psychotherapy notes and records from federally assisted substance use disorder programs (42 CFR Part 2) need their own separate authorization or consent.

AUTHORIZATION TO RELEASE PROTECTED HEALTH INFORMATION

1. Patient

Full name: [patient's full legal name]
Date of birth: [date]
Other names used in records: [former names, or "None"]
Address: [street, city, state, ZIP]
Phone / email: [contact details]
Patient ID or account number (if known): [number]

2. Who May Disclose the Information

I authorize the following person or organization to disclose my health information:

Name: [provider, hospital, clinic or health plan]
Address: [street, city, state, ZIP]
Phone / fax: [numbers]

3. Who May Receive the Information

The information may be disclosed to:

Name: [person or organization receiving the records]
Address: [street, city, state, ZIP]
Phone / email: [contact details]

Send the records by: ☐ Mail ☐ Secure email or portal ☐ Fax ☐ Pick up in person ☐ Other: [method]

Format: ☐ Paper ☐ Electronic copy

4. Information to Be Disclosed

Dates of service: from [date] to [date, or "present"]

☐ Office or clinic visit notes
☐ Hospital records (admission, discharge summary, operative reports)
☐ Laboratory and test results
☐ Imaging reports ☐ Imaging files
☐ Medication list and prescriptions
☐ Immunization records
☐ Billing and payment records
☐ Other (describe specifically): [description]

Specially protected information. Some laws give extra protection to certain kinds of records. Initial each item you specifically authorize for release. If you leave an item blank, it will not be released, where the law allows it to be held back.

____ Mental health records (not psychotherapy notes)
____ HIV or AIDS testing and treatment information
____ Genetic testing information
____ Other: [description]

This authorization does not cover psychotherapy notes. It does not cover records from a federally assisted substance use disorder program unless a separate consent that meets 42 CFR Part 2 is attached.

5. Purpose of the Disclosure

☐ At my request
☐ Continuing care with another provider
☐ Legal matter
☐ Insurance application or claim
☐ Disability or benefits claim
☐ Other: [purpose]

6. Expiration

This authorization expires on: ☐ [date] ☐ When this event occurs: [event, e.g. "my claim is closed"]

If no date or event is filled in, it expires one year from the date I sign it.

7. My Rights

I can revoke this authorization. I may revoke it at any time by sending a written, signed notice to the person or organization named in Section 2 at the address listed there. Revoking it will not undo any disclosure already made in reliance on this authorization. It also may not apply if I signed this authorization as a condition of getting insurance coverage and the law gives the insurer a right to contest a claim under the policy or the policy itself.

My care does not depend on signing. The person or organization named in Section 2 may not condition my treatment, payment, enrollment in a health plan, or eligibility for benefits on whether I sign this authorization, except where federal law allows it. If an exception applies, the consequence of refusing to sign is: [describe, or write "Not applicable"].

The information may be shared again. Information disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by federal privacy law.

I get a copy. I am entitled to a copy of this signed authorization.

Fees. The person or organization disclosing the records may charge a fee allowed by law for copying and sending them.

8. Personal Representative

Complete this section only if someone other than the patient signs.

Name of representative: [full name]
Relationship or authority: ☐ Parent or legal guardian of a minor ☐ Health care agent under a power of attorney ☐ Court-appointed guardian or conservator ☐ Executor or administrator of the patient's estate ☐ Other: [describe]
Description of authority: [e.g. "Parent of the patient, who is 12 years old"]

Attach a copy of the document that gives you authority if the provider asks for it.

9. Electronic Signature

I agree that I may sign this authorization electronically, and that my electronic signature has the same effect as a handwritten one, unless the provider named in Section 2 requires a different method.

Signatures

Patient or Personal Representative
Signature: ______________________________
Name: [full name]
Date: [date]

Quick answers

Do I need to sign an authorization to get a copy of my own medical records?

No. Getting your own records is your HIPAA right of access, which is a separate process. A provider may ask you to put the request in writing, but it's a request, not an authorization, and the provider generally has 30 days to act on it.

What makes a HIPAA authorization valid?

Under 45 CFR 164.508(c) it has to describe the information, name who may disclose it and who receives it, state the purpose, give an expiration date or event, and be signed and dated. It also needs three statements: how to revoke it, whether treatment depends on signing, and that the recipient may redisclose the information.

Can I revoke a medical records release after signing it?

Yes. You can revoke it in writing at any time, except to the extent the provider has already acted on it (and a narrow exception tied to obtaining insurance).

Does this form cover psychotherapy notes or substance use treatment records?

Not on its own. Psychotherapy notes need a separate authorization that can only be combined with another psychotherapy notes authorization, and records from federally assisted substance use disorder programs follow 42 CFR Part 2, which has its own consent rules. Some state laws add more.

Sources

This template and guide are general information, not legal advice. Laws vary by state; for anything important, have a lawyer licensed where you are review it.

More healthcare and wellness templates

All templates