HIPAA Release Form: Six Core Elements, Three Required Statements

A HIPAA release form is the patient's written permission to share records that HIPAA does not otherwise allow you to share. HIPAA calls it an authorization, and the rules sit at 45 CFR 164.508. The free template above is that form. The rest of this article is what makes one valid, and what to do with the defective ones.

A fax arrives from a law office: "Please forward all records per the attached release." The attached release is a single paragraph, no expiration date, no description of what is being requested, signed six years ago. Your front desk wants to know if they can send the chart.

They cannot. That form is defective under HIPAA, and honoring it would be an impermissible disclosure (a disclosure HIPAA does not allow). This article covers what a valid release form, formally an authorization under 45 CFR 164.508, must contain, when you actually need one, and what to do with the defective ones. There is a plain-English template skeleton at the bottom.

When a HIPAA Release Form Is Required, and When It Is Not

First, the vocabulary. The Notice of Privacy Practices is a notice, not a permission. "Consent" for treatment, payment, and operations is optional under HIPAA. The document with legal teeth is the authorization: the patient's written permission for a use or disclosure that HIPAA does not otherwise allow.

You do not need a release form to send records to another provider for treatment, to bill an insurer, or to run your practice. Those are permitted uses. You do need one for many other kinds of sharing, such as disclosures to attorneys and life insurers, letting an employer see results, marketing uses, and research outside limited exceptions. One near-neighbor to keep separate: a patient directing you to send their own records to a third party is a right of access request, with its own rules, not an authorization situation.

The Six Core Elements

Under 164.508(c)(1), a valid authorization must contain, at minimum:

• 1. A specific description of the information to be disclosed, identified "in a specific and meaningful fashion." "All records" can qualify; a blank line does not.
• 2. Who may disclose it: the person or class of persons authorized to make the disclosure, which is your practice.
• 3. Who receives it: the person or class the disclosure goes to, identified by name or by another specific description.
• 4. A description of each purpose. "At the request of the individual" is an acceptable purpose when the patient initiates.
• 5. An expiration date or event. A date, or an event tied to the individual or purpose, such as "end of my legal case."
• 6. Signature and date. If a personal representative signs, the form must describe their authority to act for the patient.

The Three Required Statements

Beyond the six elements, 164.508(c)(2) requires the form to put the patient on notice of three things: their right to revoke the authorization in writing and how; whether treatment, payment, or enrollment can be conditioned on signing (for ordinary care, it cannot); and the potential for the information, once disclosed, to be redisclosed by the recipient and no longer protected.

What Makes a Form Defective

Under 164.508(b)(2), you must treat an authorization as invalid when the expiration date has passed, an element is incomplete, you know it has been revoked, it improperly combines authorizations, it improperly makes treatment depend on signing, or you know material information on it is false. This is the checklist for that law office fax. Missing expiration: defective. No description of the records: defective.

The correct response is not to quietly fill the request anyway; it is a short letter identifying what the form lacks. The attorney can then send a corrected form.

Special Cases That Need Their Own Paper

Psychotherapy notes require a standalone authorization; they cannot ride along on a general release. Substance use disorder records from a Part 2 program run under 42 CFR Part 2's own consent rules, which apply in addition to HIPAA's. And when someone signs for the patient, the personal representative rules decide whether that signature counts; the authorization form requirements article covers the form mechanics in more depth.

A Plain-English Template Skeleton

Print it, review it with counsel once, and put the office copy where the front desk can reach it. The guesswork disappears when the checklist is on paper.

FAQ

Do we need a HIPAA release form to send records to another doctor?

Not for treatment. Disclosures for treatment, payment, and health care operations are permitted without an authorization. Attorneys, insurers outside payment, and employers are common cases that need the form.

How long is a HIPAA release form valid?

Until its stated expiration date or event. HIPAA sets no time limit. But a form with no expiration date or event is defective, and you cannot honor it. Research forms are the one exception.

Can a patient revoke a release form?

Yes, in writing, at any time. The revocation does not undo disclosures the practice already made in reliance on the form.

Is an emailed or electronically signed release form acceptable?

Generally yes, if the form contains all required elements and the signature is genuine. Verify authenticity the same way you would a faxed form, and check whether your state adds signature requirements.

What do we do with a defective release form?

Do not honor it. Reply identifying the missing element, such as an expiration date or a description of the records, and request a corrected form. Under 164.508(b)(2) an incomplete or expired authorization is invalid.

A compliant release form is a one-time build that saves your front desk a hundred guesses. The One Guy Consulting template library includes policy and procedure templates for your practice. The Full-Scope plan adds 4 hours a month of 1:1 implementation calls with Chuck. Start with a free 30-minute intro call. No obligation, no pressure.

Sources

• 45 CFR 164.508 (uses and disclosures requiring authorization)
• HHS FAQ collection: authorizations
• 42 CFR Part 2 (substance use disorder records)

---

Related Reading

• HIPAA authorization form requirements
• The HIPAA right of access
• Notice of Privacy Practices guide