A fax arrives from a law office: "Please forward all records per the attached release." The attached release is a single paragraph, no expiration date, no description of what is being requested, signed six years ago. Your front desk wants to know if they can send the chart.
They cannot. That form is defective under HIPAA, and honoring it would be an impermissible disclosure. This article covers what a valid release form, formally an authorization under 45 CFR 164.508, must contain, when you actually need one, and what to do with the defective ones. There is a plain-English template skeleton at the bottom.
When a HIPAA Release Form Is Required, and When It Is Not
First, the vocabulary. The Notice of Privacy Practices is a notice, not a permission. "Consent" for treatment, payment, and operations is optional under HIPAA. The document with legal teeth is the authorization: the patient's written permission for a use or disclosure that HIPAA does not otherwise allow.
You do not need a release form to send records to another provider for treatment, to bill an insurer, or to run your practice. Those are permitted uses. You do need one for most everything else: disclosures to attorneys and life insurers, letting an employer see results, marketing uses, and research outside limited exceptions. One near-neighbor to keep separate: a patient directing you to send their own records to a third party is a right of access request, with its own rules and fee limits, not an authorization situation.
The Six Core Elements
Under 164.508(c)(1), a valid authorization must contain, at minimum:
1. A specific description of the information to be disclosed, identified "in a specific and meaningful fashion." "All records" can qualify; a blank line does not.
2. Who may disclose it: the person or class of persons authorized to make the disclosure, which is your practice.
3. Who receives it: the person or class the disclosure goes to, named specifically.
4. A description of each purpose. "At the request of the individual" is an acceptable purpose when the patient initiates.
5. An expiration date or event. A date, or an event tied to the individual or purpose, such as "end of my legal case."
6. Signature and date. If a personal representative signs, the form must describe their authority to act for the patient.
The Three Required Statements
Beyond the six elements, 164.508(c)(2) requires the form to put the patient on notice of three things: their right to revoke the authorization in writing and how; whether treatment, payment, or enrollment can be conditioned on signing (for ordinary care, it cannot); and the potential for the information, once disclosed, to be redisclosed by the recipient and no longer protected.
What Makes a Form Defective
Under 164.508(b)(2), you must treat an authorization as invalid when the expiration date has passed, an element is incomplete, you know it has been revoked, it improperly combines authorizations, or you know material information on it is false. This is the checklist for that law office fax. Missing expiration: defective. No description of the records: defective. The correct response is not to quietly fill the request anyway; it is a short letter identifying what the form lacks. Attorneys fix defective releases every day. They will fix yours.
Special Cases That Need Their Own Paper
Psychotherapy notes require a standalone authorization; they cannot ride along on a general release. Substance use disorder records from a Part 2 program run under 42 CFR Part 2's consent rules, which are stricter than HIPAA's. And when someone signs for the patient, the personal representative rules decide whether that signature counts; the authorization form requirements article covers the form mechanics in more depth.
A Plain-English Template Skeleton
Authorization to Release Health Information (adapt with your counsel; educational template, not legal advice)
1. Patient
Name, date of birth, contact information.
2. I authorize
[Practice name, address] to disclose the information described below.
3. To
[Recipient name and organization, address].
4. Information to be released
Records from [date range]: [check boxes: complete record / visit notes / labs / imaging / billing records / other: ___]. Psychotherapy notes are NOT covered by this form and require a separate authorization.
5. Purpose
[At my request / legal / insurance / other: ___].
6. Expiration
This authorization expires on [date] or upon [event].
7. My rights
I may revoke this authorization in writing at any time by [method], except where the practice has already acted on it. My treatment and payment cannot be conditioned on signing this form. Information disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by federal privacy law.
8. Signature
Signature, date. If signed by a personal representative: name, and description of authority to act for the patient (for example, healthcare power of attorney, executor).
Print it, review it with counsel once, and put the office copy where the front desk can reach it. The judgment call disappears when the checklist is on paper.
---
FAQ
Do we need a HIPAA release form to send records to another doctor?
Not for treatment. Disclosures for treatment, payment, and health care operations are permitted without an authorization. Attorneys, insurers outside payment, and employers are the cases that need the form.
How long is a HIPAA release form valid?
Until its stated expiration date or event. HIPAA sets no maximum duration, but a form with no expiration at all is defective and cannot be honored.
Can a patient revoke a release form?
Yes, in writing, at any time. The revocation does not undo disclosures the practice already made in reliance on the form.
Is an emailed or electronically signed release form acceptable?
Generally yes, if the form contains all required elements and the signature is genuine. Verify authenticity the same way you would a faxed form, and check whether your state adds signature requirements.
What do we do with a defective release form?
Do not honor it. Reply identifying the missing element, such as an expiration date or a description of the records, and request a corrected form. Under 164.508(b)(2) an incomplete or expired authorization is invalid.
Conclusion
A compliant release form is a one-time build that saves your front desk a hundred judgment calls. The One Guy Consulting template library includes authorization forms alongside the policies that govern them, and the Full-Scope plan adds consulting hours for the odd requests that do not fit the form. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.508 (uses and disclosures requiring authorization)
- HHS FAQ collection: authorizations
- 42 CFR Part 2 (substance use disorder records)
Related Reading