A medical records release (HIPAA) form is a written authorization for health providers to release information to the patient and someone other than the patient.
The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) and state laws mandate that health providers not disclose a patient’s information without valid authorization except in limited circumstances as required or permitted by law.
Main HIPAA Rules and Regulations
45 C.F.R. Part 160—General Administrative Requirements
- rules apply to health plans, health care clearinghouses, and health care providers using electronic records for certain transactions.
- rules apply to business associates connected to these entities (if mentioned).
45 C.F.R. Part 164—Security and Privacy
- governs the use and disclosure of Protected Health Information (PHI)
- ensures you can access your medical records and limits how your data is used
- keeps PHI safe
45 CFR § 164.404—Notification to Individuals
- mandates reporting PHI breaches to affected individuals and government agencies
- requires breaches affecting 500 or more patients to be reported within 60 days
- large-scale breaches will also published on the Department of Health and Human Services Office for Civil Rights (OCR) website
When to Use a Medical Records Release Form
Patient records are the health provider’s primary business records, but they are also confidential records of information in which the patient partially controls disclosure.
You need this form when releasing information NOT related to the following:
- Patient’s Medical Treatment
- Payment for Medical Treatment
- Healthcare Operations
In addition, health providers have a right to charge for the reasonable costs of copying patient records. Many providers want payment before they release records.
Health IT provides an overview of state law and the maximum fees doctors and hospitals may charge patients for copies of documents.
Contact the health provider to find out how much the copying charges will be, if any, and include payment with the release of the signed records.
According to a 2005 article published in PubMed Central, “reasonable costs” for copying records range widely from $2 to $55 for short records of 15 pages and upwards of $15 to $585 for longer records of 500 pages.
Consequences of Not Using a Medical Records Release Form
Health providers must ensure that information is released only to properly authorized individuals and organizations. The overarching consequence of not using a release is that the health provider will not release the information.
Patients have a right to sue anyone who unlawfully releases their information without consent. As a result, health providers will not release any information without a valid records release.
When in doubt about whether a records release is needed, get one signed because it will expedite the release of information.
Everyday Situations for Using a Medical Release Form
A patient’s information is often requested for the following purposes:
Insurance: Insurance companies use the information to underwrite life and health insurance policies, pay bodily injury claims, and pay workers’ compensation claims.
Continued treatment: When a patient is referred to a specialist or moves and switches to health providers, the new provider will want to review the patient’s history.
Legal: In personal injury cases, records provide proof of physical injuries, help calculate damages, and determine the cause of injuries or, in a medical malpractice case, determine whether the health provider exercised reasonable care.
Employer: In the workplace, employers conduct pre-employment exams and lab tests that relate to specific job requirements, use medical information to determine job fitness, and document sick leave.
Research: Clinical trials and medical studies use identifiable information to conduct research.
Medicinal Marijuana: Your doctor will likely record a need for medicinal marijuana in your records. If a dispensary needs additional proof, this form may need to be provided.
What to Include in a Medical Records Release Form
To be valid, a simple records release must include at least the following:
Authorized Request: The names or other specific identification of the person authorized to make the requested disclosure.
Recipient: The names or other specific identification of the recipient of the information.
Specific Information: A description of the information to be used or disclosed, identifying the information clearly and meaningfully.
Risk of Disclosure: A statement of the potential risk that information will be re-disclosed by the recipient and no longer protected.
Expiration: Expiration date or expiration event related to the patient or the purpose of the use or disclosure.
Revocation: A statement of the patient’s right to revoke the authorization.
Purpose: A description of each purpose of the requested use or disclosure.
Refusal to Sign: Whether treatment, payment, enrollment, or benefits eligibility can be conditioned on the authorization and consequences of refusing to sign the release.
Date and Signature: If the patient’s authorized representative signs the release, a description of the authorized representative’s authority to act for the patient must also be provided.
As a reference, a Release is known by other names:
- Medical Authorization
- Authorization to Disclose Health Information
- HIPAA Release
- HIPAA Authorization
Medical Records Release Form Sample
You can use one of our free printable templates (PDF & Word) to authorize the release of medical records.
Below is an example of what a completed medical release form looks like. The patient authorizes the releaser to release his medical information to the receiver because the patient is changing doctors.
