A medical records release form is a document that requests a medical office (covered entity) to disclose a patient’s protected health information (PHI). It includes details of the permissible information to be released, its purpose, and the preferred transfer method.
Medical records can only be released with authorization from a patient.
A covered entity has a maximum of 30 days upon receiving a request to disclose medical records to a third party.
This timeframe can be extended an additional 30 days if a written statement is provided that outlines the reasons for the delay. Only one extension is permitted.
The covered entity can charge a “reasonable, cost-based fee“ provided that it can only include the following:
- Labor – Costs of labor for making copies, whether in paper or electronic format.
- Supplies – Expenses for copies made for paper, CD-ROM, or USB.
- Postage – Any postage fees if mailed.
- Preparation – If the preparation or explanation of medical records on behalf of the patient is required (must be agreed to beforehand).
- Patient Identification
- Description of the Information to be Released
- Receiving Party’s Information
- Purpose of Release
- Right to Revoke
- Right to Refuse Authorization
- Acknowledgment of Rights
The name of the patient must be included along with the “specific identification” of the person. Therefore, it is recommended to include the patient’s birthdate, address, and contact details.
Patient’s Name: ____________________ Gender: ☐ Male ☐ Female
Mailing Address: ______________________________
Date of Birth: ____/____/____
Social Security Number: ____-____-______
Phone: (____) ____-______ E-Mail: ____________________
A description of the information to be used or disclosed in a “specific and meaningful fashion.” This can be a generic statement requesting that all medical records be released or specific to certain information related to a particular period or medical condition.
“This authorization applies to the medical records and other health information about my treatment at [HEALTHCARE PROVIDER] from [START DATE] to [END DATE].”
The receiving party’s name or other specific information. It is recommended to include the name of the representative or contact person if a specific person expects the medical records.
Receiving Party: ____________________
Mailing Address: ______________________________
Phone: (____) ____-______
A description of the reason for the release of PHI. The statement “at the request of the individual” is a sufficient description of the purpose for authorization. If the medical release is urgent, this should be stated to speed up the process.
“The purpose of this authorization is for the disclosure of my health records to assist in my ongoing medical treatment.”
A medical release is required to have an expiration. This can be defined as an expiration date or event(a two-year period is the most common timeframe).
“This authorization is valid for a period of [#] months after the recipient receives the requested information.”
“This authorization is valid until the completion of my treatment for [DESCRIBE MEDICAL CONDITION].”
A statement that explains the patient has the right to revoke the release with written authorization.
“I acknowledge the rights granted to me under HIPAA allow me to revoke this authorization at any time. If I revoke this authorization, I acknowledge it must be in writing and sent by mail or electronic communication.”
If, for any reason, the patient does not want to transfer or disclose their PHI, they have the right to do so under HIPAA. This must be mentioned in a release.
“I acknowledge the rights granted to me under HIPAA allow me to revoke this authorization at any time, provided that, such revocation is in written format.”
A statement that the information released is subject to redisclosure by the recipient. This means that the patient’s PHI may be shared with business associates and no longer be protected by HIPAA.
“I acknowledge that any released PHI or ePHI may be subject to redisclosure by the recipient and may no longer be protected by federal or state law.”
The patient’s signature is required to be placed on a medical release form with a date. No matter how many pages, the patient’s execution of the document is the only requirement (initials are not required on each page).
Patient Signature: ____________________ Date: _________
Print Name: ____________________
- 45 CFR 164.508(a)(1)
- 45 CFR 164.524(b)(2)(i)
- 45 CFR 164.524(b)(2)(ii)
- 45 CFR 164.524(c)(4)
- 45 CFR 164.508(c)(1)(ii)
- 45 CFR 164.508(c)(1)(i)
- 45 CFR 164.508(c)(1)(iii)
- 45 CFR 164.508(c)(1)(iv)
- 45 CFR 164.508(c)(1)(v)
- 45 CFR 164.508(c)(2)(i)
- 45 CFR 164.508(c)(2)(ii)
- 45 CFR 164.508(c)(2)(iii)
- 45 CFR 164.508(c)(1)(vi)