Fill Now
Updated on May 26th, 2023
A medical records release form is a document that grants a covered entity permission to disclose a patient’s protected health information (PHI) to another party. It includes details of the information that is permissible to be released, for what purpose, and the preferred method of transfer.
Main Purpose
A medical records release helps to safeguard a patient’s PHI by limiting its disclosure to third parties without consent. Such protections are granted under the HIPAA Privacy Rule, which strictly prohibits the sharing, use, and disclosure of PHI without authorization.
Timeframe
A covered entity has a maximum of 30 days upon receiving a request to disclose medical records to a third party.
This timeframe can be extended an additional 30 days if a written statement is provided that outlines the reasons for the delay. Only one extension is permitted.
Source: 45 CFR § 164.524(b)
Fees ($)
The covered entity can charge a “reasonable, cost-based fee” provided that can only include the following:
- Labor – Costs of labor for making copies, whether in paper or eletronic format.
- Supplies – Expenses for copies made for paper, CD-ROM, or USB.
- Postage – Any postage fees if mailed.
- Preparation – If the preparation or explantion of medical records on behalf of the patient is required (must be agreed to beforehand).
Source: 45 CFR § 164.524(c)(4)
Requirements (9)
- Patient Identification
- Description of the Information to be Released
- Receiving Party’s Information
- Purpose of Release
- Expiration
- Right to Revoke
- Right to Refuse Authorization
- Acknowledgment of Rights
- Signature
1. Patient Identification
The name of the patient must be included along with the “specific identification” of the person. Therefore, it is recommended to include the patient’s birthdate, address, and contact details.
Example
Patient’s Name: ____________________ Gender: ☐ Male ☐ Female
Mailing Address: ______________________________
Date of Birth: ____/____/____
Social Security Number: ____-____-______
Phone: (____) ____-______ E-Mail: ____________________
Source: 45 CFR 164.508(c)(1)(ii)
2. Description of the Information to be Released
A description of the information to be used or disclosed in a “specific and meaningful fashion.” This can be a generic statement requesting that all medical records be released or specific to certain information related to a particular period or medical condition.
Example
“This authorization applies to the medical records and other health information about my treatment at [HEALTHCARE PROVIDER] from [START DATE] to [END DATE].”
Source: 45 CFR 164.508(c)(1)(i)
3. Receiving Party’s Information
The receiving party’s name or other specific information. It is recommended to include the name of the representative or contact person if the medical records are expected by a specific person.
Example
Receiving Party: ____________________
Representative’s Name:
Mailing Address: ______________________________
Phone: (____) ____-______
Source: 45 CFR 164.508(c)(1)(iii)
4. Purpose of Release
A description of the reason for the release of PHI. The statement “at the request of the individual” is a sufficient description of the purpose for authorization. If it is urgent for the medical records to be released, this should be stated to speed up the process.
Example
“The purpose of this authorization is for the disclosure of my health records to assist in my ongoing medical treatment.”
Source: 45 CFR 164.508(c)(1)(iv)
5. Expiration
A medical release is required to have an expiration. This can be defined as an expiration date or event (a two-year period is the most common timeframe).
Example Date
“This authorization is valid for a period of [#] months after the recipient receives the requested information.”
Example Event
“This authorization is valid until the completion of my treatment for [DESCRIBE MEDICAL CONDITION].”
Source: 45 CFR 164.508(c)(1)(v)
6. Right to Revoke
A statement that explains the patient has the right to revoke the authorization. To limit the liability of a medical provider, any renovation should be required to be in writing.
Example
“I acknowledge the rights granted to me under HIPAA allow me to revoke this authorization at any time. If I revoke this authorization, I acknowledge it must be in writing and sent by mail or electronic communication.”
Source: 45 CFR § 164.508(c)(2)(i)
7. Right to Refuse Authorization
It is common when seeking treatment from a specialist or new medical provider that they will request a copy of a patient’s PHI. If, for any reason, the patient does not want to transfer or disclose their PHI, they have the right to do so under HIPAA, and this must be mentioned in a release form.
Example
“I acknowledge the rights granted to me under HIPAA allow me to revoke this authorization at any time, provided that, such revocation is in written format.”
Source: 45 CFR 164.508(c)(2)(ii)
8. Acknowledgment of Redisclosure
A statement that the information released is subject to redisclosure by the recipient. This means that the patient’s PHI may be shared with business associates and no longer be protected by HIPAA.
Example
“I acknowledge that any released PHI or ePHI may be subject to redisclosure by the recipient and may no longer be protected by federal or state law.”
Source: 45 CFR § 164.508(c)(2)(iii)
9. Signature
The patient’s signature is required to be placed on a medical release form. No matter how many pages, the patient’s execution of the document is the only requirement (initials not required on each page).
Example
Patient Signature: ____________________ Date: _________
Print Name: ____________________
Source: 45 CFR § 164.508(c)(1)(vi)
Adobe PDF