Fill Now
Adobe PDF
Fill Now
A medical records release form is a document that requests a medical office (covered entity) to disclose a patient’s protected health information (PHI). It includes details of the permissible information to be released, its purpose, and the preferred transfer method.
Medical records can only be released with authorization from a patient.[1]
Timeframe
A covered entity has a maximum of 30 days upon receiving a request to disclose medical records to a third party.[2]
This timeframe can be extended an additional 30 days if a written statement is provided that outlines the reasons for the delay. Only one extension is permitted.[3]
Fees ($)
The covered entity can charge a “reasonable, cost-based fee“[4] provided that it can only include the following:
- Labor – Costs of labor for making copies, whether in paper or electronic format.
- Supplies – Expenses for copies made for paper, CD-ROM, or USB.
- Postage – Any postage fees if mailed.
- Preparation – If the preparation or explanation of medical records on behalf of the patient is required (must be agreed to beforehand).
Requirements (9)
- Patient Identification
- Description of the Information to be Released
- Receiving Party’s Information
- Purpose of Release
- Expiration
- Right to Revoke
- Right to Refuse Authorization
- Acknowledgment of Rights
- Signature
1. Patient Identification
The name of the patient must be included along with the “specific identification” of the person. Therefore, it is recommended to include the patient’s birthdate, address, and contact details.[5]
Example
Patient’s Name: ____________________ Gender: ☐ Male ☐ Female
Mailing Address: ______________________________
Date of Birth: ____/____/____
Social Security Number: ____-____-______
Phone: (____) ____-______ E-Mail: ____________________
2. Description of the Information to be Released
A description of the information to be used or disclosed in a “specific and meaningful fashion.”[6] This can be a generic statement requesting that all medical records be released or specific to certain information related to a particular period or medical condition.
Example
“This authorization applies to the medical records and other health information about my treatment at [HEALTHCARE PROVIDER] from [START DATE] to [END DATE].”
3. Receiving Party’s Information
The receiving party’s name or other specific information.[7] It is recommended to include the name of the representative or contact person if a specific person expects the medical records.
Example
Receiving Party: ____________________
Representative’s Name:
Mailing Address: ______________________________
Phone: (____) ____-______
4. Purpose of Release
A description of the reason for the release of PHI.[8] The statement “at the request of the individual” is a sufficient description of the purpose for authorization. If the medical release is urgent, this should be stated to speed up the process.
Example
“The purpose of this authorization is for the disclosure of my health records to assist in my ongoing medical treatment.”
5. Expiration
A medical release is required to have an expiration. This can be defined as an expiration date or event[9](a two-year period is the most common timeframe).
Example Date
“This authorization is valid for a period of [#] months after the recipient receives the requested information.”
Example Event
“This authorization is valid until the completion of my treatment for [DESCRIBE MEDICAL CONDITION].”
6. Right to Revoke
A statement that explains the patient has the right to revoke the release with written authorization.[10]
Example
“I acknowledge the rights granted to me under HIPAA allow me to revoke this authorization at any time. If I revoke this authorization, I acknowledge it must be in writing and sent by mail or electronic communication.”
7. Right to Refuse Authorization
If, for any reason, the patient does not want to transfer or disclose their PHI, they have the right to do so under HIPAA. This must be mentioned in a release.[11]
Example
“I acknowledge the rights granted to me under HIPAA allow me to revoke this authorization at any time, provided that, such revocation is in written format.”
8. Acknowledgment of Redisclosure
A statement that the information released is subject to redisclosure by the recipient.[12] This means that the patient’s PHI may be shared with business associates and no longer be protected by HIPAA.
Example
“I acknowledge that any released PHI or ePHI may be subject to redisclosure by the recipient and may no longer be protected by federal or state law.”
9. Signature
The patient’s signature is required to be placed on a medical release form with a date.[13] No matter how many pages, the patient’s execution of the document is the only requirement (initials are not required on each page).
Example
Patient Signature: ____________________ Date: _________
Print Name: ____________________
Sources
- 45 CFR 164.508(a)(1)
- 45 CFR 164.524(b)(2)(i)
- 45 CFR 164.524(b)(2)(ii)
- 45 CFR 164.524(c)(4)
- 45 CFR 164.508(c)(1)(ii)
- 45 CFR 164.508(c)(1)(i)
- 45 CFR 164.508(c)(1)(iii)
- 45 CFR 164.508(c)(1)(iv)
- 45 CFR 164.508(c)(1)(v)
- 45 CFR 164.508(c)(2)(i)
- 45 CFR 164.508(c)(2)(ii)
- 45 CFR 164.508(c)(2)(iii)
- 45 CFR 164.508(c)(1)(vi)