HIPAA release form
What a HIPAA release form is, when a practice actually needs one, the fields it must contain to be valid, and the most common mistakes.
HIPAA release form at a glance
A HIPAA release form is the everyday name for a HIPAA authorization: a patient's signed permission for a provider to share their health information with someone for a purpose HIPAA doesn't otherwise allow, such as an employer, attorney or insurer. It is not needed for treatment, payment or a patient getting their own records. To be valid it needs the core elements of 45 CFR 164.508(c), including an expiration date and the patient's signature.
| Legal name | HIPAA authorization (45 CFR 164.508) |
|---|---|
| Needed for | Disclosures to employers, attorneys, life insurers, family not involved in care, marketing |
| Not needed for | Treatment, payment, operations, or a patient requesting their own records |
| Must include | What, who discloses, to whom, purpose, expiration, signature and date, three required statements |
| Patient can | Revoke it in writing at any time and get a copy |
| Keep it | Six years from when it was last in effect |
“HIPAA release form” is not a term from the regulation. What people mean is a HIPAA authorization: the document a patient signs to let you share their information for a purpose the Privacy Rule doesn’t already permit.
When you need one — and when you don’t
| Situation | Release form needed? |
|---|---|
| Sending records to another provider treating the patient | No — treatment (164.506) |
| Billing the patient’s insurer | No — payment (164.506) |
| Patient asks for a copy of their own records | No — right of access (164.524) |
| Employer, school or lawyer asks for records | Usually, unless another HIPAA permission applies (court order, subpoena with required assurances, workers’ compensation law) |
| Life insurer or disability claim review | Usually |
| Using the patient’s story or photo in marketing | Yes |
| Sharing psychotherapy notes (most purposes) | Yes |
Fields a valid form must have
Build the form around the elements in 45 CFR 164.508(c):
- Patient name and identifying details.
- Information to be released — described specifically (for example, “lab results from March 2026”, not “everything”).
- Who releases it — your practice.
- Who receives it — name or specific class of recipients.
- Purpose — or “at the request of the individual”.
- Expiration — a date or an event.
- Signature and date — plus the representative’s authority if someone signs for the patient.
- Three statements: the right to revoke in writing; whether treatment can be conditioned on signing; that the recipient may redisclose the information and HIPAA may no longer protect it.
Write it in plain language and give the patient a copy.
Common mistakes
- Blank fields. A form missing a required element is invalid.
- No expiration. “Until revoked” alone doesn’t meet the expiration requirement.
- Bundled into intake paperwork. Keep it separate.
- Using it for the patient’s own access request. That’s a different process with its own deadlines.
- Not keeping it. Retain signed forms and revocations for six years.
Next steps
- HIPAA for therapists in private practice →Scenario
- HIPAA authorization →Requirement
- Emailing patients →Requirement
Frequently asked questions
Is there an official HIPAA release form?
No. HHS does not publish a mandatory form. Any form works if it contains the required elements and statements in 45 CFR 164.508(c) and is written in plain language.
Does a patient need to sign a release form to get their own medical records?
No. Patients have a right of access to their own records under 45 CFR 164.524. That is a request, not an authorization, and a practice should not require an authorization form for it.
Can a release form be signed electronically?
HIPAA requires a signature but does not prohibit electronic signatures; check that your e-signature method is reliable and that applicable state law allows it.
Can I combine the release form with my intake paperwork?
Generally no. Outside narrow research exceptions, an authorization may not be combined with other documents into a compound authorization — keep it as a separate form.