HIPAA release form template
A free, editable Word form with the core elements and required statements in 45 CFR 164.508(c). Add your practice details and give it to patients when you need their permission to share their health information.
This form
Free
Word .docx · 2 pages · 76 KB · no sign-up
Download the free templateFull therapy practice kit
$299 one time
$249 launch price for the first 30 days after sales open · 12 months of updates
- This form, plus psychotherapy notes and marketing authorizations
- Policies, risk analysis, Notice of Privacy Practices, BAA
- A filled-in example practice to copy from
Version 1.0 · Checked against 45 CFR on · Made by hipaa.systems — how we check · Not legal advice
At a glance
This free HIPAA release form template is an editable two-page Word form for a patient's authorization to share specified health information, for example with a lawyer, employer or insurer. It includes the core elements and required statements of 45 CFR 164.508(c). Don't use it as is for psychotherapy notes, marketing or 42 CFR Part 2 records, and check your state's rules.
| Format | Word (.docx), 2 pages; opens in Google Docs |
|---|---|
| Built on | 45 CFR 164.508(c) |
| Not for | Psychotherapy notes, marketing, 42 CFR Part 2 records |
| Keep signed forms | Six years from signing or last in effect, whichever is later (45 CFR 164.530(j)) |
Use it when
- A patient asks you to send their information to a lawyer, employer, school, life insurer or family member who isn't involved in their care
- Signing is voluntary — you don't make treatment, payment or eligibility depend on it
Don't use it for
- Treatment, payment or health care operations — HIPAA allows these without an authorization
- A patient getting their own records — that's a records request under the right of access
- Psychotherapy notes or marketing — each needs its own authorization
- Records of a federally assisted substance use disorder program (42 CFR Part 2)
- A sale of PHI — this form does not include the additional remuneration statement required by 45 CFR 164.508(a)(4)
- The few cases where a service may depend on signing (45 CFR 164.508(b)(4)) — the form must then state the consequences of refusing
Not sure you need a release form at all? Read HIPAA release form: when you need one and required fields.
Preview
Tap a page to open the full PDF in a new tab.
Download the free template Word .docx · 2 pages · 76 KB
How to use it
- Replace [PRACTICE NAME], the address, phone and privacy contact in the letterhead and in section 6.
- Check your state's rules: some states require specific wording or a separate consent for mental health, HIV, genetic or reproductive health information.
- Before you share anything, check that every section is complete and the form hasn't expired or been revoked.
- Give the patient a copy and keep the signed form six years from signing or last in effect, whichever is later. A written revocation stops future sharing from the day you receive it; it doesn't undo what you already did, and a limited exception applies when the form was a condition of getting insurance.
See the legal requirements this form covers
| Requirement | Where | Source |
|---|---|---|
| Core elements: the information, who shares it, who receives it, the purpose, when it ends, the signature | Sections 2–5 and 7 | 45 CFR 164.508(c)(1) |
| Statements: right to revoke, care doesn't depend on signing, information may be re-disclosed | Section 6 | 45 CFR 164.508(c)(2) |
| Plain language | The whole form | 45 CFR 164.508(c)(3) |
| Copy for the patient | Office use | 45 CFR 164.508(c)(4) |
| Identity or authority check, when not already known | Office use | 45 CFR 164.514(h) |
| Date received and expiration tracking | Office use | Recommended |
Frequently asked questions
Is there an official HIPAA release form?
No. HHS does not publish a mandatory form. Any form works if it contains the required elements and statements in 45 CFR 164.508(c) and is written in plain language — so every template, ours included, is a starting point you adapt.
Do patients need this form to get their own records?
No. A patient asking for their own records uses the right of access under 45 CFR 164.524. That is a request, not an authorization, and you should not require an authorization form for it.
Can I use it to share psychotherapy notes?
No. Most uses and disclosures of psychotherapy notes need their own authorization that is not combined with other permissions (45 CFR 164.508(a)(2) and (b)(3)).
Can patients sign it electronically?
Yes, if the electronic signature is valid under applicable federal and state law. HIPAA requires a signature and a copy of the signed form for the patient; it does not prohibit electronic signatures.
Can I use it for substance use disorder treatment records?
Not as is. Records covered by 42 CFR Part 2 need a consent that meets the Part 2 rule.