HIPAA Release Form

What Is a HIPAA Release Form?

A HIPAA release form, also called a HIPAA authorization, is a written document a patient signs to permit a healthcare provider to use or disclose specific protected health information (PHI) to a named recipient for a stated purpose. Under the HIPAA Privacy Rule, valid authorizations are required for most uses and disclosures beyond treatment, payment, and operations.

Healthcare practices use HIPAA release forms when patients ask to share records with family members, attorneys, employers, life insurance carriers, schools, or other providers outside the care team. A well-built form protects both the patient’s privacy rights and the practice from compliance risk.

What Does a HIPAA Release Form Include?

To be valid, a HIPAA authorization must contain the core elements defined by the HHS Privacy Rule (45 CFR § 164.508). A complete release form typically captures the following sections.

Patient identification. Full legal name, date of birth, address, phone number, and medical record number (if available) so the practice can match the request to the correct chart.

Disclosing party. The name and contact information of the practice or covered entity authorized to release the information.

Recipient of the information. The full name, organization, and contact details (address, fax, secure email) of the person or entity authorized to receive the PHI.

Specific information to be released. A precise description of the records being authorized — for example, office visit notes, lab results, imaging, immunization history, or the complete chart. Sensitive categories (mental health, substance use treatment, HIV status, genetic information) usually require separate opt-in checkboxes.

Purpose of the disclosure. The reason the patient is requesting the release (continuity of care, legal matter, insurance application, personal use, etc.).

Expiration date or event. A clear end date or triggering event after which the authorization is no longer valid.

Right to revoke. A statement informing the patient they can revoke the authorization in writing at any time, plus instructions on how to do so.

Re-disclosure notice. A statement that once information is disclosed, the recipient may no longer be bound by HIPAA and the PHI could be re-disclosed.

Signature and date. The patient’s signature (or personal representative’s, with relationship documented) and the date of signing.

How to Administer a HIPAA Release Form

1. Send the form ahead of the request. When a patient asks to share records, send the digital release form by SMS or email before they arrive or before staff begins gathering records.
2. Verify the patient’s identity. Confirm the patient’s name, date of birth, and one additional identifier match the chart before processing.
3. Review for completeness. Confirm every required field is filled in — especially the specific records authorized, the recipient, and the expiration date. An incomplete authorization is not valid.
4. Capture a legal electronic signature. Use an E-SIGN compliant electronic signature so the form is enforceable and auditable.
5. Store the executed authorization in the chart. HIPAA requires covered entities to retain authorizations for at least six years from the date created or last in effect.
6. Release only the minimum necessary. Limit the disclosure to exactly the records the patient authorized — nothing more.
7. Document the disclosure. Log what was released, to whom, when, and under which authorization to support accounting-of-disclosures requests.

Who Uses a HIPAA Release Form?

• Primary care and specialty practices — when transferring records to a new provider, a specialist, or a referring physician.
• Mental health and behavioral health practices — when sharing therapy notes or psychiatric records, often with stricter state-level consent requirements.
• Hospitals and surgery centers — when releasing operative reports, discharge summaries, or imaging to outside parties.
• Dental and orthodontic practices — when transferring patient records between offices or to insurance carriers.
• Therapy practices (PT, OT, speech) — when coordinating with referring physicians, schools, or workers’ compensation carriers.
• Legal and disability evaluators — when records are needed for personal injury, disability, or estate matters.

Digital vs. Paper HIPAA Release Forms

How Zentake Transforms the HIPAA Release Process

• Conditional fields surface only what applies. If a patient checks “mental health records,” the form reveals the separate opt-in required by state law. Build branching logic in the customizable online forms builder.
• Required-field enforcement blocks submission until every HIPAA-required element is captured, eliminating incomplete authorizations.
• Legally binding electronic signatures through Zentake’s e-signature engine meet E-SIGN and UETA requirements.
• HIPAA-compliant storage and audit trails via Zentake’s HIPAA-compliant infrastructure — including BAAs, encryption at rest and in transit, and full accounting of disclosures support.
• Pre-visit SMS and email delivery lets patients sign before they ever set foot in the office through digital patient intake.
• EHR routing sends the executed release directly into the patient chart via Zentake’s EHR integrations.

Related Forms and Templates

• Notice of Privacy Practices Acknowledgment — the patient signature confirming receipt of your NPP.
• Medical Records Request Form — for patient-initiated copies of their own records.
• Dental Records Release Form — specialty-specific release for dental records and imaging.
• Consent to Treat — treatment consent paired with intake.
• New Patient Registration — the foundational intake form.

Frequently Asked Questions

Is a HIPAA release form the same as a HIPAA authorization?
Yes. “HIPAA release” and “HIPAA authorization” refer to the same document defined under 45 CFR § 164.508. Both authorize a covered entity to use or disclose protected health information for a purpose not otherwise permitted by the Privacy Rule, such as sharing records with a family member, attorney, or life insurance carrier.

Does a HIPAA release form need to be witnessed or notarized?
No. The HIPAA Privacy Rule does not require witnessing or notarization. A patient’s signature and date are sufficient, provided all required elements are present. However, some states impose additional requirements for sensitive categories such as mental health, HIV status, or substance use treatment records.

Are electronic signatures valid on a HIPAA release form?
Yes. Electronic signatures are valid under the federal E-SIGN Act and most state UETA statutes, as long as the signature is verifiable, attributable to the patient, and securely captured. Zentake’s digital release form uses a legally binding electronic signature workflow that meets these requirements.

How long is a HIPAA authorization valid?
HIPAA requires every authorization to include either a fixed expiration date or an expiration event tied to the patient or purpose (for example, “upon completion of my disability claim”). Many practices default to a one-year expiration unless the patient specifies otherwise.

Can a patient revoke a HIPAA release form?
Yes. Patients can revoke an authorization in writing at any time. The revocation applies only to future disclosures; any information already shared in reliance on the authorization remains lawfully disclosed. The release form must inform the patient of this right.

How long do practices need to keep signed HIPAA authorizations?
Under HIPAA, covered entities must retain executed authorizations for at least six years from the date the document was created or last in effect, whichever is later. Some state laws require longer retention. Zentake stores executed forms in HIPAA-compliant, audit-ready storage by default.

Does a HIPAA release form cover mental health or substance use records?
It can, but those categories often require separate opt-in language. Records covered by 42 CFR Part 2 (federally protected substance use disorder records) need a Part 2–compliant authorization that is more restrictive than a standard HIPAA release. Build the form so the patient explicitly authorizes each sensitive category.

References

1. U.S. Department of Health & Human Services. Authorizations — HIPAA FAQs. hhs.gov/hipaa.
2. U.S. Department of Health & Human Services. 45 CFR § 164.508 — Uses and disclosures for which an authorization is required. Office for Civil Rights.
3. Substance Abuse and Mental Health Services Administration. 42 CFR Part 2 Final Rule. SAMHSA, 2024.

Last updated: May 2026.