A Medical Records Release Authorization is a legal document that grants a healthcare provider permission to disclose a patient's protected health information (PHI) to a specified third party for a defined purpose. Under the Health Insurance Portability and Accountability Act (HIPAA) — specifically the Privacy Rule at 45 CFR Part 164 — covered entities (healthcare providers, health plans, and healthcare clearinghouses) are prohibited from disclosing PHI without a valid written authorization from the patient, except in limited circumstances permitted by the regulation.

A valid HIPAA authorization must meet specific content requirements outlined in 45 CFR Section 164.508(c). It must describe the information to be disclosed, identify the person authorized to make the disclosure, identify the recipient, describe the purpose, include an expiration date or event, and be signed and dated by the patient. Authorizations that fail to include these required elements are considered defective and cannot legally be relied upon by the covered entity to disclose records.

Beyond HIPAA, individual states have enacted their own health privacy laws that may impose additional or more restrictive requirements. For example, California's Confidentiality of Medical Information Act (CMIA) under Civil Code Section 56.11 requires authorizations to be handwritten by the patient or printed in at least 14-point type. New York's Public Health Law Section 18 provides specific access rights and timelines for record delivery. Many states impose heightened protections for particularly sensitive categories of records, including HIV/AIDS testing results, substance abuse treatment records (also protected under federal regulation 42 CFR Part 2), mental health records, and genetic information.

The patient retains the right to revoke the authorization at any time in writing, though revocation does not apply to disclosures already made in reliance on the prior authorization.

When transferring care to a new physician or specialist who needs access to the patient's medical history, diagnostic results, treatment records, and medication lists to provide continuity of care.

When applying for disability benefits through Social Security (SSDI/SSI) or a private insurer, which requires medical documentation to evaluate the claim and verify the nature and extent of the disability.

When involved in a personal injury lawsuit, workers' compensation claim, or medical malpractice case where the patient's medical records are necessary to establish the nature and causation of injuries and the cost of treatment.

When an insurance company requests medical records to process a claim, evaluate coverage, or conduct a utilization review of proposed treatment.

When a patient or their estate needs records for a life insurance application, long-term care qualification, or Veterans Affairs (VA) benefits claim.

When a parent or legal guardian needs to authorize release of a minor child's records to a school, camp, sports organization, or new pediatrician.

Without a valid written authorization, healthcare providers are legally prohibited under HIPAA from releasing patient records to third parties (outside of treatment, payment, and healthcare operations). Attempting to obtain records without proper authorization results in denial, delays in legal proceedings, and potential gaps in medical care that can affect treatment outcomes.

Patient identification — full legal name, date of birth, Social Security number or medical record number (for accurate identification), current address, and phone number. Accurate identification prevents records from being sent to or about the wrong individual.

Records holder identification — the name, address, and contact information of the healthcare provider, hospital, clinic, or entity currently in possession of the records to be released.

Recipient identification — the full name and address of the person, organization, or entity authorized to receive the records. HIPAA requires that the authorization specifically identify who is authorized to receive the information.

Description of records to be released — a specific description of the information authorized for disclosure, such as complete medical records, records from a specified date range, specific diagnostic test results, imaging studies, psychiatric or psychological records, substance abuse treatment records, or HIV-related information. Broader authorizations allow more disclosure than may be intended.

Purpose of the release — the reason the records are being requested, such as continuity of care, legal proceedings, insurance claims, disability evaluation, or personal records. HIPAA permits the purpose to be stated as "at the request of the individual" but specificity is preferred.

Expiration date or event — HIPAA requires that the authorization include a date or event upon which it expires. Common expiration terms include a specific calendar date, completion of a legal matter, or a period such as 90 days or one year from the date of signing.

Right to revoke — a statement informing the patient that they may revoke the authorization at any time in writing, and instructions for how to do so, as required by 45 CFR Section 164.508(c)(2)(i).

Statement regarding re-disclosure — a notice that information disclosed pursuant to the authorization may no longer be protected by HIPAA once it reaches the recipient, as required by the Privacy Rule.

Patient signature and date — the authorization must be signed and dated by the patient or their legally authorized representative. For minors, the signature of a parent or guardian is required. For incapacitated adults, the signature of a healthcare agent, guardian, or court-appointed representative is necessary.