A Medical Records Release Form (also called an Authorization for Release of Protected Health Information) is a legal document that grants permission for a healthcare provider, hospital, or medical facility to disclose a patient's protected health information (PHI) to a specified third party. This form is required by federal law whenever medical records are shared outside the treatment, payment, or healthcare operations context.

The Health Insurance Portability and Accountability Act (HIPAA), specifically the Privacy Rule at 45 CFR Part 164, establishes strict requirements for the release of medical records. Under 45 CFR Section 164.508, a valid authorization must contain specific elements including a description of the information to be disclosed, the identity of the recipient, the purpose of the disclosure, an expiration date, and the individual's right to revoke the authorization. Releases that fail to include these elements are not considered valid authorizations under HIPAA and healthcare providers must refuse to comply with them.

Beyond HIPAA, state laws may impose additional protections for certain categories of health information. Mental health records, substance abuse treatment records (protected under 42 CFR Part 2), HIV/AIDS status, genetic testing results, and reproductive health records often require separate, more specific authorizations. Some states, like California (Confidentiality of Medical Information Act, Cal. Civ. Code Section 56) and New York (Public Health Law Section 18), have privacy protections that exceed HIPAA requirements. The medical records release form must comply with both federal and the more stringent applicable state law.

A medical records release is needed whenever a patient wants their health information shared with someone outside their current treatment team. The most common scenario is transferring records to a new physician or specialist when changing healthcare providers. A patient moving to a new city, switching insurance networks, or seeking a second opinion needs to authorize their former provider to send records to the new one.

Legal proceedings frequently require medical records releases. Personal injury attorneys need their client's medical records to prove the extent of injuries and calculate damages. Workers' compensation claims require the release of treatment records related to the workplace injury. Disability applicants filing with the Social Security Administration must authorize release of records supporting their disability claim under SSA regulations.

Insurance applications — particularly for life insurance and long-term disability insurance — typically include authorization for the insurer to obtain applicant medical records. Employers requesting medical clearance for return-to-work evaluations or pre-employment physicals may need specific releases. Family members managing care for elderly or incapacitated patients need releases unless they hold healthcare power of attorney. Without a properly executed release form, healthcare providers are legally prohibited from disclosing records, and unauthorized disclosure exposes them to HIPAA penalties ranging from $100 to $50,000 per violation.

A HIPAA-compliant medical records release must include the patient's full legal name, date of birth, address, and a unique identifier such as a medical record number or Social Security number. The name and address of the entity authorized to release the records — the specific hospital, clinic, or physician's office — must be identified, along with the name and address of the person or organization authorized to receive the records.

A specific description of the information to be disclosed is required — rather than a blanket release of "all records," the form should specify the types of records (office visit notes, lab results, imaging reports, surgical records, prescription history) and the date range of treatment. For specially protected categories — mental health records, substance abuse treatment, HIV status, and genetic information — HIPAA and state laws require separate explicit authorization beyond a general medical records release.

The purpose of the disclosure must be stated: continuing care, legal proceedings, insurance underwriting, employment clearance, or personal records. An expiration date or triggering event for the authorization is required under HIPAA — common formulations include a specific calendar date, "one year from signing," or "upon resolution of the legal case." The form must include a statement that the patient has the right to revoke the authorization in writing at any time, except to the extent that the healthcare provider has already acted in reliance on it.

A notice that information disclosed pursuant to the authorization may no longer be protected by HIPAA once received by the third party should be included. The form must be signed and dated by the patient or their legally authorized representative. If signed by a representative, documentation of their authority (power of attorney, guardianship order, or parental relationship for minors) must accompany the form. Healthcare providers should retain a copy of the signed authorization for a minimum of six years as required by HIPAA.