Sign a records release that gets your files where they need to go

Release, authorization or access request?

Doctor to doctor: HHS explains that a provider may send your records to another provider or health plan as needed for treatment or payment, or with your permission, and HIPAA generally doesn't require a signed authorization for treatment. Many offices still ask you to sign their own release before they send anything — that's their process, and it's usually the quickest way to get it done.

A copy for yourself is a different right: the HIPAA right of access. Your doctor normally has up to 30 days to provide it, may charge only a reasonable fee, and can't refuse because you haven't paid a bill.

Records going to anyone else — a lawyer, a life insurer, an employer, a benefits agency — need a written authorization signed by you. For records kept in an electronic health record, the access rules also let you have an electronic copy sent straight to someone else, with a written, signed request that clearly names the recipient and where to send it.

What a valid authorization must contain

Federal rules (45 CFR 164.508) list the core elements: a specific description of the information to be released; who may release it; who may receive it; the purpose (“at the request of the individual” is enough when you're the one asking); an expiration date or event; and your signature and the date. If a representative signs, the form must describe their authority to act for you.

It must also tell you that you can revoke the authorization in writing, whether treatment or benefits can depend on signing it, and that information released may be passed on by the recipient without HIPAA protection. The form has to be in plain language, and if a provider asks you to sign one, it must give you a copy.

Filling it in so it isn't sent back

Use your full legal name and date of birth, plus any former names your older records might be filed under. Give the releasing provider's full practice name and address — not just a doctor's surname — and the recipient's complete details, including a fax number if they have one.

Be specific about what you want: a date range, and the record types (office notes, lab results, imaging reports, the images themselves on disc, billing records). “All records” may be accepted, but a narrow request is usually handled faster. Set an expiry that fits the job — for example 90 days for a one-off transfer — rather than leaving it open-ended.

Many forms have separate boxes for especially sensitive information such as HIV status, mental health or genetic test results. Tick only what the recipient actually needs. A therapist's psychotherapy notes are kept apart from your medical record, aren't part of the right of access, and can generally only be released with their own authorization.

Send it to the right place

The signed form goes to the provider who holds the records, not to the person who will receive them. That's the most common reason a transfer stalls. If the releasing office has its own release form, use it — offices process their own paperwork fastest. HHS confirms that a copy of a signed authorization, including a fax or an electronically transmitted one, is valid, so a signed PDF normally works.

Fees and how long it takes

For your own copy, a provider must act within 30 days and can extend once by up to 30 more days if it tells you in writing why. The fee may cover only copying labor, supplies and postage — not searching for or retrieving your records — and HHS says it may not be a per-page fee when the records are stored electronically. If the practice has a patient portal, you may be able to view and download much of your record there whenever you want.

HHS notes that this fee limit applies only to your own copy, not to records sent to a third party, so ask the office what it charges for a transfer and how long it usually takes. Follow up after two weeks if nothing has arrived.

Disability claims and other agencies

Some agencies use their own authorization. The Social Security Administration and state disability determination services use Form SSA-827 to request medical evidence for disability claims; if you apply online for yourself, SSA offers its own electronic signing process for it. Use the agency's form when it asks for one rather than a clinic's generic release.

Changing your mind

You can revoke an authorization at any time in writing, except for anything the provider has already done in reliance on it. Send a short signed letter to the releasing provider naming the authorization and the date you signed it, and keep a copy.

Sources

• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.524: Access of individuals to protected health information
• HHS: Your medical records
• HHS: Get it. Check it. Use it.
• HHS FAQ: HIPAA authorizations and electronic exchange
• HHS FAQ: Is a copy of a signed authorization valid?
• HHS: Notice on the right of access after Ciox Health v. Azar
• SSA: Information on Form SSA-827
• SSA: Alternative signature processes for Form SSA-827