HIPAA Forms: By State

• Alabama
• Alaska
• Arizona
• Arkansas
• California
• Colorado
• Connecticut
• Delaware
• Florida
• Georgia
• Hawaii
• Idaho
• Illinois
• Indiana
• Iowa
• Kansas
• Kentucky
• Louisiana
• Maine
• Maryland
• Massachusetts
• Michigan
• Minnesota
• Mississippi
• Missouri
• Montana
• Nebraska
• Nevada
• New Hampshire
• New Jersey
• New Mexico
• New York
• North Carolina
• North Dakota
• Ohio
• Oklahoma
• Oregon
• Pennsylvania
• Rhode Island
• South Carolina
• South Dakota
• Tennessee
• Texas
• Utah
• Vermont
• Virginia
• Washington
• Washington D.C.
• West Virginia
• Wisconsin
• Wyoming

How to Fill Out a HIPAA Release Form

To fill out a HIPAA release form, a patient must choose the appropriate document. The form must allow them to request their personal health information (PHI) or grant a third party permission to release it. Depending on the form’s purpose, the individual can select a state-specific document or complete a generic template.

Each medical release document has fields that allow the person to explain the reason(s) for completing it. To ensure they have filled out the HIPAA release form correctly, they must enter the necessary information in the blanks provided and check the appropriate boxes. Once written, the sender must submit it to the required third party or entity by mail, fax, or email.

When filling out a HIPAA authorization form, include the following:

• The patient’s name, date of birth, address, and phone number;
• The name and contact information of the hospital or doctor who currently holds the patient’s medical records;
• The name and contact information of the person or entity who will receive the medical records;
• The purpose of the release (i.e., personal use, insurance, or legal purposes);
• The date(s) of the service, treatment, test results, or other related health data;
• The specific information to release (e.g., lab results, x-ray images, and operative reports);
• The delivery method (i.e., mail, email, fax, or CD).

While there is no standard or universal form, the form must be HIPAA-compliant, meaning it meets all requirements to be considered legal and binding. Therefore, all HIPAA release forms must:

• State the authorization is both completely voluntary, and the patient may revoke the permission at any time;
• State there is a risk that the entity to whom the protected health information is released may disclose it without consent to someone else;
• Use plain language that is easily understandable to the patient; and
• Indicate an expiration date for the authorization.

Reasons for Completing a Medical Release Form

An individual completes a medical release form to give consent to a hospital, doctor, or other facilities so they can release the patient’s PHI to the individual or a third party. The document has great importance in the medical world since it has many purposes. Doctors can use it to determine a patient’s treatment, while insurance companies use it when billing individuals. The HIPAA Privacy Rule reassures the general public that unwanted parties do not access their medical files. At the same time, the release form ensures that the right people obtain, discuss, or review the patient’s information.

There are a variety of scenarios when HIPAA authorization is necessary. The following examples are common uses for a medical release form.

• A person diagnosed with Alzheimer’s disease needs help managing appointments and medications.
• An employee must release the results of a recent drug test to an employer.
• A rehabilitation hospital wishes to showcase a person’s recovery in marketing campaigns.
• A life insurance company needs access to an individual’s medical history to determine eligibility.

Each situation necessitates a HIPAA release form from the patient. Without a medical information release form, the patient and third party cannot send or receive the protected health information (PHI).

HIPAA Release Form Templates

Can a Spouse Sign a HIPAA Release Form?

No, a spouse cannot sign a HIPAA release form. According to HIPAA Privacy Rule 45 (§ CFR 164.510), a spouse, family member, or friend cannot sign a HIPAA release form for a patient. Instead, patients must complete and sign the HIPAA form on their own.

HIPAA Privacy Rule 45 exists to protect individuals from unwanted breaches in privacy. As a result, family members, including spouses, are blocked from retrieving their loved one’s medical information. There are no exceptions to this law. For example, if the patient becomes incapacitated and cannot sign a HIPAA release form, it does not give spouses or relatives the ability to access the health records.

However, the law allows spouses or family members to access the patient’s PHI if they have previously given them written authority. In other words, the individual must complete a document (such as a medical power of attorney) that assigns a loved one as their personal representative. The family member must present the signed form to the third party to complete or sign a medical information release.

Fillable HIPAA Release Forms

Frequently Asked Questions (FAQ)

The following list contains questions and answers for medical records release authorization forms. If the index does not include a specific topic or subject, reference local law to ensure that the HIPAA release form complies with the state’s requirements.

• What is a HIPAA Release Form?
• How to Get a HIPAA Release Form
• How Long is a HIPAA Release Good For?
• Do HIPAA Release Forms Need to be Notarized?

What is a HIPAA Release Form?

A HIPAA release form is a document that makes it possible for a person to obtain their own medical records or allow an entity to give the information to a third party. The purpose of a medical records release authorization is to provide the patient or third party with the PHI when treating the individual, determining payment, or handling other day-to-day billing operations.

How to Get a HIPAA Release Form

In some situations, the doctor or hospital requires that the patient complete a HIPAA authorization form that they only provide. For example, office staff can mandate that patients fill out a specific document to obtain their surgery procedure notes. However, in cases where the individual needs to create a generic HIPAA release document, they can download and print a template from online sources. Regardless of the format, the authorization often requires specific information to ensure that the person writing it requests or grants the desired permissions.

How Long is a HIPAA Release Good For?

A HIPAA release form is good until it reaches the expiration date set by the person who created the document. Setting a termination date prevents third parties or entities from accessing the information for a prolonged period. If the principal does not include an end date, it lasts indefinitely or until the individual completes a revocation form. Revoking the document means that the principal takes away the ability for another party to view, discuss, or release their PHI.

Do HIPAA Release Forms Need to be Notarized?

HIPAA release forms generally do not require signatures from Notary Publics. However, laws vary by state and medical facilities, so it is critical to reference local notarization requirements. The state often requires the individual granting authority to sign the medical release form. In some cases, a document requires a witness’ signature. Most commonly, a witness signs when an individual requests the release of PHI, such as HIV/AIDS, psychiatry or behavioral health, sexually transmitted diseases, or drug and alcohol abuse.

HIPAA Release Laws: By State

States can follow HIPAA laws or create their own rules for patient information. According to HIPAA, providers have thirty (30) days from a patient’s request to provide them with PHI. Certain states abide by this law; however, others have modified the amount of time required.

The table below lists the number of days the provider has after the “request date” to issue the patient their medical records. The abbreviation “N/A” represents states that do not have release statutes or use language such as “within a reasonable time frame.”

Key Takeaways

By default, an individual’s protected health information remains private from those not directly involved in their medical care or treatment, including spouses and family members. An individual who releases their PHI does so at their discretion. When situations require the release of medical records, begin by compiling the necessary information and researching the state or medical facility’s policies. As long as HIPAA authorization forms are compliant with HIPAA’s rules, a person may use a template or generic document.