The short version
- A patient's own request is a right of access: the provider must act within 30 days, may charge only a reasonable cost-based fee, and must supply the format requested where it is readily producible.
- A third-party authorization permits disclosure but does not require it. No response deadline, no format obligation and no cap on what may be charged.
- Six core elements and three required statements make an authorization valid. The expiry field is where most forms fail — "until revoked" is not a date or an event.
- HIPAA is a floor, not a ceiling. Psychotherapy notes need their own authorization, substance use records are governed separately under 42 CFR Part 2, and several states impose stricter rules and shorter deadlines.
Written for the practice designing its release-of-information process, and for the patient trying to work out why the same request gets two different answers. It describes the federal baseline. State law sits on top of it and frequently demands more, so treat anything below as the starting point rather than the whole picture.
Two instruments, two rulebooks
The distinction turns on a single question: who initiated the request. If it came from the individual or their personal representative, the right of access at 45 CFR 164.524 applies. If it came from anyone else — an insurer, an employer, a law firm, another provider outside treatment, a family member acting informally — you are in authorization territory under 45 CFR 164.508. The obligations diverge sharply from there.
Which rules attach to the request in front of you
Who initiated this request for the records?
The patient or their personal representative
Right of access. Act within 30 days, one 30-day extension with written explanation. Reasonable cost-based fee only, and nothing at all for inspection or portal use. Supply the form and format requested where readily producible.
Anyone else, holding a signed authorization
Disclosure is permitted, not required. No statutory deadline, no format duty, no fee cap — though remuneration must be disclosed where the disclosure amounts to a sale of protected health information.
What makes an authorization valid
Six core elements. Miss any one and the form is defective on its face, which means the disclosure made in reliance on it was not permitted.
| Element | What it must say | How it fails |
|---|---|---|
| The information | The records to be used or disclosed, in specific and meaningful terms | "Any and all records" — too broad to identify what was authorised |
| Who may disclose | The covered entity or class of persons authorised to make the disclosure | Named to a practice that no longer holds the file |
| Who may receive | The recipient or class of recipients | Blank, or a firm name with no individual and no class |
| The purpose | The reason for the disclosure, or "at the request of the individual" | Left as a generic phrase that does not bound the use |
| Expiry | A calendar date, or an event tied to the individual or the purpose | "Until revoked" — neither a date nor an event |
| Signature and date | The individual's signature; a representative must describe their authority | Signed by a relative with no stated basis for acting |
That third statement is the one people skate past, and it is the honest part of the form. A patient signing an authorization for an employer or an insurer is releasing the records from the regime, not merely from the filing cabinet.
What the records lose when they leave
Held by a covered entity
- The entity and its business associates are bound
- Access rights, minimum necessary, breach notification
- A complaint route to the federal regulator
The same file, either side
- Identical clinical content
- The same capacity to harm the patient
- Nothing on the page marking which side it is on
Held by the recipient
- An employer, an insurer, a law firm, a family member
- Federal protection generally stops travelling with it
- Re-disclosure is governed by contract, if anything
Deadlines and fees, on the access side
- Thirty calendar days to act on an access request, with a single 30-day extension available if you tell the individual in writing why. The 30 days is an outer limit, not a target.
- A reasonable cost-based fee — the labour of copying, supplies, and postage where posted. Not search time, not retrieval overhead, not administrative markup.
- Nothing to inspect, and nothing to use a patient portal. Charging for either is a straightforward breach.
- The format requested, paper or electronic, where it is readily producible. "Our system only outputs paper" is a statement about your system, not a defence.
Right-of-access enforcement has been one of the more active areas of federal privacy enforcement, and the cases are notable for how ordinary they are. They are not data breaches. They are a patient asking twice, being ignored, and complaining.
Health information release template
The full text free to read — the six required elements laid out as fields, the three mandatory statements, the revocation clause, and a separate block for the categories that need their own authorization.
The categories a general release does not reach
A single all-purpose release form is the most common design in circulation and the one most likely to under-deliver. Several categories of record sit outside it.
- Psychotherapy notes. These require their own separate authorization and may not be bundled into a general records release. A form that lumps them in has not validly authorised their disclosure.
- Substance use disorder records. Programs covered by 42 CFR Part 2 operate under a stricter consent regime of their own, with its own element list. A HIPAA authorization does not satisfy it.
- HIV, genetic and mental health records. Several states require category-specific forms and attach penalties to unauthorised disclosure. New York, for one, requires an HIV-specific release rather than a general HIPAA authorization.
- Records held by another provider. An authorization naming your practice does not reach a file you do not hold, however complete the request looks.
Who can sign when the patient cannot
A personal representative may exercise the access right and sign an authorization, but the authority has to come from somewhere and the form must say where. A healthcare power of attorney, a guardianship order, a parent's status in relation to a minor: each is a basis, and each has limits. The medical authorization template is the narrow version of this — a document whose only job is to let information reach a named person.
Two frequent traps. A financial power of attorney is not automatically a health-information authority. And a spouse, absent documentation, is not a personal representative merely by being a spouse. The general mechanics of appointing someone, and why the appointment has to be made in advance, are in power of attorney, explained.
Revocation, and what it cannot undo
An individual may revoke an authorization in writing at any time. What revocation does not do is claw back a disclosure already made in reliance on it. That is the practical reason to keep authorizations narrow in scope and short in duration: a broad, open-ended form gives away future disclosures the person cannot recall once they have gone.
For the same reason, a practice should date-stamp the version of the authorization it relied on and record what was released against it. When a dispute arises about scope, the question is what the form permitted on the day, and that is answerable only if you kept the form and the log together.
A request-handling sequence that survives review
- Identify the requester before anything else — individual, personal representative, or third party. This single determination selects the entire rule set.
- Verify identity and, for a representative, the document establishing authority. Record what you checked.
- Check the authorization against the six elements and three statements. A defective form is not a slow request; it is not a request at all, and the correct answer is to say so promptly.
- Screen for the special categories — psychotherapy notes, substance use, and any state-specific class. Release those only against a form that covers them.
- Diarise the deadline on the access track, and send the extension notice in writing before day 30 if you need it.
- Log what was disclosed, to whom, under which version of which form, and on what date.
The design decision underneath all of this
Most of the failures here are not legal misunderstandings. They are the consequence of one intake form and one workflow being asked to serve two regimes with opposite defaults. Access is mandatory, fast, cheap and format-specific. Authorization is discretionary, undated, uncapped and narrow. A process that cannot tell them apart at the front door will get one of them wrong every time.
The cheapest fix is a single question at the top of the form, answered before anything else: is the person asking for these records the person the records are about? Everything downstream follows from that.
Sources
General information, not legal advice. This guide explains how these documents and rules generally work. Law varies by jurisdiction and changes, and none of it is applied to your circumstances here. For anything consequential, consult a licensed attorney where you are.
Frequently asked
Does a provider have to respond to a third-party authorization?
No. A valid authorization permits a disclosure; it does not compel one. There is no statutory deadline, no obligation to supply a particular format, and no cap on the fee, though remuneration must be disclosed where the disclosure amounts to a sale of protected health information. A patient's own access request is the opposite on every one of those points.
How long does a HIPAA authorization last?
For as long as the form says, which is why the expiry field is required. It must state a calendar date, or an event tied to the individual or the purpose — the end of a claim, for instance. "Until revoked" satisfies neither and makes the authorization defective. Narrow, dated authorizations are better for both sides than open-ended ones.
Can I be charged for a copy of my own medical records?
A reasonable cost-based fee is permitted: the labour of copying, supplies, and postage if posted. Search and retrieval time and administrative overhead are not chargeable. Inspecting your records, and viewing them through a patient portal, must be free. Some states cap fees further or set shorter response deadlines than the federal 30 days.
Are therapy notes covered by a general records release?
No. Psychotherapy notes require their own separate authorization and cannot be combined with a general release. Substance use disorder records held by programs under 42 CFR Part 2 are governed by a separate consent regime with its own element list, and several states add category-specific rules for HIV, genetic and mental health records.
Can I revoke an authorization after signing it?
Yes, in writing, at any time — and the form is required to tell you so and to describe any exceptions. Revocation is forward-looking only. It does not undo a disclosure already made while the authorization was live, which is the argument for keeping the scope and duration tight when you sign in the first place.