HIPAA Release Forms: What They Need to Include and Why
A HIPAA authorization — commonly called a HIPAA release — is the patient's written permission for a covered entity to use or disclose their protected health information for a purpose that is not otherwise permitted under the Privacy Rule. The authorization must contain specific elements listed in 45 CFR 164.508(c). If any required element is missing, the authorization is defective and the disclosure is a HIPAA violation — even if the patient clearly intended to consent.
Required Elements
The Privacy Rule requires every valid authorization to include: a specific and meaningful description of the information to be disclosed, the name or class of persons authorized to make the disclosure, the name or class of persons to whom the disclosure may be made, a description of the purpose of the disclosure, an expiration date or event, and the individual's signature and date. Our HIPAA Release form includes all six elements in a structured, fillable format designed to withstand compliance review.
Right to Revoke
The authorization must inform the individual of their right to revoke the authorization in writing, and the exceptions to that right (disclosures already made in reliance on the authorization before revocation). This statement is not optional — it is a required element. Many template HIPAA releases circulating online omit it or bury it in fine print, which is a compliance risk.
Conditioning Prohibition
A covered entity generally cannot condition treatment, payment, enrollment, or eligibility on the patient signing an authorization. The authorization must state whether the covered entity is conditioning any of these on the authorization. There are narrow exceptions — for example, a provider may condition research-related treatment on an authorization for the use of PHI for that research — but the general rule is that the patient must be told they can refuse to sign without losing access to care.
Psychotherapy Notes
Psychotherapy notes (as defined under HIPAA — the therapist's personal process notes, not the medical record) require a separate authorization that cannot be combined with an authorization for other PHI. If your practice involves behavioral health, your HIPAA release form should either exclude psychotherapy notes explicitly or be a dedicated psychotherapy-notes authorization. Combining them in a single form makes the entire authorization invalid for the psychotherapy notes.
Common Mistakes
The most common defects in HIPAA release forms: no expiration date (makes the authorization invalid), vague description of the information to be disclosed ("all medical records" may not be specific enough in some contexts), missing right-to-revoke language, and using an authorization form for disclosures that are already permitted under the Privacy Rule (treatment, payment, healthcare operations) — which creates unnecessary patient friction without any compliance benefit.
Related Forms You Might Need
- Acupuncture — $19.99
- Chiropractic — $19.99
- Dental — $19.99