Medical Records Release: HIPAA Authorizations and How to Request Records

Doctors and hospitals generally cannot share your health information without your permission. A signed medical records release, often called a HIPAA authorization, lets you choose who may receive it.

What an authorization includes

• Your name and identifying details.
• The person or organization allowed to receive records.
• What information is covered and for what purpose.
• An expiration date or event.
• Your signature and date, and a statement that you can revoke it.

Why people use them

• Sharing records with a new doctor.
• Insurance claims and benefits.
• Legal cases, such as an injury claim.
• Helping a family member or caregiver.

Know your rights

You generally have the right to access and get a copy of your own records, though providers may charge reasonable fees. Be careful with broad authorizations that open your entire history, especially when an insurer asks you to sign one.

Revoking permission

1. Send a written revocation to the provider.
2. Keep a copy.
3. Understand that disclosures already made may not be undone.

HIPAA basics in plain English

The federal privacy rule known as HIPAA limits how doctors, hospitals, insurers and certain other covered entities may share your health information. They can use and share it for treatment, payment and health care operations, but most other disclosures need your written authorization. HIPAA also gives you rights to see and get copies of your records, request corrections and receive an accounting of certain disclosures.

Elements of a valid authorization

1. A specific description of the information to be released.
2. The name of the person or organization allowed to disclose it.
3. The name of the person or organization allowed to receive it.
4. The purpose of the disclosure.
5. An expiration date or event.
6. A statement of your right to revoke it in writing.
7. Your signature and date.

Special categories of records

• Psychotherapy notes have extra protection.
• Substance use treatment records may have separate federal rules.
• Records related to HIV, genetic testing or reproductive care may be treated specially by state law.
• Minors' records have special rules depending on state law and who consented.
• Ask the provider about any additional forms.

Limiting what you release

Insurers and lawyers sometimes ask for broad authorizations that cover all medical history. You may be able to limit the release to records related to the claim and a defined period. Ask questions before signing and keep a copy of what you signed. For injury claims, ask your lawyer which records are needed.

Requesting your own records

• Send a written request to the provider's medical records department.
• Providers must usually respond within 30 days, with limited extensions.
• They may charge reasonable fees for copying.
• You can often get electronic copies.
• See our guide to medical power of attorney.

Frequently asked questions