HIPAA Release Form Template: Free Authorization Form for Medical Records and Photos

This page gives you a free, editable HIPAA authorization template in three versions: a general authorization, a medical records release, and a photo/video release. Each required field is explained in plain English and tied to the regulation, so your privacy officer can check it line by line. The template is a starting point. Whether your authorizations are valid still depends on legal review, state add-ons, and how your practice stores and tracks signed forms.

Download the free HIPAA authorization form template

Three variants are available:

Variant	What it's for	Who signs
General authorization to use or disclose PHI	Disclosures that need patient permission, such as to an employer, attorney, or life insurer	Patient or personal representative
Medical records release (release of information)	Sending a defined set of records to a named third party	Patient or personal representative
Photo/video release	Using identifiable patient images in marketing, on your website, or on social media	Patient or personal representative

This template is not legal advice. Have your privacy officer or counsel review it, and add any state addenda, before staff hand it to a patient.

For related documents, browse our free HIPAA tools and templates, including patient intake form templates.

What makes an authorization form HIPAA compliant

A HIPAA authorization is valid only if it contains specific core elements and required statements. It must also be written in plain language. The table below maps each requirement to a field on the template. Confirm each one against the current regulation text before use.

Core elements (45 CFR 164.508(c)(1))

Required element	Template field	Notes for staff
Specific, meaningful description of the information	"Information to be used or disclosed"	"Lab results and visit notes, 01/2023–06/2024" is specific. "All records" may not be specific enough.
Who is authorized to make the disclosure	"From (practice / provider)"	Use your legal practice name. List each location if you are a multi-location group.
Who receives the information	"To (recipient name and address)"	A named person or organization.
Purpose of the disclosure	"Purpose"	"At the request of the individual" may be enough when the patient initiates the request.
Expiration date or event	"This authorization expires on"	A date, or an event related to the patient or purpose.
Signature and date	Signature block	Signature of the patient or personal representative.
Representative's authority, if applicable	"If signed by a personal representative"	Relationship and basis of authority, such as parent, guardian, POA, or executor.

Required statements (45 CFR 164.508(c)(2))

• Right to revoke. The patient may revoke the authorization in writing. The form states how and to whom, or refers to your Notice of Privacy Practices. The template has a "Revocation contact" field.
• Conditioning. Whether treatment, payment, enrollment, or eligibility can be conditioned on signing. In most cases, they cannot; the rule lists narrow exceptions.
• Redisclosure. Information disclosed under the authorization may be redisclosed by the recipient and may no longer be protected by HIPAA.

Plain language and patient copy. The form must be written in plain language. If your practice asks for the authorization, you must give the patient a copy of the signed form (45 CFR 164.508(c)(3)-(4)).

What makes an authorization defective (45 CFR 164.508(b)(2)-(3))

• The expiration date has passed or the expiration event has occurred.
• A core element or required statement is missing or not filled in.
• The practice knows it has been revoked.
• The practice knows that material information on the form is false.
• It was combined with another document in a way the rules don't allow. For example, an authorization buried in a general consent-to-treat packet is a compound authorization problem.

When you need an authorization and when you don't

Front desk staff often ask patients for an authorization when none is needed. Sometimes they do the reverse. Use this table as a starting point:

Request	Authorization needed?	Notes
Sending records to a referring or treating provider	Generally no	Treatment disclosure (45 CFR 164.506)
Sending claims data to a health plan for payment	Generally no	Payment disclosure (45 CFR 164.506)
Internal quality review, audits, staff training	Generally no	Health care operations (45 CFR 164.506)
Patient requests a copy of their own records	No	Right-of-access request, not an authorization (45 CFR 164.524)
Patient's employer, attorney, or life insurer requests records	Yes	No TPO exception applies (45 CFR 164.508(a))
Using patient information or photos for marketing	Usually yes	Limited exceptions (45 CFR 164.508(a)(3))
Disclosing psychotherapy notes	Yes, with narrow exceptions	Requires its own authorization (45 CFR 164.508(a)(2))
Sale of PHI	Yes	Must state that remuneration is involved (45 CFR 164.508(a)(4))

Right of access is not an authorization. When patients ask for their own records, process the request as an access request. HHS guidance says practices should not require patients to sign an authorization form to get their own records. You may use a simple access request form, but it must not create barriers or delays (45 CFR 164.524). If a patient asks you to send their records to a third party, check with your privacy officer whether to handle it as an access request or as an authorization.

Medical records release (release of information) version

The ROI version asks for these fields:

• Patient identifiers: full name, date of birth, any former names, and medical record number if known.
• Records requested: a date range and record types, with checkboxes for visit notes, lab results, imaging reports, billing records, and immunization records.
• Sending party: your practice and the specific location holding the records.
• Receiving party: name, organization, address, and fax or secure delivery details.
• Delivery method: only the methods your practice supports, such as mail, secure email, fax, or pickup.
• Purpose: for example, "continuing care with new provider" or "legal matter."
• Expiration: a date or event.
• Signature and date, with the required statements printed above the signature line.

Personal representatives. The form includes a section for parents or guardians of minors, people with healthcare power of attorney, and executors or administrators of a deceased patient's estate. Staff should collect proof of authority, such as guardianship papers or letters testamentary. Minors' consent rules vary by state. In some states, a minor can consent to certain care, and the parent may not have access to those records.

Specially protected records. Some categories require separate, explicit consent or initials. They should not be released under a general checkbox:

• Substance use disorder records covered by 42 CFR Part 2
• HIV/AIDS and STI test results, under many state laws
• Mental health records, including psychotherapy notes
• Genetic testing results, under many state laws

The template gives each category its own initial box. If a box is blank, the category isn't released.

Front desk tips:

1. Check that every field is complete before you log the request. Incomplete forms are defective.
2. Verify the requester's identity using your practice's ID policy, especially for representatives and third-party pickups.
3. Write the received date and the staff member's initials on the form. Your turnaround tracking starts from that date.

Photo and video release version

When you need it. Use this release when identifiable patient images will be used for marketing, on social media, on your website, in before-and-after galleries, or in testimonials. These uses generally require an authorization under the marketing rules (45 CFR 164.508(a)(3)).

When it's usually not needed. Clinical photos taken for treatment and kept in the medical record generally fall under treatment. They usually don't need a separate HIPAA authorization, though your practice may still want written consent.

Fields included:

• Description of the images, such as "before-and-after photos of left knee, taken 03/2025."
• Specific uses and channels, as checkboxes: website, Instagram, Facebook, printed brochures, presentations.
• Whether the patient will be identifiable by face, name, tattoos, or other features.
• Any compensation or discount offered for participating.
• Expiration date or event.
• Right to revoke and the revocation contact.
• The conditioning and redisclosure statements.

Revocation doesn't undo publication. Once a photo is posted or printed, revoking the authorization stops future use. It can't recall copies already shared, screenshotted, or distributed. The template says this plainly above the signature line; have counsel confirm the wording.

State rules: California and other stricter requirements

HIPAA sets a federal floor. State laws that are more protective of patient privacy still apply alongside it (45 CFR 160.203). No single federal form satisfies every state.

California. The Confidentiality of Medical Information Act (CMIA) has its own authorization requirements under Cal. Civ. Code 56.11. These include formatting rules, such as a minimum type size or a separately signed section, plus required elements that overlap with HIPAA's but are not identical. California practices should use a CMIA addendum or a California-specific version of the form.

Other states. Before you use the template in another state, check state rules on:

• Minors' consent and parental access
• Mental health records
• HIV and STI test results
• Genetic information

Multi-location groups. Keep one master template with the federal elements. Add a short addendum for each state where you operate, and file the addenda next to the master so front desk staff in each state pull the correct combination.

Handling signed authorizations inside your practice

Storage and copies. Store signed forms in the medical record or your designated record system. Give the patient a copy. Keep forms for at least six years from the date they were created or last in effect, whichever is later (45 CFR 164.530(j)).

Expirations and revocations. Log each authorization's expiration and watch for revocations. When a patient revokes in writing, staff must stop disclosing under that form going forward. A shared log with the patient, form type, expiration, and revocation date catches most errors.

Sending records out. When records go by fax, use our confidential fax cover sheet template. If you plan to collect authorizations through online forms, first check whether Google Forms, Microsoft Forms and other form builders are HIPAA compliant and whether the vendor will sign a BAA.

Chanty's planned tools. Chanty's HIPAA-compliant form builder (planned) and e-signature tool are not available yet. They can't collect, sign, or send authorizations today. For now, read our HIPAA e-signature guide before you choose a vendor.

Coordinating the work internally. Chanty is internal team chat for staff. It doesn't send forms to patients, store official records, or replace your EHR. It can keep a release-of-information request from stalling. For example:

1. The front desk receives a request and posts it in an ROI channel.
2. Someone turns the message into a task with an owner and a due date.
3. Medical records staff mark the task done when the request is fulfilled, and the follow-up stays visible to the team.

This happens alongside your record systems, not instead of them. HIPAA-compliant chat for staff with a signed BAA is available on the Business and Enterprise plans. The Free plan has no BAA and should not be used for PHI. Third-party integrations such as Google Drive or Dropbox fall outside Chanty's BAA. See Chanty security, HIPAA and BAA details.

Checklist before you put the template into use

• Your privacy officer or counsel has reviewed the template and every state addendum.
• You've filled in your practice name, the revocation contact, and only the delivery methods you actually support.
• Front desk staff are trained on the difference between a right-of-access request and an authorization.
• Staff know which record categories need separate initials.
• One named person owns the log of requests, expirations, and revocations.
• A process is in place to give every patient a copy of the signed form.
• An annual review date is on the calendar, with an extra review whenever regulations change.

FAQ

What is a HIPAA compliant authorization form?

It is a signed document that gives a practice permission to use or disclose PHI for a purpose HIPAA doesn't otherwise permit. To be valid, it must contain the core elements and required statements in 45 CFR 164.508(c), be written in plain language, and be unexpired and unrevoked. A template helps you include those elements, but it doesn't guarantee a valid authorization on its own.

What is the difference between a HIPAA authorization and a medical records release form?

A medical records release is a common type of HIPAA authorization, focused on sending records to a third party. "Authorization" is the broader term. It also covers marketing, photos, psychotherapy notes, and other uses.

Does a patient need to sign an authorization to get a copy of their own records?

No. That is a right-of-access request. Practices should not require an authorization to fulfill it (45 CFR 164.524).

How long is a HIPAA authorization valid?

Until the expiration date or event written on the form, or until the patient revokes it. HIPAA doesn't set a maximum duration, but state law may.

Can a patient revoke a HIPAA authorization, and how?

Yes, in writing, using the process stated on the form. Revocation stops future disclosures. It doesn't undo disclosures already made in reliance on the form (45 CFR 164.508(b)(5)).

Do I need a HIPAA compliant photo release form to post patient photos on social media?

Generally yes, when the photos identify the patient and are used for marketing or promotion (45 CFR 164.508(a)(3)). Confirm your wording with counsel.

Is there a separate HIPAA authorization form for California?

HIPAA itself has no state version. California's CMIA adds its own requirements under Cal. Civ. Code 56.11, so California practices should use a CMIA-compliant version or addendum.

Can I collect HIPAA authorizations with an online form or e-signature?

Often yes, if the vendor handles PHI under a signed BAA and the electronic signature meets applicable requirements. Chanty's form builder and e-signature tools are planned, not live.

How long do we have to keep signed authorization forms?

For at least six years from the date created or last in effect, whichever is later (45 CFR 164.530(j)), or longer if state law or your record retention policy requires it.