Medical Records Authorization

HIPAA AUTHORIZATION / MEDICAL RECORDS REQUEST PREPARATION PACKET

Use this packet to prepare one of two different documents. Select the route before completing the form.

☐ Route A — HIPAA authorization. The patient authorizes a covered entity to use or disclose specifically described health information to a named person or class of persons. Complete Part A.

☐ Route B — individual access request. The patient requests access to records in a designated record set. Complete Part B. A direction to transmit records to another person requires the court-order screen in Part B3.

Do not submit both routes as one document unless the receiving provider confirms that its process accepts them together. Compare this packet with any current form offered by the provider before submission.

PREPARATION INFORMATION

Patient legal name: [PATIENT LEGAL NAME]

Other names used for treatment: [OTHER NAMES OR "NONE"]

Date of birth: [__/__/____]

Medical-record or account number, if known: [RECORD / ACCOUNT NUMBER]

Address: [PATIENT ADDRESS]

Telephone: [PATIENT TELEPHONE]

Email: [PATIENT EMAIL]

Provider or record holder: [NAME, DEPARTMENT, ADDRESS, TELEPHONE, FAX, AND SECURE-PORTAL INFORMATION]

PART A — AUTHORIZATION FOR USE OR DISCLOSURE

A1. PERSONS AUTHORIZED TO DISCLOSE

I authorize the following person, provider, facility, health plan, or specifically identified class of persons to use or disclose the information described below:

[NAME OR SPECIFIC CLASS, ADDRESS, AND CONTACT INFORMATION]

This authorization applies to the following additional locations or custodians, if any:

[ADDITIONAL LOCATIONS / CUSTODIANS OR "NONE"]

A2. PERSONS AUTHORIZED TO RECEIVE

The information may be disclosed to:

Recipient name or specific class: [RECIPIENT NAME OR CLASS]

Organization: [ORGANIZATION OR "NONE"]

Delivery address: [MAILING OR STREET ADDRESS]

Secure email / portal / fax: [DELIVERY INFORMATION]

Telephone: [RECIPIENT TELEPHONE]

A3. INFORMATION TO BE USED OR DISCLOSED

Date range — required: From [__/__/____] through [__/__/____]

Select and describe the records specifically enough for the holder to identify them:

☐ Complete medical record for the date range above

☐ History and physical examinations

☐ Office, clinic, and progress notes

☐ Hospital admission and discharge records

☐ Operative and procedure reports

☐ Diagnostic images and image reports

☐ Laboratory and pathology reports

☐ Medication and prescription records

☐ Billing records, itemized statements, and payment history

☐ Insurance claims and explanation-of-benefits records

☐ Rehabilitation, therapy, or functional-capacity records

☐ Other specifically described information: [RECORD TYPE / ENCOUNTER / BODY PART / PROVIDER]

Express exclusions: [RECORDS NOT AUTHORIZED FOR DISCLOSURE OR "NONE"]

A4. SENSITIVE-RECORD SCREEN

These selections flag records for additional legal and provider review. Checking a line does not by itself establish that this packet satisfies every federal, state, tribal, or local consent rule.

☐ Psychotherapy notes may be involved. Do not include them in this general authorization; prepare a separate psychotherapy-notes authorization.

☐ Records subject to 42 C.F.R. Part 2 may be involved. Obtain a Part 2 review and use a consent containing every applicable § 2.31 element. Do not treat this general authorization as automatically sufficient.

☐ Mental-health records other than psychotherapy notes may be involved.

☐ HIV, STI, communicable-disease, or genetic-testing information may be involved.

☐ Reproductive-health information may be involved.

☐ Records concern a minor, a deceased person, or a patient whose representative authority requires confirmation.

☐ Research, school, employment, workers' compensation, correctional, military, or tribal records may be involved.

☐ Other specially protected or restricted information: [DESCRIPTION]

Additional consent, initials, witness, or form required after legal/provider review: [DESCRIBE OR "NONE IDENTIFIED"]

A5. PURPOSE

Select one:

☐ At my request.

☐ Other purpose: [SPECIFIC PURPOSE]

A6. EXPIRATION DATE OR EVENT

This authorization expires on the following date or upon the following event related to me or the purpose of this authorization:

[EXPIRATION DATE OR EVENT — REQUIRED; DO NOT LEAVE BLANK]

There is no default expiration period in this packet.

A7. REQUIRED NOTICES

Revocation. I may revoke this authorization in writing at any time. I will send the revocation to [PRIVACY OFFICER / OFFICE, ADDRESS, FAX, OR SECURE-PORTAL ROUTE]. Revocation will not affect action already taken in reliance on this authorization. If this authorization was obtained as a condition of insurance coverage, other law may preserve an insurer's right to contest a claim or the policy.

Conditioning — select the accurate statement after provider review:

☐ The provider or plan may not condition treatment, payment, enrollment, or eligibility for benefits on whether I sign this authorization.

☐ The provider or plan may condition [RESEARCH-RELATED TREATMENT / PRE-ENROLLMENT ELIGIBILITY, ENROLLMENT, UNDERWRITING, OR RISK RATING (NOT PSYCHOTHERAPY NOTES) / HEALTH CARE SOLELY TO CREATE INFORMATION FOR A THIRD PARTY] on this authorization. If I refuse to sign, the consequence is: [SPECIFIC CONSEQUENCE].

Redisclosure. Information disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by the HIPAA Privacy Rule. Other law may continue to restrict use or disclosure.

Copy. If the covered entity seeks this authorization from me, it must provide me with a copy of the signed authorization.

A8. SIGNATURE

I have read this authorization, or it has been read to me, and the completed form reflects my authorization.

Patient signature: ________________________________________

Patient printed name: [PATIENT NAME]

Date signed: [__/__/____]

Complete the following only if a personal representative signs:

Representative signature: ________________________________________

Representative printed name: [REPRESENTATIVE NAME]

Authority to act for the patient: [SPECIFIC LEGAL AUTHORITY]

Supporting document attached: ☐ Yes ☐ No ☐ Not applicable

Date signed: [__/__/____]

PART B — INDIVIDUAL ACCESS REQUEST

Use this part only when the patient is exercising the individual access right. The HIPAA access right generally covers protected health information in a designated record set; it excludes psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative proceeding.

B1. REQUESTED RECORDS

I request access to the following records maintained in a designated record set:

Date range: From [__/__/____] through [__/__/____]

Records or information requested: [SPECIFIC AND MEANINGFUL DESCRIPTION]

☐ Inspection only

☐ Copy only

☐ Inspection and copy

B2. FORM AND FORMAT

☐ Electronic copy in this readily producible format: [PDF / NATIVE FILE / OTHER]

☐ Readable electronic format agreed with the provider if the requested format is not readily producible

☐ Paper copy

☐ Inspection at an agreed time and place

☐ Other agreed form or format: [DESCRIPTION]

Do not substitute a summary or explanation for the requested records unless the patient agrees in advance to the summary or explanation and to any associated fee.

B3. DELIVERY

Select one:

☐ Deliver the records to me at: [PATIENT DELIVERY ADDRESS / SECURE EMAIL / PORTAL]

☐ Transmit an electronic copy of protected health information in an electronic health record directly to the person designated below. If the request is broader than this court-order-limited third-party directive, use Part A or request delivery to the patient instead.

Designated person: [NAME]

Organization, if any: [ORGANIZATION]

Where to send the copy: [COMPLETE ADDRESS / SECURE EMAIL / PORTAL / FAX]

B4. FEES AND COMMUNICATION

☐ Notify me before charging more than $[AMOUNT].

☐ Contact me at [TELEPHONE / EMAIL] if clarification of scope or format would facilitate production.

For records delivered to the patient under the individual access right, any copy fee must be reasonable and cost-based and limited to the categories permitted by 45 C.F.R. § 164.524(c)(4). Do not rely on that HIPAA fee limitation for a request to transmit records to a third party. A provider ordinarily must act on the request within 30 days after receipt; one extension of no more than 30 days requires a timely written explanation and completion date.

B5. SIGNATURE

Patient signature: ________________________________________

Patient printed name: [PATIENT NAME]

Date signed: [__/__/____]

Complete the following only if a personal representative signs:

Representative signature: ________________________________________

Representative printed name: [REPRESENTATIVE NAME]

Authority to act for the patient: [SPECIFIC LEGAL AUTHORITY]

Supporting document attached: ☐ Yes ☐ No ☐ Not applicable

Date signed: [__/__/____]

SUBMISSION AND RESPONSE LOG

Route submitted: ☐ Part A authorization ☐ Part B access request

Submission date: [__/__/____]

Submission method and destination: [METHOD / ADDRESS / PORTAL / FAX]

Proof of submission retained: ☐ Yes ☐ No

Provider receipt confirmed: [__/__/____ / METHOD / CONTACT]

Identity or authority verification requested: [DESCRIPTION OR "NONE"]

Clarification requested: [DESCRIPTION OR "NONE"]

Fee estimate: $[AMOUNT] on [__/__/____]

Response or production date: [__/__/____]

Denied in whole or part: ☐ No ☐ Yes — attach the written denial and review/complaint instructions

Follow-up required: [ACTION / RESPONSIBLE PERSON / DATE]

FINAL QUALITY-CONTROL CHECKLIST

☐ The correct route is selected and the unused route is removed before submission.

☐ Patient identifiers and representative authority are complete and accurate.

☐ Each disclosing person or class and each recipient or class is specifically identified.

☐ The requested information, record types, and date range are specific and meaningful.

☐ Sensitive-record categories were screened under current applicable law and provider policy.

☐ A general authorization does not include psychotherapy notes.

☐ Any Part 2 consent was separately reviewed for every applicable § 2.31 requirement.

☐ Part A states a purpose and a patient-related or purpose-related expiration date or event.

☐ Part A includes accurate revocation, conditioning, and redisclosure notices.

☐ Part B clearly states the requested form, format, delivery recipient, and destination.

☐ Any Part B third-party direction is limited to an electronic copy of protected health information in an electronic health record; otherwise Part A or patient delivery is used.

☐ The patient or authorized representative signed and dated the selected document.

☐ A copy of the signed document and proof of submission will be retained.

ADMINISTRATIVE NOTES

• A covered entity must document and retain a signed HIPAA authorization as required by 45 C.F.R. §§ 164.508(b)(6) and 164.530(j); the federal retention period is six years from creation or from when the documentation last was in effect, whichever is later.
• A disclosure made pursuant to an authorization under § 164.508 is excluded from the HIPAA accounting right by § 164.528(a)(1)(iv). The requester should not assume that an authorized disclosure will appear in a later HIPAA accounting.
• This packet does not create a contract among the patient, recipient, and record holder; it contains no indemnity, fee-shifting, arbitration, jury waiver, liability cap, or litigation remedy.