Medical Records Authorization (HIPAA) - Pennsylvania

PENNSYLVANIA AUTHORIZATION FOR RELEASE OF HEALTH INFORMATION

This packet contains a general HIPAA authorization and optional standalone consents for categories governed by additional confidentiality rules. Complete only the parts that apply. A provider may require its own form.

Instructions and Workflow Selection

Identify the legal route being used. These routes have different timing, fee, and documentation rules.

☐ General authorization: The patient authorizes a provider to disclose information under 45 C.F.R. § 164.508.

☐ Individual access request / signed direction: The patient or personal representative requests access under 45 C.F.R. § 164.524 and directs the provider to send the copy to the person identified below.

☐ Pennsylvania subpoena production: Counsel has served a subpoena and is using the procedure in 42 Pa.C.S. § 6152. This form does not replace the subpoena.

Do not combine the standalone psychotherapy-notes authorization or the Part 2 civil-proceeding consent with the general authorization. Use a separate copy and separate signature for each applicable standalone part.

Part A — General HIPAA Authorization

1. Patient Identification

2. Person or Organization Authorized to Disclose

3. Recipient

I authorize disclosure to:

For a signed direction under 45 C.F.R. § 164.524(c)(3)(ii), the patient must clearly identify both the designated person and where the copy is to be sent.

4. Information Authorized for Disclosure

Date range: [__/__/____] through [__/__/____]

☐ Complete designated record set for the date range above, subject to lawful exclusions

☐ History and physical examinations

☐ Office, progress, and treatment notes, excluding psychotherapy notes

☐ Hospital and emergency-department records

☐ Operative and surgical reports

☐ Physician orders

☐ Laboratory and pathology reports

☐ Radiology and imaging reports

☐ Imaging files: [________________________________]

☐ Physical therapy and rehabilitation records

☐ Prescription, pharmacy, and medication records

☐ Billing, itemized-charge, and payment records

☐ Genetic testing information contained in the selected records

☐ Other information described specifically: [________________________________]

This general authorization does not include psychotherapy notes, confidential HIV-related information, or federally protected Part 2 records unless a legally sufficient standalone authorization or consent is completed below.

5. Purpose

☐ At the request of the patient

☐ Legal representation and evaluation of a personal-injury claim

☐ Other: [________________________________]

6. Expiration

Complete one. An authorization without a valid expiration date or expiration event is defective under 45 C.F.R. § 164.508.

☐ This authorization expires on [__/__/____].

☐ This authorization expires upon this event related to the patient or purpose: [________________________________].

7. Required Statements

• I may revoke this authorization in writing at any time by delivering the revocation to each provider or custodian identified in Section 2 at the address shown there. Revocation will not affect action already taken in reliance on this authorization or an insurer's rights where other law permits the insurer to contest a claim.
• The provider generally may not condition treatment, payment, enrollment, or eligibility for benefits on whether I sign this authorization. Federal law permits limited exceptions, including certain research-related treatment, specified health-plan enrollment or eligibility uses, and health care provided solely to create information for disclosure to a third party.
• Information disclosed to the recipient may be redisclosed and may no longer be protected by the HIPAA Privacy Rule. Other federal or Pennsylvania confidentiality law may continue to restrict particular records.
• I am entitled to a copy of this signed authorization when a covered entity seeks it from me.
• This authorization is written in plain language, and I have had an opportunity to review it.

8. Signature

If signed by a personal representative:

Part B — Standalone Authorization for Psychotherapy Notes

I authorize [ORIGINATOR / CUSTODIAN] to disclose the psychotherapy notes described below to [RECIPIENT AND ADDRESS]:

Specific notes, provider, and date range: [________________________________]

Purpose: ☐ At my request ☐ Other: [________________________________]

Expiration date or event: [________________________________]

I understand that I may revoke this authorization in writing except to the extent action has already been taken in reliance on it; treatment, payment, plan enrollment, and benefits generally may not be conditioned on this authorization; and disclosed information may be redisclosed and may no longer be protected by HIPAA.

Part C — Standalone Consent for Substance Use Disorder Records

C.1 Patient and Discloser

Patient: [________________________________]

Person(s) or class authorized to make the disclosure: [________________________________]

C.2 Information and Recipient

Specific and meaningful description of records: [________________________________]

Recipient(s) or class of recipients: [________________________________]

C.3 Purpose

Complete one purpose only when the consent is for use or disclosure in a proceeding.

☐ At the request of the patient

☐ Legal representation, investigation, or proceeding described as follows: [________________________________]

☐ Other single purpose: [________________________________]

C.4 Expiration and Revocation

Expiration date or patient/purpose-related event: [________________________________]

I may revoke this consent in writing by delivering the revocation to [PROGRAM / LAWFUL HOLDER AND ADDRESS], except to the extent a program or lawful holder has already acted in reliance on it.

C.5 Signature

Each disclosure made with this consent must be accompanied by either the full statement in 42 C.F.R. § 2.32(a)(1) or this permitted abbreviated statement:

42 CFR part 2 prohibits unauthorized use or disclosure of these records.

The disclosure must also include a copy of this consent or a clear explanation of its scope. Counsel and the disclosing program should confirm whether the recipient and purpose language satisfies both current Part 2 and Pennsylvania law before use.

Part D — Standalone Pennsylvania Mental-Health Records Consent

Section 111 of the Pennsylvania Mental Health Procedures Act protects documents concerning persons in treatment. Complete this standalone consent for records governed by that Act. Do not use it to authorize psychotherapy notes unless Part B is also completed separately.

Patient: [________________________________]

Facility / person permitted to disclose: [________________________________]

Recipient and address: [________________________________]

Specific records and date range: [________________________________]

Purpose: [________________________________]

Expiration date or event: [________________________________]

Part E — Standalone Consent for Confidential HIV-Related Information

This consent contains the elements required by 35 P.S. § 7607(c).

This consent may be revoked at any time except to the extent the person making the disclosure has already acted in reliance on it. Revocation must be delivered in writing to [DISCLOSER AND ADDRESS].

Each disclosure made under this consent must be accompanied by this statutory notice:

This information has been disclosed to you from records protected by Pennsylvania law. Pennsylvania law prohibits you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or is authorized by the Confidentiality of HIV-Related Information Act. A general authorization for the release of medical or other information is not sufficient for this purpose.

Pennsylvania Production, Timing, and Fee Guide

HIPAA Individual Access

Under 45 C.F.R. § 164.524, a covered entity generally must act on an individual's access request within 30 days after receipt. It may take one extension of no more than 30 days if it timely gives the individual a written reason for the delay and a completion date.

For an individual-access copy, the fee may include only reasonable, cost-based charges for copying labor; supplies for the paper copy or requested portable electronic media; postage when mailing is requested; and an agreed explanation or summary. Search-and-retrieval labor is not listed as a permitted component.

Pennsylvania Subpoena Production

Under 42 Pa.C.S. § 6152, a provider or facility electing the statutory subpoena procedure generally notifies subpoenaing counsel within three days after receipt, holds the originals, and—after permitted expenses are paid—delivers certified copies within 30 days. Different provisions apply to district-attorney requests and Commonwealth agencies. The custodian certification and sealed-inner-envelope requirements in § 6152(d) must be followed when that procedure is used.

2026 Pennsylvania Maximum Charges

The Pennsylvania Department of Health's schedule effective January 1, 2026 lists these maximum charges for covered production requests:

Actual postage, shipping, and delivery costs may be added. The Department's notice states that requests by the individual who is the subject of the information or the individual's personal representative are governed by HIPAA and its federal regulations. Confirm the current annual schedule before relying on these figures after December 31, 2026.

Optional Receipt Log

Sources and References

• 45 C.F.R. § 164.508 — official eCFR
• 45 C.F.R. § 164.524 — official eCFR
• 42 C.F.R. §§ 2.31–2.33 — official eCFR Part 2
• 42 Pa.C.S. § 6152 — official General Assembly text
• 42 Pa.C.S. § 6155 — official General Assembly text
• Mental Health Procedures Act § 111 — official General Assembly compilation
• Confidentiality of HIV-Related Information Act § 7 — official General Assembly text
• Pennsylvania Drug and Alcohol Abuse Control Act § 8 — official General Assembly compilation
• Pennsylvania Department of Health — Medical Record Fees effective January 1, 2026