MEDICAL RECORDS RELEASE AUTHORIZATION

Purpose of This Form

This authorization permits the release (disclosure) of your Protected Health Information ("PHI") as required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Privacy Rule, codified at 45 C.F.R. § 164.508. Your completion and signing of this form is voluntary. You have the right to refuse to sign this authorization, and your refusal will not affect your treatment, payment, enrollment in a health plan, or eligibility for benefits.

IMPORTANT: This authorization meets the core element and required statement requirements of 45 C.F.R. § 164.508(c). State laws may impose additional requirements. Refer to the State-Specific Requirements section (Section 12) for applicable state provisions. If state law is more protective of patient privacy than HIPAA, state law controls.

SECTION 1: PATIENT INFORMATION

Patient Full Legal Name: [________________________________]

Former/Maiden Name (if records filed under a different name): [________________________________]

Date of Birth: [__/__/____]

Social Security Number (last 4 digits, optional): XXX-XX-[____]

Medical Record Number (if known): [________________________________]

Address: [________________________________]

City/State/ZIP: [________________________________]

Telephone: [________________________________]

Email: [________________________________]

SECTION 2: DISCLOSING PROVIDER / ENTITY

This is the healthcare provider, facility, or entity that currently holds your medical records and is being asked to release them.

Provider/Facility Name: [________________________________]

Department (if applicable): [________________________________]

Address: [________________________________]

City/State/ZIP: [________________________________]

Telephone: [________________________________]

Fax: [________________________________]

SECTION 3: RECIPIENT OF RECORDS

Pursuant to 45 C.F.R. § 164.508(c)(1)(iii), you must identify who will receive your records.

Recipient Name/Organization: [________________________________]

Attention (Contact Person): [________________________________]

Address: [________________________________]

City/State/ZIP: [________________________________]

Telephone: [________________________________]

Fax: [________________________________]

Email (if secure electronic delivery requested): [________________________________]

SECTION 4: RECORDS TO BE RELEASED

Pursuant to 45 C.F.R. § 164.508(c)(1)(i), the following is a specific and meaningful description of the records authorized for release.

4.1 Scope of Records

☐ Complete medical records — All records maintained by the disclosing provider/entity

☐ Records from a specific date range: [__/__/____] through [__/__/____]

☐ Records from a specific provider or facility: [________________________________]

☐ Most recent visit/encounter only — Date: [__/__/____]

☐ Specific records selected below (Section 4.2)

4.2 Specific Record Types

Check all record types authorized for release:

Clinical Records

☐ History and physical examination

☐ Progress notes / Office visit notes

☐ Consultation reports

☐ Discharge summaries

☐ Emergency department records

☐ Operative/surgical reports

☐ Anesthesia records

☐ Pre-operative and post-operative notes

☐ Admission records

Diagnostic Records

☐ Laboratory test results

☐ Pathology/cytology reports

☐ Diagnostic imaging reports (X-ray, MRI, CT, ultrasound, PET, mammogram)

☐ Diagnostic imaging films/CDs (additional fees may apply)

☐ EKG/ECG/cardiac testing results

☐ Pulmonary function test results

☐ Endoscopy/colonoscopy reports

Treatment Records

☐ Medication lists / Prescription history

☐ Immunization records

☐ Allergy lists

☐ Treatment plans / Care plans

☐ Physical therapy / Rehabilitation records

☐ Occupational therapy records

☐ Speech therapy records

☐ Nutritional/dietitian assessments

☐ Nursing notes/assessments

Administrative Records

☐ Billing and claims records

☐ Insurance information and correspondence

☐ Referral and authorization letters

☐ Prior authorization documentation

☐ Advance directives / Living will / POLST

☐ Power of attorney documentation

4.3 Sensitive Health Information Categories

SPECIAL NOTICE: The following categories of health information receive heightened federal and/or state legal protection. These records will NOT be released unless you specifically authorize them by checking the applicable box below. Specific authorization is legally required for these categories.

☐ Mental Health / Behavioral Health Treatment Records

Does NOT include psychotherapy notes. See Section 4.4 below. Protected under various state laws including Cal. Welf. & Inst. Code § 5328; Tex. Health & Safety Code Ch. 611; N.Y. Mental Hygiene Law § 33.13.

☐ Substance Use Disorder Treatment Records

Protected under 42 C.F.R. Part 2. As of the February 2024 Final Rule (compliance date February 16, 2026), consent for treatment, payment, and healthcare operations may be combined in a single consent. However, this authorization for disclosure to third parties for non-TPO purposes requires separate patient authorization. Prohibition on re-disclosure applies: "This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR part 2). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR part 2." (42 C.F.R. § 2.32)

☐ HIV/AIDS Testing and Status Information

Protected under state-specific statutes: Cal. Health & Safety Code § 121025; Tex. Health & Safety Code § 81.103; Fla. Stat. § 381.004; N.Y. Pub. Health Law § 2782.

☐ Sexually Transmitted Infection (STI) Records

Additional state protections may apply.

☐ Genetic Testing Results and Genetic Information

Protected under GINA (42 U.S.C. § 2000ff) and state genetic privacy laws: Cal. Civ. Code § 56.17; Fla. Stat. § 760.40; N.Y. Civ. Rights Law § 79-l.

☐ Reproductive Health Records (pregnancy, fertility, contraception, abortion)

☐ Communicable Disease Records (tuberculosis, hepatitis, reportable diseases)

4.4 Psychotherapy Notes

Psychotherapy notes (as defined in 45 C.F.R. § 164.501) are notes recorded by a mental health professional documenting or analyzing the contents of conversation during a private counseling session that are separated from the rest of the medical record. Under 45 C.F.R. § 164.508(a)(2), psychotherapy notes require a SEPARATE authorization that may not be combined with an authorization for other types of PHI (except for another psychotherapy notes authorization).

☐ I authorize the release of psychotherapy notes. I understand this is a separate authorization and may not be combined with any other authorization except for other psychotherapy notes.

If checked, describe the specific psychotherapy notes authorized for release:

Provider of psychotherapy: [________________________________]

Date range of notes: [__/__/____] through [__/__/____]

Separate Signature for Psychotherapy Notes: ______________________________

Date: [__/__/____]

SECTION 5: PURPOSE OF DISCLOSURE

Pursuant to 45 C.F.R. § 164.508(c)(1)(iv), you must describe the purpose of the requested disclosure.

Check all that apply:

☐ Continuing care / Transfer of care to another provider

☐ Second medical opinion / Consultation

☐ Legal proceeding (litigation, workers' compensation, disability determination)

☐ Insurance claim or application (health, life, disability, long-term care)

☐ Disability determination (SSA, SSDI, private disability)

☐ Workers' compensation claim

☐ Personal injury claim

☐ Family and Medical Leave Act (FMLA) certification

☐ Employment-related (fitness for duty, occupational health)

☐ School, camp, or sports enrollment

☐ Immigration purposes

☐ Veterans Affairs / Military records

☐ Personal records / Patient's own use

☐ Other (describe): [________________________________]

SECTION 6: DELIVERY METHOD

Preferred delivery method for released records:

☐ Mail to the recipient address listed in Section 3

☐ Secure fax to: [________________________________]

☐ Secure electronic transmission (encrypted email) to: [________________________________]

☐ Patient portal access (if available)

☐ CD/DVD/USB drive — ☐ Mail ☐ Pick up in person

☐ In-person pick up by: ☐ Patient ☐ Authorized representative: [________________________________]

Electronic Records Right: Under 45 C.F.R. § 164.524(c)(2)(ii), if PHI is maintained in an electronic designated record set, you have the right to request an electronic copy in the form and format you request, if it is readily producible in that form and format. If not readily producible, the covered entity shall provide it in an agreed-upon alternative electronic format.

SECTION 7: COPY FEES AND TIMELINES

7.1 Federal HIPAA Fee Limitations

Under 45 C.F.R. § 164.524(c)(4), the covered entity may charge a reasonable, cost-based fee that includes only the cost of: (i) labor for copying; (ii) supplies for creating the paper copy or electronic media; and (iii) postage, when the individual has requested the copy be mailed. The fee may not include costs for searching for or retrieving the requested information.

7.2 State-Specific Fee Schedules and Timelines

California

• Fees: Covered entities may charge no more than $0.25 per page for paper copies, plus reasonable clerical costs not to exceed $20 (Cal. Health & Safety Code § 123110(b)). For records maintained electronically, no more than $0.25 per page in electronic format.
• Timeline: Records must be made available within 15 days of a written request (Cal. Health & Safety Code § 123110(a)). A one-time 15-day extension is permitted.
• Inspection: Patient has the right to inspect records at the facility at no charge during business hours (Cal. Health & Safety Code § 123110(a)).

Texas

• Fees: Regulated by the Texas Medical Board and Department of State Health Services. Maximum fees are set by rule and vary by type and format. Standard charges include a per-page fee plus a flat fee for search and processing.
• Timeline: Records must be provided within 15 business days of a written request by the patient (Tex. Health & Safety Code § 241.154(a)). Mental health records must be made available within 15 days (Tex. Health & Safety Code § 611.0045).
• Authorization Form: The Texas Attorney General has adopted a standard Authorization to Disclose Protected Health Information (Tex. Health & Safety Code § 181.154(d)). The AG form may be used; other forms that comply with HIPAA and the Texas Medical Privacy Act are also acceptable.

Florida

• Fees: Per Fla. Stat. § 456.057(13), the charge for copies shall not exceed $1.00 per page for the first 25 pages and $0.25 per page for each page thereafter. The health care practitioner may also charge a search and handling fee of no more than the amount provided by Fla. Admin. Code.
• Timeline: Records must be furnished "in a timely manner" without delays for legal review (Fla. Stat. § 456.057(6)). Hospitals must provide within 30 days (Fla. Stat. § 395.3025(4)).
• Inspection: Patient may view records at the facility.

New York

• Fees: Per N.Y. Pub. Health Law § 18(2)(e), providers may charge $0.75 per page, not to exceed the costs incurred. For records on microfilm, the charge is up to $1.50 per page.
• Timeline: The provider must make records available for inspection within 10 days of a written request and provide copies within a reasonable time (N.Y. Pub. Health Law § 18(2)(a)).
• Mental Health Records: Requests for mental health records may be reviewed by a qualified person to determine if access would cause "substantial and identifiable harm" (N.Y. Mental Hygiene Law § 33.16).

SECTION 8: DURATION AND EXPIRATION

Pursuant to 45 C.F.R. § 164.508(c)(1)(v), this authorization must include an expiration date or event.

This authorization is valid and effective:

☐ From the date of signature until: [__/__/____]

☐ For a period of [____] months from the date of signature

☐ For a period of [____] year(s) from the date of signature

☐ Until the following event occurs: [________________________________]

☐ For one-time use only (expires upon completion of the specified disclosure)

Note: If no expiration date is specified, this authorization will expire twelve (12) months from the date of signature, unless applicable state law requires a shorter duration.

SECTION 9: RIGHT TO REVOKE

9.1 Revocation Rights

Pursuant to 45 C.F.R. § 164.508(c)(2)(i), you have the right to revoke this authorization at any time by providing written notice to the disclosing provider/entity.

To revoke this authorization, submit a written revocation to:

Name/Office: [________________________________]

Address: [________________________________]

Fax: [________________________________]

Email: [________________________________]

9.2 Exceptions to Revocation

Your revocation will be effective upon receipt, except to the extent that the disclosing provider/entity has already taken action in reliance on this authorization prior to receiving your written revocation (45 C.F.R. § 164.508(b)(5)(i)).

9.3 Written Revocation Form

The following may be used to revoke this authorization:

"I, [Patient Name], hereby revoke the Medical Records Release Authorization that I signed on [Date of Authorization] authorizing [Disclosing Provider] to release my medical records to [Recipient]. I understand that this revocation is effective upon receipt and does not apply to information already disclosed prior to receipt of this revocation."

Patient Signature: ______________________________

Date of Revocation: [__/__/____]

SECTION 10: CONSEQUENCES OF REFUSING TO SIGN

Pursuant to 45 C.F.R. § 164.508(c)(2)(ii):

• Your treatment, payment, enrollment in a health plan, or eligibility for benefits will not be conditioned on your signing this authorization, except:

☐ If the disclosure is for eligibility or enrollment in a health plan, and the authorization is requested prior to enrollment (45 C.F.R. § 164.508(b)(4)(iii)); or

☐ If the disclosure is for a health care provider to furnish research-related treatment (45 C.F.R. § 164.508(b)(4)(i)).

• If you refuse to sign this authorization, the records described in Section 4 will not be released to the recipient described in Section 3.

• Your refusal will not affect your right to receive treatment from the disclosing provider.

SECTION 11: RE-DISCLOSURE NOTICE

Pursuant to 45 C.F.R. § 164.508(c)(2)(iii):

NOTICE: Once your health information is disclosed pursuant to this authorization, the information may be subject to re-disclosure by the recipient and may no longer be protected by HIPAA or other federal or state privacy laws. However, if the recipient is also a covered entity or business associate under HIPAA, your information will continue to be protected by the HIPAA Privacy Rule. Additionally, certain categories of information (such as substance use disorder records under 42 C.F.R. Part 2, HIV-related information, and mental health records) may retain special protections under applicable federal or state law even after disclosure.

SECTION 12: STATE-SPECIFIC REQUIREMENTS

12.1 California (CMIA — Cal. Civ. Code §§ 56–56.37)

The following provisions apply when the disclosing provider is located in California or when the records pertain to a California resident:

(a) Authorization Format (Cal. Civ. Code § 56.11): This authorization must be either (i) handwritten by the patient or their representative, or (ii) printed in no less than 14-point type. The authorization language must be clearly separated from any other language on the same page. The patient's signature must serve no other purpose than to execute the authorization.

(b) Required Elements (Cal. Civ. Code § 56.11): The authorization must include:
- The specific uses and limitations on use of the medical information
- The name or functions of the provider being asked to disclose the information
- The name or functions of the persons or entities authorized to receive the information
- The specific uses and limitations on use by the recipients
- A specific date after which the provider is no longer authorized to disclose (no "indefinite" authorizations)

(c) Mental Health Records (Cal. Welf. & Inst. Code § 5328 — Lanterman-Petris-Short Act): Records of individuals receiving mental health treatment are confidential and may not be disclosed except as specifically authorized by the patient or as permitted under the statute.

(d) HIV Test Results (Cal. Health & Safety Code § 121025): Specific written authorization is required for disclosure of HIV test results. The authorization must include a description of the information to be disclosed and the name of each person authorized to receive it.

(e) Damages: The CMIA provides a private right of action with compensatory damages, punitive damages, attorneys' fees, and statutory damages of $1,000 per violation and up to $1,000 per subsequent violation (Cal. Civ. Code §§ 56.35, 56.36).

12.2 Texas (HB 300 — Tex. Health & Safety Code Ch. 181)

(a) Authorization Form: The Texas Attorney General has adopted a standard authorization form for the disclosure of protected health information (Tex. Health & Safety Code § 181.154(d)). Covered entities may use the AG form or any other form that complies with HIPAA and the Texas Medical Privacy Act.

(b) Electronic Disclosure Notice: If a covered entity maintains an Internet website, it must post a notice of privacy practices and a description of its electronic disclosure of PHI to other entities (Tex. Health & Safety Code § 181.154(b)).

(c) Mental Health Records (Tex. Health & Safety Code Ch. 611): Communications between a patient and a mental health professional, and records of the identity, diagnosis, evaluation, or treatment of a patient, are confidential. Disclosure requires specific written consent. The mental health professional may deny access to records if release would be harmful to the patient's physical, mental, or emotional health (Tex. Health & Safety Code § 611.0045(c)).

(d) HIV Records (Tex. Health & Safety Code § 81.103): Test results are confidential. Release requires a separate, specific written authorization.

(e) Physician-Patient Privilege (Tex. Occ. Code § 159.002): Communications between physician and patient, and records maintained by a physician, are confidential and may not be disclosed without the patient's consent or as otherwise authorized by law.

(f) Penalties: The Texas Attorney General may bring enforcement actions with civil penalties up to $250,000 per violation under the Texas Medical Privacy Act. Individuals have a private right of action for actual damages and injunctive relief.

12.3 Florida

(a) Patient Records (Fla. Stat. § 456.057): Any health care practitioner licensed under Chapter 456 who makes a physical or mental examination of, or administers treatment to, any person shall, upon request by such person or the person's legal representative, furnish copies of all reports and records relating to such examination or treatment without delays for legal review.

(b) Hospital Patient Rights (Fla. Stat. § 395.3025): Each patient or the patient's legal representative shall, upon request, have access to that patient's medical records. The hospital may charge for copies in accordance with the fee schedule.

(c) HIV Testing (Fla. Stat. § 381.004): The results of HIV testing performed under this section are confidential. The identity of any person upon whom an HIV test has been performed and the results of such test are not to be disclosed except as provided in the statute.

(d) Genetic Testing (Fla. Stat. § 760.40): DNA analysis may be performed only with the informed consent of the person to be tested, and the results of such DNA analysis are the exclusive property of the person tested. Results may not be disclosed without the consent of the person tested.

(e) Information Security (Fla. Stat. § 501.171): Requires notification of security breaches affecting personal information, including medical information.

12.4 New York

(a) Patient Access (N.Y. Pub. Health Law § 18): Upon the written request of any patient, or the patient's representative authorized pursuant to law, a health care provider shall provide access to, or copies of, the patient's medical records, including records maintained in electronic form. Records must be made available for inspection within 10 days.

(b) Mental Health Records (N.Y. Mental Hygiene Law § 33.13): Clinical records maintained at a mental health facility shall not be publicly disclosed and shall be kept confidential. The records may not be disclosed to any person except as specifically authorized by the patient or as permitted under the Mental Hygiene Law.

(c) HIV Information (N.Y. Pub. Health Law Article 27-F, §§ 2780–2787): Confidential HIV-related information may be disclosed only with a specific written release. The release must be dated and must include: (i) the name of the individual whose information is to be disclosed; (ii) the name of the person or entity authorized to receive the information; (iii) the purpose of the disclosure; (iv) the time period during which the release is authorized; and (v) the signature of the individual or legally authorized representative (N.Y. Pub. Health Law § 2782).

(d) SHIELD Act (N.Y. Gen. Bus. Law § 899-aa): Entities holding private information of New York residents must implement reasonable safeguards. Enhanced breach notification requirements apply when medical information, combined with other data elements, is compromised.

(e) Fee Limitations: Per N.Y. Pub. Health Law § 18(2)(e), providers may charge $0.75 per page, not to exceed the costs incurred by the provider. Providers may not charge for inspecting records.

SECTION 13: PERSONAL REPRESENTATIVE PROVISIONS

13.1 Personal Representative Authorization

If this authorization is signed by a personal representative of the patient, the representative must provide documentation of their legal authority to act on behalf of the patient, as required by 45 C.F.R. § 164.502(g).

Personal Representative Name: [________________________________]

Relationship to Patient: [________________________________]

Basis of Legal Authority (check one):

☐ Parent of a minor child — The parent generally has authority to act as the personal representative for the minor, except where:
- The minor has consented to care on their own (see Section 13.3 for state-specific minor consent)
- The minor may obtain care without parental consent under state law
- A court has authorized someone other than the parent to make health care decisions
- A parent has agreed to a confidential relationship between the minor and the provider

☐ Legal guardian — Court order of guardianship attached: ☐ Yes

☐ Healthcare power of attorney / Health care proxy — Document attached: ☐ Yes

☐ Executor or administrator of the estate of a deceased patient — Letters testamentary or letters of administration attached: ☐ Yes

☐ Court-appointed conservator — Court order attached: ☐ Yes

☐ Other legal authority — Describe: [________________________________]; Documentation attached: ☐ Yes

13.2 Deceased Patient Records

If the patient is deceased:

Date of Death: [__/__/____]

Personal Representative (executor/administrator): [________________________________]

Documentation of Authority: [________________________________]

Note: Under 45 C.F.R. § 164.502(g)(4), the personal representative of the deceased has the same rights as the patient with respect to PHI. The executor or administrator of the estate, or the person authorized under applicable law, is the personal representative.

13.3 Minor Patient Records

Minor Patient Name: [________________________________]

Date of Birth: [__/__/____]

Age: [____]

Authorization Signed By:

☐ Parent: [________________________________]

☐ Legal Guardian: [________________________________]

☐ Minor patient (for records related to services for which the minor lawfully consented on their own behalf)

State-Specific Minor Consent Ages and Categories:

• California: Minors 12+ may consent to mental health treatment (Cal. Fam. Code § 6924), STD treatment (Cal. Fam. Code § 6926), substance abuse treatment (Cal. Health & Safety Code § 11752), and reproductive health services (Cal. Fam. Code § 6925). Minors 15+ living separately may consent to medical care (Cal. Fam. Code § 6922). For care the minor lawfully consented to, the minor controls the authorization.
• Texas: Minors may consent to treatment for STDs, pregnancy, drug/chemical dependency (Tex. Fam. Code § 32.003(a)). Minors 16+ may consent in certain circumstances (Tex. Fam. Code § 32.003(b)).
• Florida: Minors may consent to STD treatment (Fla. Stat. § 384.30) and substance abuse treatment (Fla. Stat. § 397.601). Married minors may consent to medical treatment.
• New York: Minors may consent to STD treatment (N.Y. Pub. Health Law § 2305), HIV testing (N.Y. Pub. Health Law § 2781(1)), and reproductive health services. Minors over 12 may consent to certain mental health treatment in residential facilities.

SECTION 14: ELECTRONIC RECORDS PROVISIONS

14.1 Right to Electronic Copies

Under 45 C.F.R. § 164.524(c)(2)(ii), if your medical records are maintained electronically in a designated record set, you have the right to obtain a copy in electronic form and format. You may direct the covered entity to transmit the electronic copy to a third party you designate.

14.2 Electronic Delivery Options

☐ Patient portal (provider's electronic health record portal)

☐ Secure email (encrypted) to: [________________________________]

☐ Electronic media (CD, DVD, USB flash drive)

☐ Direct messaging (health information exchange)

☐ FHIR-based API access (if available)

☐ Other electronic format: [________________________________]

14.3 Electronic Format Preference

☐ PDF

☐ C-CDA (Consolidated Clinical Document Architecture)

☐ FHIR Bundle

☐ Other: [________________________________]

Note: The covered entity must provide the electronic copy in the form and format requested, if readily producible. If not readily producible, the entity must provide it in a mutually agreed-upon alternative electronic format.

SECTION 15: PATIENT ACKNOWLEDGMENTS

By signing below, I acknowledge and confirm that:

☐ I have read this authorization form in its entirety (or it has been read to me) and I understand its contents.

☐ I authorize the release of the specific medical records described in Section 4 to the recipient identified in Section 3, for the purpose(s) described in Section 5.

☐ I understand that I may refuse to sign this authorization and that my refusal will not affect my treatment, payment, enrollment, or eligibility for benefits (except as noted in Section 10).

☐ I understand that I may revoke this authorization at any time by providing written notice as described in Section 9.

☐ I understand that revocation is not effective to the extent the disclosing provider has already acted in reliance on my authorization.

☐ I understand that information disclosed pursuant to this authorization may be subject to re-disclosure and may no longer be protected by HIPAA (except as noted in Section 11).

☐ I understand that I am entitled to a copy of this signed authorization (45 C.F.R. § 164.508(c)(4)).

☐ I have specifically authorized (or declined to authorize) the release of sensitive health information in Sections 4.3 and 4.4 (mental health, substance use disorder, HIV/AIDS, STI, genetic, reproductive health, and psychotherapy notes).

☐ I am signing this authorization voluntarily, without coercion or undue influence.

SECTION 16: SIGNATURES

16.1 Patient or Personal Representative

Printed Name of Patient: [________________________________]

Patient Signature: ______________________________

Date: [__/__/____]

16.2 Personal Representative (if applicable)

Printed Name of Personal Representative: [________________________________]

Relationship to Patient: [________________________________]

Signature: ______________________________

Date: [__/__/____]

Description of Legal Authority to Act for Patient: [________________________________]

16.3 Witness (if required by state law or institutional policy)

Printed Name of Witness: [________________________________]

Signature: ______________________________

Date: [__/__/____]

16.4 Interpreter (if applicable)

I have interpreted the contents of this authorization form for the patient in:

Language: [________________________________]

Interpreter Name: [________________________________]

Interpreter ID/Credentials: [________________________________]

Signature: ______________________________

Date: [__/__/____]

SECTION 17: PROVIDER USE — PROCESSING CHECKLIST

For use by the disclosing provider's Health Information Management (HIM) / Medical Records department.

☐ Patient identity verified (photo ID, DOB, MRN)

☐ Authorization form contains all required core elements (45 C.F.R. § 164.508(c)(1))

☐ Authorization form contains all required statements (45 C.F.R. § 164.508(c)(2))

☐ Authorization has not expired

☐ Authorization has not been revoked

☐ Sensitive information categories specifically authorized (mental health, SUD, HIV, genetic)

☐ Psychotherapy notes authorization is separate (if applicable)

☐ Personal representative authority verified (if applicable)

☐ State-specific requirements verified (CMIA format, TX AG form, etc.)

☐ Fee estimate provided to patient/requestor (if applicable)

☐ Records prepared and quality-checked

☐ Disclosure logged for accounting of disclosures purposes (45 C.F.R. § 164.528)

☐ Copy of signed authorization retained (minimum 6 years per 45 C.F.R. § 164.530(j))

☐ Copy of signed authorization provided to patient (45 C.F.R. § 164.508(c)(4))

☐ Records released on: [__/__/____] by: [________________________________]

☐ Method of delivery: [________________________________]

Sources and References

• 45 C.F.R. § 164.508 — Uses and Disclosures for Which an Authorization Is Required: https://www.law.cornell.edu/cfr/text/45/164.508
• 45 C.F.R. § 164.524 — Access of Individuals to PHI: https://www.law.cornell.edu/cfr/text/45/164.524
• 45 C.F.R. § 164.528 — Accounting of Disclosures of PHI: https://www.law.cornell.edu/cfr/text/45/164.528
• 42 C.F.R. Part 2 — Confidentiality of SUD Patient Records: https://www.law.cornell.edu/cfr/text/42/part-2
• 42 C.F.R. Part 2 Final Rule (Feb. 2024): https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
• HHS Guidance on Individual Right of Access: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html
• HHS FAQ on Authorizations: https://www.hhs.gov/hipaa/for-professionals/faq/authorizations/index.html
• GINA (42 U.S.C. § 2000ff): https://www.law.cornell.edu/uscode/text/42/chapter-21F
• Cal. Civ. Code §§ 56–56.37 (CMIA): https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=1.&title=&part=2.6.&chapter=1.&article=
• Cal. Civ. Code § 56.11 (Authorization Format Requirements): https://codes.findlaw.com/ca/civil-code/civ-sect-56-11/
• Cal. Health & Safety Code § 123110 (Patient Access to Health Records): https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=123110&lawCode=HSC
• Tex. Health & Safety Code Ch. 181 (Medical Privacy Act): https://statutes.capitol.texas.gov/Docs/HS/htm/HS.181.htm
• Tex. Health & Safety Code Ch. 611 (Mental Health Records): https://statutes.capitol.texas.gov/Docs/HS/htm/HS.611.htm
• TX AG Standard Authorization Form: https://www.texasattorneygeneral.gov/sites/default/files/files/divisions/consumer-protection/hb300-Authorization-Disclose-Health-Info.pdf
• Fla. Stat. § 456.057 (Patient Records): https://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute&URL=0400-0499/0456/Sections/0456.057.html
• Fla. Stat. § 395.3025 (Hospital Patient Records): https://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute&URL=0300-0399/0395/Sections/0395.3025.html
• N.Y. Pub. Health Law § 18 (Patient Access to Records): https://www.nysenate.gov/legislation/laws/PBH/18
• N.Y. Pub. Health Law § 2782 (HIV Confidentiality): https://www.nysenate.gov/legislation/laws/PBH/2782
• N.Y. Mental Hygiene Law § 33.13 (Mental Health Records): https://www.nysenate.gov/legislation/laws/MHY/33.13