Home › Tools › HIPAA Authorization Form

HIPAA Authorization (Release) Form Generator

Make a HIPAA release form for family members, lawyers or other providers. It includes every element the law requires, ready to print and sign.

When You Need a HIPAA Authorization

Situation	Authorization needed?
Treatment, payment or health care operations	No
Sending records to another doctor for your care	No (treatment), though many offices still ask for a form
Family or friends involved in your care, if you do not object	Usually no, for information relevant to your care
Records to a lawyer, employer, school or life insurer	Yes
Marketing or sale of health information	Yes
Psychotherapy notes	Yes, on a separate form

Every Element the Form Must Have

A specific description of the information to share.
Who may share it (the provider or plan).
Who may receive it.
The purpose. "At my request" is enough when the patient asks.
An expiration date or event.
The patient's signature and date, or a representative's signature and their authority.
Statements on the right to revoke, whether care can be conditioned on signing, and that information may be shared again.

The form must be in plain language, and the patient gets a copy. A form missing any element is not valid.

Sensitive Records

Many states add extra rules for mental health, HIV, genetic and reproductive health records, so this form asks the patient to initial each one. Records from a substance use disorder program covered by 42 CFR Part 2 may need that program's own consent form.

Practices also need a Notice of Privacy Practices. Patients asking for their own records do not need an authorization; they have a right of access.

Sources: 45 CFR 164.508 (uses and disclosures requiring an authorization: core elements, required statements, compound authorizations); 45 CFR 164.510(b) (sharing with family and friends); 45 CFR 164.502(g) (personal representatives); 42 CFR Part 2. This tool creates a draft form, not legal advice.

Frequently Asked Questions

What is a HIPAA authorization form?

It is a signed form that lets a provider or health plan share a patient's health information for a purpose HIPAA does not already allow, such as sending records to a lawyer, an employer or a family member. People often call it a HIPAA release form.

What must a HIPAA authorization include?

Under 45 CFR 164.508(c): a specific description of the information, who may share it, who may receive it, the purpose, an expiration date or event, and the patient's signature and date. It must also state the right to revoke in writing, whether treatment can be conditioned on signing, and that shared information may be disclosed again.

Do I need a HIPAA form to let my family talk to my doctor?

Not always. HIPAA lets providers share relevant information with family or friends involved in your care if you do not object. A signed authorization makes it clear and lets them get copies of records. Parents of minors and people with a health care power of attorney usually act as your personal representative.

How long is a HIPAA authorization valid?

Until the expiration date or event written on the form. HIPAA sets no maximum, but the form must have one. You can revoke it in writing at any time.

Can psychotherapy notes go on the same authorization?

No. An authorization for psychotherapy notes can only be combined with another authorization for psychotherapy notes. Use a separate form, which this generator creates when you tick that box.

Hassan Raza Awan, Founder of LegitMedBilling & IT Solutions

Written by Hassan Raza Awan

Founder — LegitMedBilling & IT Solutions

Hassan has 4+ years of hands-on U.S. medical billing experience — working claims, denials, credentialing, and payer follow-up for practices across the United States. Every guide he publishes is written from real remittances and payer behavior, not theory.

Drowning in Records Requests?

We run front-office and billing workflows for U.S. practices, including records requests. Start with a free one-week audit.

Get Free Practice Audit Medical Billing Services