What makes a disclosure valid?

A valid authorization names the patient, identifies the recipient, describes the information, states the purpose, includes an expiration, and contains the patient's signature. For electronic signatures, the ESIGN Act test requires intent, consent, attribution, and reliable record retention (15 U.S.C. §7001).

Can a patient revoke the authorization?

Yes. A patient may revoke an authorization in writing at any time unless the provider has acted in reliance on it. Revocations should be directed to the record holder and logged in the patient file to prevent further disclosures.

Are electronic signatures acceptable?

Electronic signatures are acceptable when they meet ESIGN/UETA standards and any additional HIPAA administrative safeguards. Confirm the e-signature process captures intent, attribution, and an audit trail.

What if the recipient requests more records?

Obtain a new or amended authorization that specifically authorizes the additional records. Do not interpret a prior limited authorization as blanket consent for further disclosure.

Who can sign for an incapacitated patient?

Authorized representatives defined by state law or facility policy (e.g., healthcare proxy, legal guardian) may sign. Documentation of authority should be attached to the disclosure form.

How long should the authorization be kept?

Retain executed authorizations for at least as long as the health record retention policy requires—HIPAA recommends six years from creation or last effective date (45 CFR §164.530(j)). See your state rules for longer periods.

Electronic Signature
Templates
Healthcare
Healthcare Medical Records Disclosure

Healthcare Medical Records Disclosure

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE MEDICAL RECORDS DISCLOSURE

Patient Information

Patient Full Legal Name

Date of Birth

Gender

Medical Record Number (if known)

Address

Primary Phone

Email

Emergency / Alternate Contact

Name Phone

Records To Be Disclosed

I authorize the release of the following portion(s) of my medical record. Select all that apply. For release of highly confidential information (mental health notes, HIV, substance abuse), place your initials in the box provided next to that item to specifically authorize disclosure.

Standard categories

Entire medical record from: to

Progress notes

Operative / procedure reports

Laboratory results

Radiology / imaging reports

Immunization records

Billing / account records

Sensitive information requiring explicit authorization

Behavioral health / psychotherapy notes — Initials:

HIV / AIDS related information — Initials:

Substance use disorder treatment records — Initials:

Genetic testing / counseling — Initials:

Reproductive / sexual health records — Initials:

Other specific records or instructions

From / To (Releasing Party and Recipient)

Provider / Facility Releasing Information Recipient (To whom records will be disclosed)

Purpose of Disclosure

Purpose (select all that apply):

Treatment / Continuity of Care

Payment / Insurance

Personal Use

Legal

Other — specify below

If Other, describe purpose

Method of Disclosure

Select method(s) by which records may be released:

Mail to address above

Fax to number above

Secure electronic transmission to email above

Upload to patient/recipient portal

Patient or authorized representative will pick up records in person

Fees and Charges

I acknowledge that the provider may charge a reasonable fee for copying, postage, and preparation of records as permitted by applicable law. These charges must be paid prior to release of records unless otherwise arranged.

I acknowledge and accept that I may be charged fees for copies and handling.

Expiration and Revocation

This authorization will expire on the earlier of the date specified below, the occurrence of the stated event, or 12 months from the date signed unless a different expiration is indicated. I understand I may revoke this authorization in writing at any time except to the extent that action has already been taken in reliance on it. Revocation must be submitted to the releasing provider.

Expiration Date (if any)

Or expiration event (describe)

No expiration (patient understands implications)

Rights and Acknowledgments

By signing below, I certify that I am the patient or am authorized to act on behalf of the patient. I understand that:

I may revoke this authorization at any time in writing, except to the extent that action has already been taken in reliance upon it.
Information disclosed pursuant to this authorization may no longer be protected by federal or state privacy law and may be subject to redisclosure by the recipient.
This authorization is voluntary and treatment, payment, enrollment, or eligibility for benefits will not be conditioned on signing this authorization except where permitted by law.
I have read and understand this authorization and acknowledge receipt of a copy of it upon request.

Signature of Patient or Authorized Representative

If signed by other than the patient, indicate relationship and authority to sign (e.g., parent, legal guardian, healthcare power of attorney).

Printed Name:

Signature:

Date:

If signing on behalf of patient, Relationship / Authority:

For office use only: Records released by (staff name):

What the Healthcare Medical Records Disclosure Is

A Healthcare Medical Records Disclosure is a written authorization that permits a health care provider or facility to release an individual’s protected health information (PHI) to specified recipients for defined purposes. The form typically identifies the patient, describes the PHI to be disclosed, names the recipient(s), specifies the purpose and duration of the disclosure, and informs the patient of their right to revoke authorization. In the United States these disclosures must meet HIPAA requirements for valid authorizations and, when signed electronically, satisfy ESIGN Act standards (15 U.S.C. §7001) and applicable state UETA rules.

Stepwise process to complete the disclosure

Follow these sequential steps to ensure a complete and legally effective disclosure.

01

Verify identity: Confirm patient identity using government ID or facility protocol before completing the form.
02

Specify records: Describe exactly which records or date ranges should be released to avoid over-disclosure.
03

Designate recipient: Provide recipient contact details and delivery method (mail, fax, electronic) for accurate routing.
04

Sign and date: Patient or authorized representative must sign and date; include relationship and authority if signed by another party.

Frequently asked questions and common issues

Answers to routine questions about validity, revocation, electronic signatures, and practical problems encountered when completing or processing a disclosure.

Need help? Contact support

What makes a disclosure valid?
A valid authorization names the patient, identifies the recipient, describes the information, states the purpose, includes an expiration, and contains the patient's signature. For electronic signatures, the ESIGN Act test requires intent, consent, attribution, and reliable record retention (15 U.S.C. §7001).
Can a patient revoke the authorization?
Yes. A patient may revoke an authorization in writing at any time unless the provider has acted in reliance on it. Revocations should be directed to the record holder and logged in the patient file to prevent further disclosures.
Are electronic signatures acceptable?
Electronic signatures are acceptable when they meet ESIGN/UETA standards and any additional HIPAA administrative safeguards. Confirm the e-signature process captures intent, attribution, and an audit trail.
What if the recipient requests more records?
Obtain a new or amended authorization that specifically authorizes the additional records. Do not interpret a prior limited authorization as blanket consent for further disclosure.
Who can sign for an incapacitated patient?
Authorized representatives defined by state law or facility policy (e.g., healthcare proxy, legal guardian) may sign. Documentation of authority should be attached to the disclosure form.
How long should the authorization be kept?
Retain executed authorizations for at least as long as the health record retention policy requires—HIPAA recommends six years from creation or last effective date (45 CFR §164.530(j)). See your state rules for longer periods.

Key data points to include and protect

Patient identifiers: Full name, DOB, MRN

Recipient details: Name, address, contact

Scope of PHI: Specific record types

Purpose: Care, billing, legal

Expiration: Date or event

Signatory authority: Signature, relationship

Consequences and compliance risks to avoid

HIPAA violation: Civil and criminal fines

Wrong recipient: Breach requiring notice

Invalid authorization: Disclosure denial or rescind

I-9/TIN errors: Administrative penalties

Malpractice exposure: Provider liability risk

Record retention failure: Regulatory citations

Common mistakes when preparing the disclosure

Using vague recipient descriptions that result in overbroad access and unintended disclosure.
Leaving scope unspecified (e.g., 'all records') instead of limiting by date range or record type.
Failing to verify the identity or authority of the person signing on behalf of the patient.
Not documenting revocations or updates, leading to downstream confusion and possible improper disclosures.

How disclosures are routed and processed

Typical operational flow for handling a completed disclosure within a healthcare setting.

Intake: Clinic staff collect and verify authorization details.
Record retrieval: Medical records team locates requested PHI.
Delivery method: Records sent via secure electronic transfer or physical delivery.
Audit and logging: Release recorded in audit trail and patient chart.

Configuring an electronic disclosure workflow

Key configuration items when setting up an e-disclosure process to ensure security and auditability.

Field	Configuration
Authentication method	Email link or SMS code
Audit logging	IP, timestamp, actions
Retention policy	Encrypted storage, 6+ years
Delivery options	Secure portal, SFTP, encrypted email

Technical considerations for digital signing and secure transfer

Ensure your chosen platform supports HIPAA-level controls, tamper-evident audit trails, and secure delivery options before enabling e-disclosures.

Encryption: TLS in transit
Data at rest: AES-256 storage
Authentication: Multi-factor options

Platforms that provide audit logs, BAA support, and integrations with EHR systems reduce administrative overhead and help demonstrate compliance with HIPAA and ESIGN requirements.

Timeframes and processing expectations

Common timelines for fulfilling disclosure requests and related deadlines to track.

Request fulfillment:

Typically 30 days unless state law requires sooner

Expedited requests:

Faster handling for clinical need; document basis

Retention start:

Effective date is signature date

Revocation effect:

Prospective only; does not undo prior releases

Audit retention:

Maintain logs for at least 6 years

Organizations and roles that commonly complete this disclosure

A range of healthcare and related organizations routinely use disclosures to exchange PHI safely and lawfully.

Hospitals and clinics — release records for continuity of care, referrals, and specialist consultations.
Behavioral health providers — manage sensitive mental health and substance use records under specific state rules.
Health plans and insurers — request records for claims adjudication and utilization review.

Accurate completion by these groups reduces processing time, mitigates breach risk, and supports timely patient care.

Who signs the disclosure and when they’re authorized

Patient / Individual

The patient (or competent adult) is the primary signer. Their signature attests to informed consent for the specified disclosure and is required except when other legal authority applies.

Authorized representative

Persons with documented authority—such as a healthcare proxy, legal guardian, or parent of a minor—may sign. Include proof of authority (power of attorney, court order) with the disclosure.

Essential components of a professional disclosure form

A clear, compliant disclosure includes defined fields and statements to meet HIPAA and ESIGN standards while minimizing ambiguity for staff and recipients.

Identification

Complete patient identifiers (name, DOB, MRN) and requester details to ensure accurate record matching and minimize the risk of disclosing another individual's PHI.

Recipient and purpose

Name the recipient and state the purpose of disclosure (e.g., 'continuity of care', 'legal', 'billing') to limit downstream use and meet HIPAA authorization requirements.

Specific scope

Define record types or date ranges (e.g., 'operative report 01/01/2023–06/30/2023') to avoid overly broad releases that may expose unrelated sensitive data.

Expiration

Specify a clear expiration date or event; open-ended authorizations increase risk and may not satisfy institutional policies or payer requirements.

Revocation notice

Explain how a patient may revoke the authorization and that revocation is prospective; include contact details for submitting revocation requests.

Signature block

Include signature, printed name, date, and relationship. For representatives, attach proof of authority and document identity verification steps.

Supporting documents and export formats to include

Collecting the right attachments and offering standard export formats reduces friction and supports secure transfers to external recipients.

Authorization attachment

Attach copies of ID, power of attorney, or guardianship papers when a representative signs; these verify authority and prevent disputes.

Consent addenda

Include any required HIPAA-compliant addenda or state-specific disclosure notices that clarify secondary uses or re-disclosure limitations.

Export formats

Provide records in PDF or secure electronic formats (PDF/A, encrypted ZIP) and indicate whether images, scanned documents, and structured data (CCD/CCDA) are included.

Delivery receipts

Save proof of delivery (secure portal receipt, SFTP logs, or signed courier confirmation) to document fulfillment and for audit purposes.

Practical tips for accurate and efficient completion

Adopt consistent policies and train staff to reduce errors and processing time when handling disclosures.

Use standardized templates

Deploy a single, policy-approved disclosure template across the organization to ensure required elements are always collected and to simplify staff training and QA.

Verify recipient contact details

Confirm recipient addresses, fax numbers, and portal endpoints before sending to avoid misrouting sensitive records and to ensure timely delivery.

Log every request

Record intake date, requester identity, purpose, and fulfillment steps in the EHR or a tracking system to maintain an auditable chain of custody.

Limit disclosure scope

When possible, release only the minimum necessary information to accomplish the stated purpose, in keeping with HIPAA privacy principles.

Representative vendor pricing and compliance features

Comparison of starting prices and basic capability signals for common eSignature vendors; signNow is listed first in accordance with vendor ordering rules.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	Yes
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Real-world examples of disclosure use cases

Two typical scenarios showing how disclosures are applied in practice and the practical outcomes they produce.

Hospital transfer

A patient transferred between hospitals requires immediate records

timely electronic authorization reduces transfer delays
The receiving team obtained imaging and operative notes within hours, improving continuity of care and avoiding duplicated testing.

Legal request

An attorney requests records for litigation with a patient-signed release

certified copies and a chain-of-custody were provided
The provider attached authorization, proof of identity, and audit logs; this satisfied the court and reduced follow-up subpoenas.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now