Establishing secure connection…Loading editor…Preparing document…

Healthcare PHI Release Restriction Request

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Healthcare PHI Release Restriction Request

Use this form to request that the health care provider restrict the use or disclosure of your protected health information (PHI). Complete all applicable sections. Requests will be reviewed and accepted or denied in accordance with applicable law and the provider's policies. If the provider agrees, the restriction will remain in effect until the expiration date below or until you revoke the restriction in writing.

Patient Information

Medical Record No.:

Date of Birth:

Gender:

Phone:

Email:

PHI To Be Restricted

I request that the following PHI be restricted from disclosure as indicated. Check all that apply and provide details where requested.

  All PHI

  Treatment notes / clinical progress notes

  Laboratory results

  Imaging / radiology reports

  Billing / payment information

  Mental health records

  Substance use treatment records

  HIV/AIDS-related records

  Genetic testing/results

  Other (describe below)

Restriction on Disclosures To

Do not disclose the restricted PHI to the following persons, organizations, or facilities. List each party by name and, if known, an address or phone number.

Purpose and Duration

Requested Effective Date:

Expiration Date (if any):

Acknowledgment and Conditions

By signing below I request that the provider restrict the use and disclosure of my PHI as specified above. I understand and acknowledge the following:

  • Provider is not required to agree to this requested restriction, except as required by law. If the provider refuses, I will be notified in writing of the reason for denial.
  • If the provider agrees to the restriction, it will apply to disclosures to the persons or entities listed above, except in an emergency or where disclosure is required by law.
  • I may revoke this request in writing at any time, except to the extent the provider has already taken action in reliance on this request.
  • This request does not apply to uses or disclosures made prior to the provider's receipt of this form, nor does it affect the provider's ability to use or disclose PHI for treatment purposes as necessary in an emergency.

Signature is required below to process this request. If signed by a personal representative or guardian, provide relationship and documentation upon request.

Provider Use Only

Decision:   Provider agrees to restriction      Provider denies restriction

Staff Name:

Title:

Date Reviewed:

Printed Name:

Signature:

Date:

Relationship to Patient (if signing on behalf of patient):

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What a Healthcare PHI Release Restriction Request Is

A Healthcare PHI Release Restriction Request is a written instruction from a patient asking a covered entity to limit use or disclosure of protected health information (PHI). The form specifies which categories of PHI are restricted, the parties or recipients covered, and the period of restriction. While HIPAA allows patients to request restrictions, covered entities are not always required to agree; exceptions apply for treatment, emergency care, or where payment or operations are involved. The request creates an audit trail and clarifies consent for third parties handling PHI.

Why submitting a restriction request matters

A clear restriction request documents patient preferences, reduces unauthorized sharing, and sets expectations for care teams and third parties. It helps providers manage disclosures and supports compliance with HIPAA privacy obligations.

Why submitting a restriction request matters

Who commonly completes this form

Organizations keep these requests with the medical record and use them to inform release workflows and staff training.

  • Patients requesting limited disclosure to insurers or family members, to protect specific behavioral health or reproductive health records.
  • Health care proxies or attorneys acting on behalf of incapacitated patients with documented authority.
  • Practice administrators or privacy officers who file and track the request within the patient record system.

Essential parts of a professional restriction request

A complete Healthcare PHI Release Restriction Request collects identification, a clear description of restricted PHI, named recipients, the restriction period, signature and date, and any legal authority for a representative. Clear structure reduces processing delays and legal ambiguity.

Patient details

Full name, date of birth, medical record or patient ID, and current contact information for accurate matching.

PHI description

Specific categories or date ranges of records to restrict (e.g., lab results, mental health notes, imaging).

Restricted recipients

Named individuals or organizations to whom disclosure is limited or prohibited.

Scope and duration

Start and end dates or an event-based end condition for when the restriction expires.

Signature and authority

Patient signature or authorized representative signature plus printed name and relationship.

Provider response area

Space for covered entity to document acceptance, denial, rationale, and effective date of action.

Step-by-step: submitting a restriction request

Follow this sequence to prepare, submit, and follow up on the restriction request with minimal friction.

  • 01
    Assemble identifiers: Gather patient name, DOB, and medical record number.
  • 02
    Specify PHI and recipients: Clearly describe records and list recipients to restrict.
  • 03
    Sign and attach proof: Sign the form and include POA or representative documentation if needed.
  • 04
    Submit and document: Send via the provider's privacy office and retain proof of delivery and receipt.

How providers typically process a restriction request

This workflow reflects common steps used by covered entities to evaluate and implement restriction requests while maintaining compliance.

  • Intake: Privacy officer logs the request and verifies identity.
  • Clinical review: Care team assesses whether restriction impacts treatment or operations.
  • Legal review: Legal or compliance staff determine enforceability under HIPAA exceptions.
  • Implementation: Accepted restrictions are entered into the EHR and flagged for billing and disclosure workflows.

Configuring an electronic workflow for restriction requests

Configure digital intake to capture required fields, authenticate signers, route for approvals, and log actions in an audit trail.

Field Configuration
Authentication Email + SMS code or stronger KBA for high-risk requests
Routing Auto-route to Privacy Officer, then Legal if flagged
Audit logging Record IP, timestamp, signer attribution and attachments
Retention Store signed request with EHR for required retention period

Technical considerations for eSubmission and storage

Use role-based access controls, audit trails, and BAAs when processing PHI to align systems and legal obligations.

  • Integrations: Salesforce, NetSuite, Microsoft 365, Google Workspace, Box, Procore
  • File formats: PDF, DOCX, HTML, Excel supported for import/export
  • Security: TLS 1.2/1.3 in transit; AES-256 at rest

eSignature vendor comparison for handling PHI release restriction requests

Compare common eSignature vendors on pricing and core capabilities relevant to PHI workflows. signNow is listed first per platform comparison conventions.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day trial Varies Varies Varies Varies
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No

Security and compliance controls to verify

Encryption in transit: TLS 1.2/1.3
Encryption at rest: AES-256
HIPAA support: BAA available
Audit trail: IP, timestamp, and action logs
Certifications: SOC 2 Type II, ISO 27001
Regulatory standards: ESIGN and UETA compliance

Consequences of incorrect or mishandled requests

HIPAA civil fines: Penalties can apply for disclosure violations
State penalties: Additional fines or sanctions under state law
Breach notifications: May trigger patient notification obligations
Denial disputes: Administrative appeals or legal challenges
Operational risk: Disruption to care coordination if critical data blocked
Reputational harm: Loss of trust and potential liability

Common problems to avoid

  • Vague descriptions of PHI that make the request unenforceable or ambiguous.
  • Missing patient identifiers that prevent the provider from locating the correct record.
  • Unsigned or undated forms that the provider will not process.
  • Failure to attach proof of representative authority when signed by an agent.

Practical tips for faster processing and better compliance

Adopt clear templates, require minimal essential fields, and validate identity to reduce back-and-forth with providers.

Use provider forms
Submit the provider's required form when available to match internal workflows and minimize rejections.
Provide identifiers
Include medical record number and DOB to expedite matching and avoid delays.
Attach authority
Include power of attorney or guardianship documents when applicable to prove signing authority.
Keep copies
Retain signed copies and delivery receipts for audit and dispute resolution purposes.

Use cases and real-world examples

Practical examples show how restriction requests are used and the outcomes that follow.

Behavioral Health Restriction

A patient requested limits on mental health therapy notes

  • Provider reviewed treatment impact and accepted restriction for billing disclosures only
  • The restriction was logged in the EHR, billing was adjusted, and the patient was notified of the effective date and any exceptions.

Third-Party Disclosure Limit

A patient asked to prevent disclosure to an estranged family member

  • Legal and clinical teams evaluated safety concerns
  • The provider denied disclosure to that individual and documented the denial with rationale and appeal instructions.

Who signs or authorizes this request

Patient — Primary Signer

The patient is the default signer; their signature demonstrates personal intent to restrict PHI and authorizes the covered entity to act on the request.

Authorized Representative

An attorney-in-fact, guardian, or executor may sign if they provide valid documentation of authority; attach a copy of the power of attorney or court order.

Frequently asked questions about restriction requests

Answers address typical points of confusion about enforceability, timelines, and what to expect after submission.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.