Can this be signed electronically?

Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. §7001) and UETA when the signing process shows intent, consent to transact electronically, attribution to the signer, and record retention capability.

When is patient consent required?

Patient authorization is required for most disclosures of PHI not otherwise permitted by HIPAA; release forms must meet HIPAA authorization content rules and include purpose, recipient, and a specific description of information to be disclosed.

What about sensitive records?

Certain categories (substance use, psychotherapy notes, genetic information) often require explicit additional consent or state-specific language; verify state law and include precise purpose language to avoid unlawful disclosure.

How do I verify an authorized representative?

Obtain and retain proof of authority such as a durable power of attorney, guardianship order, or court appointment; verify identity and document the verification step in the record.

Are electronic signatures HIPAA-compliant?

Electronic signatures can be HIPAA-compliant when the system supports secure authentication, audit trails, and a Business Associate Agreement (BAA) with the eSignature vendor to protect PHI.

How long must requests be retained?

Retain the request, authorization, and audit evidence per HIPAA for 6 years from creation or last effective date (45 CFR §164.530(j)), with longer periods possible under state law or organizational policy.

Electronic Signature
Templates
Healthcare
Healthcare RDR Document

Healthcare RDR Document

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE RECORDS DISCLOSURE AND RELEASE (RDR) DOCUMENT

Patient Name: Date of Birth: Medical Record Number:

Patient Contact Information

Address Phone Email

Recipient / Recipient Organization

Recipient Name or Organization Recipient Address

Recipient Phone

Recipient Fax / Secure Transfer ID

Recipient Email

Insurance / Payer Information (if applicable)

Insurance Provider

Policy / ID Number

Group Number

Relevant Medical Information (to assist recipient)

Current Medications Allergies (including drug allergies) Prior Surgeries / Significant Procedures Chronic Conditions

Records to Be Released

Select the specific records to be disclosed. Selecting certain categories requires explicit authorization below.

Types of Records All medical records (comprehensive) Progress notes / clinic notes Laboratory results Imaging reports (CT, MRI, X-ray) Operative reports Billing and insurance claim information Other (specify):

Sensitive Information — Special Authorization Required

Federal and state laws require specific authorization to release certain sensitive information. Check each category you authorize for release and initial below where indicated.

HIV/AIDS test results and records Mental health therapy notes and psychotherapy records Substance use disorder treatment records Genetic testing results

If any of the above are selected, patient initials to specifically authorize release:

Date Range for Records

From: To: If no dates specified, authorization covers the entire medical record for the entity named above.

Purpose of Disclosure

Continuing care / treatment Insurance claim / coverage Legal representation Personal use by patient Other (specify):

Expiration and Revocation

This authorization will expire on: or, if left blank, one year from the date of signature. This authorization may be revoked in writing at any time, except to the extent that action has already been taken in reliance on it.

Fees and Method of Delivery

I understand that a reasonable fee may be charged for copying and postage. Records may be delivered by mailed paper copy, secure electronic transfer, or fax as directed above. For electronic delivery, I acknowledge that there are risks to confidentiality and I consent to the method selected.

Preferred Delivery Method Mailed paper copy Fax Secure electronic transfer

Redisclosure Notice

Information disclosed pursuant to this authorization may be subject to redisclosure by the recipient and may no longer be protected by federal or state privacy laws. The recipient may be prohibited from redisclosing certain substance use disorder records without additional authorization.

Certification

By signing below I certify that I have read and understand this authorization, that I am the patient or am authorized to act on behalf of the patient, and that the information provided on this form is true and correct to the best of my knowledge. I understand that signing this form is voluntary and that treatment, payment, enrollment, or eligibility for benefits will not be conditioned on signing this authorization unless allowed by law.

HIPAA Acknowledgment

I acknowledge that I have been informed of my privacy rights and the uses and disclosures permitted by law. I understand that information disclosed pursuant to this authorization may include health information protected by state law or special statutes that require explicit authorization.

I acknowledge and consent to the terms above.

Patient / Authorized Representative Printed Name:

Relationship to Patient (if signing for patient):

Signature:

Date:

If signed by authorized representative, documentation of authority (power of attorney, guardianship, or other legal documentation) must be attached and will be retained with this authorization.

What the Healthcare RDR Document Is and when it’s used

The Healthcare RDR Document (Request for Disclosure of Records) is a standardized authorization used to request, release, or transfer protected health information (PHI) among providers, payers, legal representatives, and patients. It identifies the patient, lists the records and date range, names the recipient, states the purpose for disclosure, and records a dated signature or equivalent electronic consent. In the United States the form must meet HIPAA authorization requirements and can be executed electronically under the ESIGN Act and UETA when intent, consent, attribution, and retention are demonstrable.

Why a clear RDR Document matters for compliance and continuity

A complete Healthcare RDR Document documents patient consent, reduces processing delays, and creates an auditable record of disclosure decisions. Properly completed forms reduce HIPAA risk and satisfy ESIGN/UETA standards for enforceable electronic execution when identity and intent are documented.

Who typically completes or receives a Healthcare RDR Document

Healthcare providers, patients, and authorized representatives commonly use this document to request or release medical records across ambulatory and inpatient settings.

Hospitals and clinics — release PHI for continuity of care, referrals, and second opinions.
Health information management teams — verify identity, process records, and preserve audit trails.
Patients and authorized representatives — request copies for treatment, legal matters, or insurance claims.

Insurers, legal counsel, and research coordinators also process RDR Documents; consistent completion reduces administrative burden and legal exposure across these use cases.

Representative profiles who handle RDR Documents

Health Information Manager

Coordinates intake and fulfillment of record requests, confirms patient identifiers and authority, applies the minimum necessary principle, logs disclosures in the release register, and ensures retention of the request and audit trail for compliance and later review.

Authorized Representative

A patient-named or legally appointed individual (guardian, attorney, or executor) who signs the RDR Document or provides proof of authority; must supply supporting documentation so providers can lawfully disclose PHI without risking HIPAA violations.

Security and compliance items to track on each request

Encryption in transit: TLS 1.2/1.3

Encryption at rest: AES-256

HIPAA compliance: BAA required

Audit trail: Timestamps, IP, signer

Regulatory certs: SOC 2 Type II, ISO 27001

FDA records: 21 CFR Part 11 controls

Step-by-step: completing and routing an RDR Document

Follow these steps to complete, authenticate, and route a Healthcare RDR Document accurately for compliant disclosure.

01

Collect Patient Info: Confirm legal name, DOB, and medical record number.
02

Specify Records: List record types and exact date ranges.
03

Obtain Consent: Patient or representative signs and dates form.
04

Route and Track: Deliver to recipient and retain audit trail.

Recommended online workflow settings for RDR processing

Configure your eSubmission workflow to capture identity, consent, and an auditable record while restricting access to minimum necessary PHI.

Field	Configuration
Upload Format	PDF, DOCX accepted
Signature Type	Typed, drawn, or PKI-based signatures
Authentication	Email, SMS code, or KBA if required
Retention & Audit	Enable audit trail, exportable certificate

Typical eSubmission flow for a Healthcare RDR Document

A standard digital workflow includes uploading the form, placing required fields, authenticating the signer, and capturing an audit trail for secure delivery and archiving.

Upload Document: Attach PDF or DOCX with required fields.
Place Fields: Add signature, date, and ID fields.
Authenticate Signer: Use email link, SMS code, or stronger proofing.
Complete & Archive: Capture certificate and store securely.

Technical considerations for eSubmission and integrations

Confirm supported file types, authentication methods, and integrations before enabling online RDR processing to avoid workflow interruptions.

File Formats: PDF/A, PDF, DOCX accepted
Integrations: Salesforce, Microsoft 365, Google Workspace, NetSuite
Authentication: Email, SMS, KBA, SSO options

Common pitfalls when preparing Healthcare RDR Documents

Incomplete patient identifiers (name, DOB, MRN) cause record mismatches and processing delays that often require re-submission and manual verification.
Vague or open-ended date ranges lead to partial disclosures or requests for clarification, increasing administrative time and patient frustration.
Missing documentation of authority for representatives (power of attorney, guardianship letters) results in denied requests or legal exposure for the releasing provider.
Failing to capture or retain an auditable consent trail for electronic signatures can create compliance gaps under ESIGN and HIPAA requirements.

Key legal and operational risks tied to incorrect RDRs

HIPAA Violations: Civil fines, corrective action

Unauthorized Disclosure: Civil liability, reputational harm

Delay in Care: Treatment or claim impacts

Contract Breach: Payor or vendor penalties

Invalid Consent: Request rejection, rework

Recordkeeping Failures: Regulatory inspection risk

Typical timelines and provider response expectations

Timelines vary, but federal rules set baseline expectations that providers and requestors should follow to maintain compliance and timely access to records.

HIPAA response timeframe:

Generally 30 days to respond; one 30-day extension permitted (45 CFR §164.524).

Expedited requests:

Handled sooner when clinical urgency is documented; policies vary by provider.

Identity verification:

Verification delays can add several business days to processing time.

Delivery expectations:

Electronic delivery often completes within 1–3 business days after retrieval.

Record retrieval time:

Complex or archived records may require 10–30 business days to assemble.

Key processing milestones from request to disclosure

A typical request follows four sequential milestones; documenting each stage helps demonstrate compliance and identify bottlenecks.

01

Request Received

Intake date recorded and initial completeness check performed.

02

Identity Verified

Confirm patient or representative authority before retrieving records.

03

Records Retrieved

Locate and compile requested documents from clinical systems.

04

Disclosure Completed

Deliver records to recipient and store audit evidence.

Representative eSignature pricing and compliance snapshot

Compare starting price, trial availability, bulk-send capability, audit trail, HIPAA support, and envelope caps across common eSignature providers; signNow is listed first per vendor comparison conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Practical examples of Healthcare RDR Document use

These concise scenarios show typical reasons and outcomes for record disclosure requests in clinical and administrative contexts.

Hospital Transfer

A receiving hospital requests prior treatment records to coordinate care and avoid duplicate testing

Records requested include imaging and discharge summaries
Accurate date ranges and complete identifiers enabled electronic transfer within three business days, avoiding treatment delays and additional tests.

Patient Legal Request

A patient requests records for a pending appeal related to insurance denial

Request specifies billing and progress notes for a twelve-month period
Providing a clearly signed and dated authorization reduced legal follow-up and supported timely claim adjudication.

Frequently asked questions about Healthcare RDR Documents

Answers to common operational and legal questions when preparing, signing, and transmitting a Healthcare RDR Document.

Need help? Contact support

Can this be signed electronically?
Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. §7001) and UETA when the signing process shows intent, consent to transact electronically, attribution to the signer, and record retention capability.
When is patient consent required?
Patient authorization is required for most disclosures of PHI not otherwise permitted by HIPAA; release forms must meet HIPAA authorization content rules and include purpose, recipient, and a specific description of information to be disclosed.
What about sensitive records?
Certain categories (substance use, psychotherapy notes, genetic information) often require explicit additional consent or state-specific language; verify state law and include precise purpose language to avoid unlawful disclosure.
How do I verify an authorized representative?
Obtain and retain proof of authority such as a durable power of attorney, guardianship order, or court appointment; verify identity and document the verification step in the record.
Are electronic signatures HIPAA-compliant?
Electronic signatures can be HIPAA-compliant when the system supports secure authentication, audit trails, and a Business Associate Agreement (BAA) with the eSignature vendor to protect PHI.
How long must requests be retained?
Retain the request, authorization, and audit evidence per HIPAA for 6 years from creation or last effective date (45 CFR §164.530(j)), with longer periods possible under state law or organizational policy.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now