Establishing secure connection…Loading editor…Preparing document…

New York Authorization for Release of Health Information

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

AUTHORIZATION FOR RELEASE OF HEALTH INFORMATION PURSUANT TO HIPAA

OCA Official Form No.: 960

[This form has been approved by the New York State Department of Health]

Patient Name: Date of Birth: Social Security Number:

Patient Address:

I, or my authorized representative, request that health information regarding my care and treatment be released as set forth on this form:

In accordance with New York State Law and the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), I understand that:

1. This authorization may include disclosure of information relating to ALCOHOL and DRUG ABUSE, MENTAL HEALTH TREATMENT, except psychotherapy notes, and CONFIDENTIAL HIV* RELATED INFORMATION only if I place my initials on the appropriate line in Item 9(a). In the event the health information described below includes any of these types of information, and I initial the line on the box in Item 9(a), I specifically authorize release of such information to the person(s) indicated in Item 8.

2. If I am authorizing the release of HIV-related, alcohol or drug treatment, or mental health treatment information, the recipient is prohibited from redisclosing such information without my authorization unless permitted to do so under federal or state law. I understand that I have the right to request a list of people who may receive or use my HIV-related information without authorization. If I experience discrimination because of the release or disclosure of HIV-related information, I may contact the New York State Division of Human Rights at (212) 480-2493 or the New York City Commission of Human Rights at (212) 306-7450. These agencies are responsible for protecting my rights.

3. I have the right to revoke this authorization at any time by writing to the health care provider listed below. I understand that I may revoke this authorization except to the extent that action has already been taken based on this authorization.

4. I understand that signing this authorization is voluntary. My treatment, payment, enrollment in a health plan, or eligibility for benefits will not be conditioned upon my authorization of this disclosure.

5. Information disclosed under this authorization might be redisclosed by the recipient (except as noted above in Item 2), and this redisclosure may no longer be protected by federal or state law.

6. THIS AUTHORIZATION DOES NOT AUTHORIZE YOU TO DISCUSS MY HEALTH INFORMATION OR MEDICAL CARE WITH ANYONE OTHER THAN THE ATTORNEY OR GOVERNMENTAL AGENCY SPECIFIED IN ITEM 9(b).

7. Name and address of health provider or entity to release this information:

8. Name and address of person(s) or category of person to whom this information will be sent:

9(a). Specific information to be released:

Medical Record from to

Entire Medical Record, including patient histories, office notes (except psychotherapy notes), test result, radiology studies, films, referrals, consults, billing records, insurance records, and records sent to you by other health care providers.

Other:

Include: (Indicate by Initialing)

Alcohol/Drug Treatment

Mental Health Information

HIV-Related Information

Authorization to Discuss Health Information

(b) By initialing here I authorize

to discuss my health information with my attorney, or a governmental agency, listed here:

10. Reason for release of information:

At request of individual

Other:

11. Date or event on which this authorization will expire:

12. If not the patient, name of person signing form:

13. Authority to sign on behalf of patient:

All items on this form have been completed and my questions about this form have been answered. In addition, I have been provided a copy of the form.

Signature of patient or representative authorized by law.

Date:

* Human Immunodeficiency Virus that causes AIDS. The New York State Public Health Law protects information which reasonably could identify someone as having HIV symptoms or infection and information regarding a person’s contacts.

NYHIPAA 8/09

Instructions for the Use of the HIPAA compliant Authorization Form to Release Health Information Needed for Litigation

This form is the product of a collaborative process between the New York State Office of Court Administration, representatives of the medical provider community in New York, and the bench and bar, designed to produce a standard official form that complies with the privacy requirements of the federal Health Insurance Portability and Accountability Act (“HIPAA”) and its implementing regulations, to be used to authorize the release of health information needed for litigation in New York State courts. It can, however, be used more broadly than this and be used before litigation has been commenced, or whenever counsel would find it useful.

The goal was to produce a standard HIPAA-compliant official form to obviate the current disputes which often take place as to whether health information requests made in the course of litigation meet the requirements of the HIPAA Privacy Rule. It should be noted, though, that the form is optional. This form may be filled out on line and downloaded to be signed by hand, or downloaded and filled out entirely on paper.

When filing out Item 11, which requests the date or event when the authorization will expire, the person filling out the form may designate an event such as “at the conclusion of my court case” or provide a specific date amount of time, such as “3 years from this date”.

If a patient seeks to authorize the release of his or her entire medical record, but only from a certain date, the first two boxes in section 9(a) should both be checked, and the relevant date inserted on the first line containing the first box.

Enter text✕

What the New York Authorization for Release of Health Information Is

The New York Authorization for Release of Health Information is a written, dated document that gives a patient (or the patient's legal representative) the right to permit a covered entity to disclose protected health information to a designated person or organization. It documents the scope of records to be shared, the purpose of disclosure, who may receive the information, and how long the authorization remains effective. Where electronic signatures are used, the form must meet ESIGN (15 U.S.C. ch. 96) and New York's Electronic Signatures and Records Act (NY Tech Law §301–309) requirements to be enforceable.

Why a Proper Authorization Matters for Patients and Providers

A valid authorization protects patient privacy, clarifies what records may be released, and reduces administrative delays in care coordination or claims processing. It creates a clear legal record of consent to disclose protected health information under HIPAA and applicable New York law.

Why a Proper Authorization Matters for Patients and Providers

Who Typically Completes This Authorization and Why

Healthcare providers, patients, attorneys, insurers, and administrative staff commonly complete New York authorizations to enable information exchange for treatment, payment, or legal purposes.

  • Patients and authorized representatives who need records sent to another provider, insurer, or legal counsel for continuity of care or claims.
  • Medical records departments and release-of-information staff who process requests and verify identity and scope before disclosure.
  • Attorneys and benefits administrators requesting records for appeals, disability claims, or legal proceedings when patient consent is required.

Identifying the correct requester and documenting scope prevents improper disclosures and supports compliance with HIPAA and New York privacy provisions.

Core Components of a Professional New York Authorization for Release of Health Information

A complete authorization addresses identity, scope, purpose, expiry, signature, and revocation. Clear, unambiguous language minimizes processing errors and legal exposure when information is transferred between providers, payers, and third parties.

Patient Identity

Full legal name, date of birth, and a government ID or medical record number to confirm the subject of the records.

Recipient Details

Name and contact information for the individual or organization authorized to receive the records, including address and phone.

Scope of Records

Specific types of records to release (e.g., imaging, labs, mental health, substance use) and relevant date ranges.

Purpose of Disclosure

A concise reason for disclosure, such as treatment, payment, disability determination, or legal representation.

Expiration

A clear expiration date or event (MM/DD/YYYY); if left blank, describe default limits under policy or law.

Signature and Authority

Patient or authorized representative signature, printed name, relationship to patient, and date; include witness or notary if required.

Step-by-Step: Completing the New York Authorization for Release of Health Information

Follow these steps in order to create a valid authorization that meets both HIPAA and New York technical requirements for signature and content.

  • 01
    Step 1: Confirm identity and role of the requester before starting.
  • 02
    Step 2: Complete patient details, recipient, scope, and purpose fields accurately.
  • 03
    Step 3: Set an explicit expiration date or event in MM/DD/YYYY format.
  • 04
    Step 4: Obtain patient or authorized representative signature and date; record witness or notary if required.

Configuring an Online Authorization Workflow

When building a digital workflow, configure fields and authentication to balance ease of signing with required legal assurances for healthcare disclosures.

Field Configuration
Patient ID Required text field; auto-validate against MRN when possible
Recipient Contact Required field with address and phone subfields
Records Scope Checkboxes for record types plus date-range fields
Signature Signature field with date; enable audit trail and signer authentication

Digital Signing and Transmission Requirements

Digital completion requires secure signing, traceable audit logs, and appropriate authentication to meet HIPAA and New York requirements.

  • Authentication: Use at minimum email-based verification; stronger options include SMS OTP or identity proofing for higher-risk disclosures
  • Audit Trail: Capture signer IP, timestamp, and actions to meet attribution and retention requirements
  • Encryption: Encrypt PHI in transit (TLS 1.2/1.3) and at rest (AES-256) before transmission

Ensure the eSignature provider supports HIPAA BAA, detailed audit logs, and the required encryption standards before enabling e-submission of authorizations.

Typical Filing and Delivery Flow for an Authorization

A common process moves from request to verification to secure delivery. Each step should be recorded to support compliance audits and patient inquiries.

  • Request Received: Requester submits purpose and recipient details
  • Identity Verified: Staff confirms patient identity and legal authority
  • Authorization Completed: Patient signs and dates the form
  • Records Sent: Provider transmits records securely and logs the disclosure

Comparing eSignature Vendor Pricing and Capabilities for Health Authorizations

Key plan features and starting prices influence total cost and compliance capability. signNow is listed first for comparison; verify plan details before purchase.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Trial available Trial available Trial available Trial available
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No

Security and Compliance Essentials for PHI Release

Encryption: TLS 1.2/1.3; AES-256
Certifications: SOC 2 Type II; ISO 27001
HIPAA: HIPAA compliant BAA available
Audit Logs: Detailed signer audit trail stored
Authentication: Email, SMS OTP, or advanced identity proofing
Retention: Secure long-term archival options

Consequences of Incorrect or Incomplete Authorizations

Unauthorized Disclosure: Civil penalties and reputational harm
HIPAA Violations: Potential fines and corrective action
Delayed Care: Treatment or claims processing delays
Invalid Release: Provider may refuse to disclose records
Litigation Risk: Increased exposure to lawsuits
Repeat Requests: Operational costs from rework

Common Mistakes to Avoid When Preparing the Authorization

  • Leaving the expiration date blank or ambiguous, which can create compliance uncertainty
  • Overbroad scope language that authorizes unrelated sensitive records (e.g., substance use) without specific consent
  • Mismatched patient identifiers or signer identity that prevent record retrieval or cause denial
  • Failing to obtain required witness or notary where the state or provider policy requires it

Frequently Asked Questions About the New York Authorization for Release of Health Information

Answers to common execution, validity, and transmission questions for the New York authorization form.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users