Can the form be signed electronically?

Yes. Electronic signatures meet ESIGN and UETA requirements when the record shows intent, consent, attribution, and retention capability; consumer-facing records must include ESIGN consumer disclosure when applicable.

Is notarization required for medical releases?

Generally no; notarization is not typically required for HIPAA authorizations. Some institutions or third parties may request notarization for additional assurance — confirm local policy.

How long does a provider have to respond?

HIPAA requires timely access, typically within 30 days of request with one permitted 30-day extension; providers must inform the requester of any extension and the reason.

How do I revoke an authorization?

Submit a written revocation to the provider that signed the release. The revocation applies prospectively and does not undo disclosures made while the authorization was valid.

What if I’m signing as a representative?

Provide documentation of authority such as guardianship papers, power of attorney, or parental status; failure to document authority commonly results in request denial.

Can fees be charged for copies?

Yes. Providers may charge reasonable, cost-based fees for copying and postage; state law or facility policy may further limit allowable charges.

Electronic Signature
Templates
Miscellaneous
Patient Release Records Form

Patient Release Records Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Patient Release Records Form

Recitals

WHEREAS, Patient Name: (hereinafter "Patient") has requested the release of certain protected health information in accordance with applicable law; and

WHEREAS, Custodian of Records: (hereinafter "Custodian") maintains the requested records and is authorized to disclose them pursuant to this authorization; and

WHEREAS, Recipient: (hereinafter "Recipient") will receive the records for the purpose set forth below and will treat them in accordance with applicable confidentiality requirements.

Patient / Requester Information

Patient Full Legal Name Date of Birth Patient ID / Medical Record Number Patient Address

Phone

Email

If requester is not the patient, state relationship and authority to act

Custodian of Records

Facility / Provider Name Custodian Address

Recipient Information & Purpose

Recipient / Organization to Receive Records Recipient Address Purpose of Disclosure Method of Delivery (select all that apply)

Mail Fax Secure Electronic Transfer In-person Pickup

Scope of Work — Records to Be Released

Specify types of records, date range, and any limitations. If left blank, the authorization covers all records maintained by the Custodian for the period specified.

Description of Records and Instructions

From (start date)

To (end date)

Payment Terms

The Patient or Requester agrees to pay reasonable fees for copying, postage, and retrieval as permitted by law. Fees must be paid in accordance with the schedule below.

Fee Amount (per page or flat fee) Payment Schedule Late Fee

Term and Termination

This Authorization is effective as of the date signed and shall remain in effect until the earlier of the date specified below or the date revoked in writing by the Patient or authorized representative.

Effective Date

Expiration Date

Notice Period to Terminate

Confidentiality and Sensitive Information

The Recipient shall maintain the confidentiality of disclosed records in accordance with applicable law. Redisclosure of information is permitted only as allowed by law or with further written authorization from the Patient.

Authorization to Release Sensitive Information (initial each applicable)

HIV/AIDS-related information Mental health or psychotherapy notes Substance abuse treatment records

By checking any sensitive categories above, the Patient acknowledges express, informed consent for release of such information and understands that special protections apply. The Custodian will not release psychotherapy notes without a specific, separate authorization in compliance with law.

Revocation and Acknowledgments

The Patient may revoke this Authorization at any time by providing a signed, written revocation to the Custodian. Revocation will not affect disclosures already made in reliance on this Authorization prior to receipt of the revocation. The Patient acknowledges that treatment, payment, enrollment, or eligibility for benefits will not be conditioned on signing this Authorization except where allowed by law.

Revocation Address or Contact for Custodian

Governing Law

This Authorization and any disputes arising hereunder shall be governed by and construed in accordance with the laws of the jurisdiction where the Custodian is located, without regard to its conflicts of law principles.

Entire Agreement

This Authorization constitutes the entire agreement between the parties with respect to the release of the Patient's health information and supersedes all prior agreements, representations, and understandings related to the subject matter herein.

Certification

I certify that I have read and understand this Authorization, that the information provided on this form is accurate, and that I am signing voluntarily. I understand the limits on redisclosure and my right to revoke as described above.

Additional Instructions or Special Handling

Patient / Authorized Representative:

By:

Date:

Recipient / Custodian Representative:

By:

Date:

What the Patient Release Records Form Is and when it’s used

A Patient Release Records Form is a written authorization that lets a patient or authorized representative permit a covered entity to disclose specified protected health information to a named person or organization. It identifies the patient, the records or date ranges to be released, the recipient, the purpose, an expiration or revocation clause, and an explicit signature. The form must meet HIPAA authorization requirements and can be submitted electronically under ESIGN/UETA when the form demonstrates intent, consent, attribution, and retention.

Why a clear release form matters for patient care and compliance

A complete, compliant release accelerates care coordination, protects patient privacy, and documents consent for disclosures. Proper forms reduce administrative delay, avoid denied requests, and create an auditable record suitable for litigation or audit.

Who fills and signs a Patient Release Records Form

Roles should be clearly documented on the form to show who requested, who released, and when the release occurred for audit and compliance.

Patients or authorized representatives (parents, guardians, POA) — Submit or revoke authorizations and confirm identity before release.
Healthcare providers and medical records departments — Verify request validity, redact sensitive entries when required, and record disclosures.
Third-party requestors (attorneys, insurers, researchers) — Provide purpose and scope; may need additional consent for sensitive data.

Key security and compliance details to include

HIPAA: BAA required; protects PHI

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

Audit trail: Timestamped actions and signer attribution

Access controls: Role-based access and activity logging

Retention policy: Store copies per regulatory retention rules

Authentication: Email, SMS code, or stronger multi-factor

Step-by-step: completing a Patient Release Records Form

Follow these steps to create a valid authorization that can be processed quickly and complies with HIPAA.

01

Prepare the form: Select a HIPAA-compliant template and add required fields.
02

Identify parties: Enter patient details and full recipient name and address.
03

Specify records: List exact record types or date ranges for disclosure.
04

Sign and date: Obtain the patient or authorized signer’s dated signature.

Digital signing and technical options for e-submission

Ensure the vendor supports a HIPAA BAA if PHI will be stored or transmitted, and retain a tamper-evident audit trail for the release.

Accepted formats: PDF, DOCX
Integrations: EHR portals, Google Workspace, NetSuite
Authentication: Email link, SMS code, or KBA

Configuring an online release workflow

Set up fields and signer authentication to match your organization’s acceptance policy and legal obligations.

Field	Configuration
Patient identity	Require DOB and MRN for verification
Record selection	Use checkboxes and conditional fields
Signer authentication	Select email, SMS code, or stronger MFA
Audit retention	Capture timestamps and IP addresses

Where completed release forms are sent and how they move

A completed release typically routes from requester to records staff, then to the recipient with retained documentation of the disclosure.

Submit to records: Send signed form to the medical records department
Records review: Records staff verifies identity and scope
Deliver to recipient: Provide records via secure portal or encrypted email
Archive copy: Retain a copy for audit and compliance

Typical timelines and provider response expectations

Be aware of statutory response times and internal processing SLAs when you submit or request medical records.

Request acknowledgement:

Confirm receipt promptly and note tracking number

Provider response timeframe:

HIPAA requires access within 30 days; one 30-day extension permitted

Extension notice:

Provider must notify patient of extension and reason

Fees and copies:

Charge only reasonable, cost-based copying fees

Urgent requests:

Expedite when treatment-related or court-ordered

Common mistakes that delay or invalidate releases

Incomplete patient identifiers: Missing DOB or MRN leads records staff to request clarification and delays disclosure by days or weeks.
Overbroad or vague descriptions: Requests like 'all records' without date ranges cause redaction issues and require follow-up to limit scope.
Missing expiration or revocation terms: Lack of an end date can create ambiguity about how long the authorization remains valid.
Incorrect signer authority: Submitting a guardian or POA without proof of authority often results in rejected requests and administrative backlog.

Risks and potential consequences of an improper release

HIPAA fines: Civil penalties and corrective action possible

Denied access: Records withheld until valid authorization provided

Privacy breaches: Improper disclosure increases liability risk

Invalid authorization: Legal challenges to disclosures may follow

Delayed care: Care coordination may be interrupted

Litigation exposure: Wrongful disclosure can prompt lawsuits

Pricing and feature snapshot for common eSignature platforms

Compare starting price, trial availability, bulk-send, audit trail, HIPAA support, and envelope caps when selecting an eSignature provider.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial, no credit card	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Practical tips to speed approvals and protect privacy

Follow these practices to minimize follow-up, reduce rejection risk, and document consent clearly.

Confirm identity and authority before processing

Verify a government ID, POA document, or court order when a representative submits a release; record verification steps in the file for auditability.

Limit scope to what is necessary

Specify exact record types and date ranges rather than 'all records' to reduce redaction issues and limit unnecessary disclosure of sensitive data.

Use standardized templates with required fields

Standardize forms with mandatory fields and validation to cut clerical errors and speed automated processing in the records office.

Retain clear revocation instructions

Include a revocation clause and instructions for withdrawing consent; process revocations in writing and preserve proof of receipt.

Frequently asked questions about Patient Release Records Forms

Answers to common questions about electronic signing, notarization, revocation, and timelines for medical record releases.

Need help? Contact support

Can the form be signed electronically?
Yes. Electronic signatures meet ESIGN and UETA requirements when the record shows intent, consent, attribution, and retention capability; consumer-facing records must include ESIGN consumer disclosure when applicable.
Is notarization required for medical releases?
Generally no; notarization is not typically required for HIPAA authorizations. Some institutions or third parties may request notarization for additional assurance — confirm local policy.
How long does a provider have to respond?
HIPAA requires timely access, typically within 30 days of request with one permitted 30-day extension; providers must inform the requester of any extension and the reason.
How do I revoke an authorization?
Submit a written revocation to the provider that signed the release. The revocation applies prospectively and does not undo disclosures made while the authorization was valid.
What if I’m signing as a representative?
Provide documentation of authority such as guardianship papers, power of attorney, or parental status; failure to document authority commonly results in request denial.
Can fees be charged for copies?
Yes. Providers may charge reasonable, cost-based fees for copying and postage; state law or facility policy may further limit allowable charges.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now