Medical Records Release Form (HIPAA)

A medical records release form is a document that permits a medical office to disclose a patient’s protected health information. Medical release forms include details about the information authorized for disclosure, its purpose, and the patient’s rights under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Medical Records Release Form (HIPAA)

A medical records release form is a document that permits a medical office to disclose a patient’s protected health information. Medical release forms include details about the information authorized for disclosure, its purpose, and the patient’s rights under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Email Delivery

Email Delivery

Email Delivery

A medical records release form is a document that permits a medical office to disclose a patient’s protected health information. Medical release forms include details about the information authorized for disclosure, its purpose, and the patient’s rights under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

1. Home »
2. HIPAA »
3. Medical Records Release

By Type (4)

Dental

Hospital

Medicare

Veterans Affairs (3)

Covered Entities

Healthcare providers that transmit medical records electronically are considered covered entities and must comply with HIPAA’s rules when sharing or using protected health information (PHI).

Fees ($)

When an individual requests access to their medical files or asks for their records to be forwarded to a third party, the covered entity can charge a “reasonable, cost-based fee” to pay for the following [1] :

• Labor – Costs of labor for making copies, whether in paper or electronic format.
• Supplies – Expenses for supplies required to produce copies.
• Postage – Costs associated with sending physical copies.
• Preparation – Costs associated with preparing a description of medical records (must be agreed to beforehand).

HIPAA Requirements for Authorization

Generally, covered entities must obtain the patient’s approval before sharing PHI for marketing purposes or other reasons that require patient authorization under HIPAA’s privacy rule. [2] To authorize a disclosure, patients will need to sign a release form that contains the following [3] :

• The name of each person or entity allowed to release the patient’s records
• The receiving party’s name or identifying information
• A description of the medical records to be used or disclosed
• An explanation of the reason for the release
• The date or event upon which the patient’s authorization expires
• The patient’s signature with the date

The release must also include certain disclosures, including that [4] :

• The patient can revoke the release (revocation instructions and exceptions must be included)
• The patient’s health care won’t be affected if they choose not to authorize the release
• The released information may be redisclosed by the recipient and no longer protected by HIPAA

Covered entities must disclose medical records within 30 days of receiving a request from the patient. [5] This time frame can be extended an additional 30 days by providing a written statement outlining the reasons for the delay (only one extension is permitted). [6]

Sources

1. 45 CFR 164.524(c)(4)
2. 45 CFR 164.508(a)(1), 45 CFR 164.502(a)(1)
3. 45 CFR 164.508(c)(1)
4. 45 CFR 164.508(c)(2)
5. 45 CFR 164.524(b)(2)(i)
6. 45 CFR 164.524(b)(2)(ii)