How to Fill Out a Medical Release Form: Sections, Signing, Submitting

To fill out a medical release form correctly, you need to identify yourself and the provider holding the records, name exactly who should receive them, describe the specific records and dates you want released, state a purpose, set an expiration, and sign and date the form. Miss any one of those and the provider can reject it. The rest is detail, and the detail is where most forms go wrong.

Gather Your Information Before You Start

Sitting down with a blank form and realizing you don’t have a fax number or a medical record number is the fastest way to stall. Pull everything together first:

Your full legal name, date of birth, current address, phone number, and any patient or medical record number the provider has assigned you.
The full name and address of the healthcare provider or facility that currently holds the records.
The full name, address, phone number, and fax number of whoever should receive the records, whether that’s another doctor, an attorney, or an insurance company.
A clear idea of exactly which records you want released, including the type of record and the date range.
The reason for the release, such as continuity of care, an insurance claim, or a legal proceeding.
A date or event after which the authorization should expire.

Use your legal name exactly as it appears in the provider’s records. A nickname or an old address is one of the most common reasons a form gets bounced back.

Complete Each Section of the Form

Patient Identification

Enter your legal name, date of birth, address, and any medical record or patient ID number in the fields provided. Match what the provider has on file.

Who Is Releasing the Records

Fill in the name of the practice or facility, its address, and the department if the form asks. This is the provider you’re authorizing to hand records over.

Who Is Receiving the Records

Give the recipient’s full name, mailing address, phone, and a fax number or secure email if you have one. Vague recipient information is a common cause of records getting misrouted or held up.

Description of the Records

This is where precision matters most. If the form has checkboxes, tick only what you actually need. If it has a write-in field, be specific about both the type of records and the date range. Something like “lab results from January through March 2025” is far more useful than “all medical records” when labs are all you need.

There is a good reason to keep this narrow. HIPAA’s “minimum necessary” standard, which normally limits how much a provider can share, does not apply to disclosures you authorize yourself.¹ If you write “all records,” the provider can send everything on file. Ask for what you need and nothing more.

Purpose of the Release

Pick the option that fits, or write your own. Continuity of care, insurance claim, and legal proceeding are common. If you don’t want to explain, “at the request of the individual” satisfies the federal requirement on its own.²

Expiration Date or Event

Do not leave this blank. A form without an expiration is incomplete and can be rejected.² A specific calendar date like “December 31, 2026” is the clearest option. An event-based expiration such as “upon completion of legal proceedings” works when the endpoint is uncertain. When you’re not sure, a one-year window gives you enough time without leaving an open-ended authorization in circulation.

Signature and Date

Sign and date the form. The signature must come from the patient or someone with legal authority to act on the patient’s behalf. HIPAA does not require notarization or a witness.³ Some forms include a witness line anyway; leaving it blank does not invalidate the authorization under federal law.

Sensitive Records Need a Separate Form

Not every category of record can ride on a standard release. Two categories carry extra federal protection, and a general form will not reach them.

Psychotherapy notes are the personal notes a therapist keeps separate from the main chart. Releasing them requires a standalone authorization, even to another treating provider. A “release all my records” form will not cover them.⁴

Substance use disorder treatment records fall under a separate federal regulation with its own consent requirements, including a statement about possible redisclosure and a description of the consequences of refusing to sign. Consent for these records in connection with a legal proceeding cannot be combined with consent for any other purpose; it has to stand alone.⁵

If your records touch either area, ask the provider whether their standard form covers them or whether you need a separate document. Getting this wrong usually means the provider will simply hold back those records and you will have to start over.

Signing on Behalf of Someone Else

If you are filling out a release for another person, you need legal authority to do so. Under HIPAA, a “personal representative” has the same rights as the patient to authorize disclosure, but only within the scope of that authority.⁶

For a living adult or emancipated minor, that means someone holding a health care power of attorney, a court-appointed guardian, or a holder of a general or durable power of attorney that includes health care decisions.
For a deceased patient, an executor, an administrator of the estate, or anyone with legal authority to act on behalf of the decedent or the estate can sign. This is not limited to people who could make health care decisions during the patient’s life.

If your authority is narrow, say a power of attorney covering only one specific treatment, the provider should treat you as the representative only for records relevant to that treatment. Bring a copy of the document that grants your authority when you submit the form. The provider will almost certainly ask for it.

Review, Copy, and Submit

Before you hand the form in, read it once more against the checklist: patient identification, disclosing provider, recipient, records description, purpose, expiration, and your signature and date. A form missing any required element is considered defective and the provider cannot act on it.²

Make a copy of the signed form for your own records before sending it. You can submit by mail, fax, hand-delivery, or through a secure patient portal if the provider offers one. A photocopy, fax, or electronically transmitted version of your signed authorization is legally valid; you do not need to deliver the original.⁷

What Happens After You Submit

Providers have 30 calendar days to respond to your request. They can extend that once by another 30 days, but only if they notify you in writing of the delay and give you a new expected date. So the outer limit is 60 days from submission.⁸

They can charge a reasonable, cost-based fee, but only for the labor of copying, supplies like paper or a USB drive, and postage if you want the records mailed. They cannot charge you for searching, retrieving, or reviewing your file, or for keeping their systems HIPAA-compliant. State law that authorizes a higher fee does not override this federal cap.⁹ If the provider offers a patient portal with download capability, they generally cannot charge you anything for accessing records that way.¹⁰

Providers can deny a request, but only on specific grounds spelled out in federal rules, and your reason for wanting the records is never one of them. Some denials, such as psychotherapy notes or information compiled for a legal proceeding, cannot be appealed to the provider. Others, like a licensed professional’s determination that access could endanger you or someone else, are reviewable by a different licensed professional not involved in the original decision. Any denial must be provided to you in writing.⁸

Canceling or Narrowing a Release

You can cancel an authorization at any time in writing. The revocation takes effect when the provider receives it, not when you mail it and not when a copy reaches a third party like your attorney. Send it directly to the provider that holds the authorization.¹¹

Two limits are worth knowing. A revocation does not undo disclosures the provider already made while the authorization was valid. And if you signed the authorization as a condition of obtaining insurance coverage and the insurer has a legal right to contest your claim or policy, your revocation will not cut off the insurer’s access.¹¹

This is the practical reason to set a tight expiration on the form itself. A 90-day or one-year window limits your exposure even if you never get around to revoking. Only research authorizations are permitted to have no expiration; every other form should have one.