HIPAA Release Form

What HIPAA actually is

The Health Insurance Portability and Accountability Act (HIPAA) was signed into law in 1996. Its Privacy Rule, enforced by the U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR), sets national standards for when and how “covered entities” — health plans, healthcare clearinghouses, and most healthcare providers — may use or disclose a patient's protected health information (PHI).

PHI includes anything that identifies a patient and relates to their health condition, treatment, or payment: medical records, lab results, billing statements, prescription history, mental-health notes, imaging, and even appointment scheduling information. Under the Privacy Rule, a covered entity may not disclose PHI to a third party unless the patient has signed a valid authorization, the disclosure falls under a specific exception (such as treatment, payment, or public-health reporting), or the patient is incapacitated and the disclosure is in the patient's best interest.

What the release form does

A HIPAA authorization form grants a named individual (or organisation) permission to receive specific protected health information from a specific provider or health plan. According to HHS guidance, a valid authorization must include:

• A description of the information to be disclosed (e.g., “all medical records,” “cardiology records from January 2024 to present,” or “prescription history”).
• The name of the person or entity authorised to receive the information.
• The name of the covered entity (provider or plan) authorised to make the disclosure.
• The purpose of the disclosure (or a statement that it is “at the request of the individual”).
• An expiration date or event (e.g., “one year from date of signature” or “upon completion of treatment”).
• The patient's signature and date, plus a statement that the authorization can be revoked in writing.

Most hospitals and clinics provide their own authorization form, but you are not required to use it — any document that contains the required elements is valid under federal law. Some states impose additional requirements (for instance, New York requires specific language for HIV-related information under Public Health Law § 2782).

Who needs a HIPAA release

The most common scenarios in which a signed HIPAA authorization matters:

• Adult children managing a parent's care: Once a child turns 18, parents lose automatic access to their medical records. The reverse is also true — an adult child helping an aging parent navigate specialists, prescriptions, or insurance claims needs a signed release to speak with those providers on the parent's behalf. The National Institute on Aging (NIA) specifically recommends that family caregivers obtain a HIPAA authorization early, before a health crisis makes it harder to get one signed.
• Divorced or separated parents sharing a child's records: A non-custodial parent may need an authorization to access a minor child's medical records, depending on state law and custody arrangements.
• Spouses and partners: Marriage does not automatically grant a spouse the right to access medical records. A signed authorization (or designation as a personal representative under HIPAA) is needed for ongoing access.
• Professional caregivers and care coordinators: A home-health aide or patient advocate typically needs written authorization to communicate with the patient's doctors or pharmacy.

HIPAA does not prevent emergency treatment

A common misconception is that HIPAA can block or delay emergency care. It does not. The Privacy Rule explicitly permits disclosures necessary to treat a patient, and the HIPAA enforcement agency (OCR) has published guidance confirming that emergency medical providers — paramedics, ER physicians, trauma teams — may share PHI as needed for treatment without prior authorization from the patient. If you are unconscious after a car accident, the ER team will treat you and share information with consulting specialists regardless of whether anyone has a release form on file.

Where HIPAA becomes relevant is after the emergency. Once you are stabilised, the hospital cannot update your family on your condition, share test results, or discuss your treatment plan with a relative unless that person is authorised — either by a signed HIPAA release, by being your designated personal representative, or by a healthcare power of attorney that has been activated.

HIPAA release vs healthcare power of attorney

These two documents overlap but do different things:

• HIPAA release: Grants access to medical information. The authorised person can read your records and talk to your doctors, but cannot make decisions on your behalf.
• Healthcare power of attorney (healthcare proxy): Grants authority to make medical decisions for you when you are incapacitated. A healthcare proxy is typically also treated as a personal representative under HIPAA, meaning they get record access as well — but only once the power of attorney activates (usually when a physician certifies you cannot make decisions for yourself).

For this reason, many elder-law attorneys recommend having both documents: a healthcare power of attorney for decision-making authority, and a separate HIPAA release that is effective immediately so your designated person can access records and talk to your providers even while you are still competent.

How to get and use one

You can ask any healthcare provider for their authorization form, download a template from your state's health department website, or draft your own as long as it contains the federally required elements listed above. The form does not need to be notarised under federal law (though a few states require notarisation or witnesses for healthcare proxies, which is a separate document).

Keep a signed copy with your emergency documents — alongside your advance directive, healthcare power of attorney, and emergency wallet card. The authorised person should also keep a copy. If you carry an emergency wallet card, consider noting on the card that a HIPAA release is on file and where to find it.