Release of information
An illustrative outline of the elements a HIPAA-aware authorization to release protected health information commonly includes. Not a substitute for a form reviewed for your jurisdiction.
Extra caution: Authorizations for substance use disorder records and certain other sensitive records carry additional federal and state requirements. Confirm which rules apply before you rely on any single form.
Current as of July 7, 2026. Laws, payer rules, and billing codes change, so confirm the current requirements for your jurisdiction and setting before you rely on it.
What's inside
Who is authorizing
- Patient name, date of birth
- Signature and date, or authorized representative and relationship
Who may disclose and who may receive
- Disclosing party (your practice)
- Receiving party name and contact
What may be shared
- Specific records or categories to release
- Special protections a patient may want to address separately, such as substance use treatment records (often covered by 42 CFR Part 2), HIV status, and psychotherapy notes
Purpose and scope
The purpose of the disclosure, stated plainly, and any limits the patient wants to place on it.
Expiration, revocation, and rights
- An expiration date or event
- A statement that the patient may revoke in writing, and how
- A note that treatment cannot be conditioned on signing, with narrow exceptions
- A note that information disclosed may be re-disclosed by the recipient and may no longer be protected
About this resource
This template is part of the shrinkiatry resource library, a set of free, clinician-facing references and examples. It's reviewed by Shariq Refai, MD, MBA, FAPA, a board-certified psychiatrist, on a quarterly schedule. Next scheduled review: October 1, 2026. First published July 7, 2026, last reviewed July 7, 2026.
Browse the rest of the resource library, or verify who reviews this site. Spotted something out of date? Email corrections@shrinkiatry.com.