HIPAA Medical Records Release Form
Free HIPAA release PDF — AI fills 45 CFR §164.508 with all 9 core elements + expiration, psychotherapy-notes 164.508(a)(2), 42 CFR Part 2 SUD, GINA Title II, TX HB300 + CA CMIA + NY OCA-960.…
Identify patient and recipient
Enter patient's full legal name, date of birth, address, and the source provider/facility releasing the records.…
Specify the records and purpose
Describe records to release ("entire medical record", "office visits Jan 1–Dec 31, 2025", "imaging only").…
Sign with expiration and revocation language
Patient signs and dates. Set expiration ("one year from signature", "upon completion of [purpose]", or specific date).…
Why choose iFillPDF
All 9 HIPAA core elements
Description of PHI, who may release, who may receive, purpose, expiration, signature & date, revocation right, redisclosure notice, and statement that treatment cannot be conditioned on signing — all per 45 CFR §164.508(c).
Sensitive-PHI handling
Separate explicit-checkbox lines for mental-health psychotherapy notes (45 CFR §164.508(a)(2) — must be its own form, no other PHI listed, since the 2013 Omnibus Rule), substance-use-disorder records (42 CFR Part 2 post-2024 HHS…
State-specific add-ons
Auto-includes state quirks: CA CMIA requires patient initials per record category, NY uses OCA Form 960 wording, TX HB300 adds reasonable-fee disclosure, FL §456.057 limits charges to actual cost.
Revocation form included
Page 2 is a separate revocation form the patient can fill out and send to the provider to terminate the authorization at any time — required disclosure under §164.508(b)(5)(i).
AI auto-fills your HIPAA Privacy Rule authorization (45 CFR §164.508) from a 30-second brief — "specific" vs "general" authorization toggle, all 9 required core elements per §164.508(c) (description of PHI, authorized discloser, recipient, purpose, expiration, signature + date, revocation right per §164.508(b)(5), redisclosure notice, anti-conditioning statement), psychotherapy-notes separate authorization per §164.508(a)(2), 42 CFR Part 2 substance-use-disorder override (now harmonized with HIPAA per HHS Final Rule 2024), FERPA 20 USC §1232g student-records crossover, GINA Title II genetic-info separate authorization, NY OCA-960 wording (top-9 SERP), TX HB300 reasonable-fee disclosure, CA CMIA Civ Code §56.10 patient-initial-per-category, FL §456.057 actual-cost cap, Mass DPH form. HHS-OCR 2025 enforcement: $137-68,928/violation tier (45 CFR §160.404), Anthem 2018 settled $16M, NewYork-Presbyterian $4.8M. HITECH 42 USC §17932 free electronic copy 1×/yr. ESIGN Act 15 USC §7001 + UETA-compliant signature. Hetzner Falkenstein EU TADPF hosting on US legal forms, SOC 2 Type II + ISO 27001:2022 + GDPR Art. 5. No Adobe Acrobat $19.99/mo, no LegalZoom $39, no Rocket Lawyer $39.99/mo.
Go further with lifetime access
E-signature proof log, business templates, no watermark. $8.99, one payment, for life — no subscription.
Frequently asked questions
Is a HIPAA release form required to share my medical records?+
Yes for any disclosure outside Treatment, Payment or Healthcare Operations (TPO) per 45 CFR §164.506. Your provider can share PHI between treating clinicians, with billing payers, and for QI/audit purposes WITHOUT authorization, but to release records to your employer, attorney, life-insurance carrier, family member, school, or another patient — you must sign a HIPAA-compliant authorization meeting all 9 core elements of §164.508(c). Penalties for unauthorized disclosure (HHS-OCR 2025 tiers 45 CFR §160.404): $137 to $68,928 per violation, max $2.067M/yr per identical violation; Anthem paid $16M in 2018, Premera Blue Cross $6.85M in 2020. Pricing comparison: HIPAA Journal (top-1 SERP) PDF $0 blank-only, eSign $9.99/mo (top-6 SERP), Drata enterprise compliance suite $7,500+/yr; iFillPDF generates the same §164.508-compliant authorization with all 9 core elements + state add-ons (NY OCA-960, TX HB300, CA CMIA) for $0.
How long is a HIPAA release valid?+
Whatever expiration you write in. Common choices: "one year from date of signature", "upon completion of the [purpose] for which it was signed", or a specific calendar date. The expiration is a required core element — no expiration = invalid form. Patients can revoke earlier in writing under §164.508(b)(5).
Can a provider charge me for copies of my records?+
Yes, but tightly capped. HIPAA Privacy Rule 45 CFR §164.524(c)(4) allows only "reasonable cost-based fees" — labor for copying, supplies, postage; CIOX Health v. Azar (D.D.C. 2020) struck down HHS's flat-fee $6.50 ceiling but providers cannot charge for record review or retrieval labor. State caps go further: CA H&S §123110 $0.25/page paper / $0.50/microfilm + $15 clerical, FL §456.057(17) $1/page first 25 then $0.25, TX HSC §241.154 + HB300 max $25 first 20 pages + $0.50/page after, NY 10 NYCRR §405.10 $0.75/page. Electronic records often capped lower (CA H&S §123110(b) $0.10/page-equivalent). You always have the right to a free electronic copy once per year under HITECH 42 USC §17935(e). Refused or overcharged? File HHS-OCR complaint at hhs.gov/hipaa/filing-a-complaint — OCR investigates within 180 days and has settled overcharge cases at $85,000+ (2019 Bayfront Health Right of Access).
Does a HIPAA release cover psychotherapy notes?+
No — psychotherapy notes require a separate, distinct authorization under 45 CFR §164.508(a)(2). A general medical release does NOT cover them. If you want them released, sign a second HIPAA form that specifically names "psychotherapy notes" and lists no other PHI categories.
Can I release medical records of a deceased family member?+
Only if you are the personal representative of the estate (executor, administrator) or held a HIPAA authorization signed before death that has not expired. PHI of a deceased person is protected for 50 years after death under §164.502(f). Provide a copy of letters testamentary or court appointment to the provider when requesting records.
More PDF tools
Keep going with a related tool — all free, no signup.