Dental records release form: Free template and HIPAA rules

Key Takeaways

A dental records release form is a HIPAA-compliant authorization that lets a patient control who can access their protected health information.

A valid HIPAA authorization needs six core elements: a specific description of the records, who’s disclosing them, who’s receiving them, the purpose, an expiration date or event, and the patient’s signature.

HIPAA also requires every authorization to spell out the patient’s right to revoke it in writing, and that clause is mandatory, not optional.

Retention periods and response deadlines vary by state, so confirm your state dental board’s current rules before you set a policy.

Practice management software like Pabau can capture a signed authorization digitally, store it with the patient record, and track a request from submission through to release.

A patient calls asking for their x-rays and treatment notes to take to a new dentist, and whoever picks up the phone has to know, on the spot, what’s actually required before anything goes out the door.

A dental records release form is what makes that transfer official: a signed authorization stating which records can go where, and why, so the practice stays inside HIPAA and the patient stays in control of their own information. Get the form right and the request is a five-minute task.

Get it wrong, by sending records without a valid signature or missing your state’s deadline, and it turns into a compliance problem. Here’s what actually has to be on the form, how a request should move through your practice, and what the rules look like state by state.

What a dental records release form actually does

A dental records release form is a signed authorization that gives patients control over their own information and lets a practice legally disclose records to a third party. It confirms the patient understands what’s being shared, with whom, and why.

While the practice owns the physical dental records, patients have a legal right to access and obtain copies under HIPAA, the Health Insurance Portability and Accountability Act. That right is one of the core pillars of the HIPAA Privacy Rule: it lets patients manage their own care as they move between providers.

What HIPAA requires in every authorization

The U.S. Department of Health and Human Services, or HHS, sets out six required elements for a valid authorization under its Office for Civil Rights guidance (45 CFR §164.508(c)(1)):

• A specific description of the information: Exactly which records are being disclosed (for example, “x-rays and treatment notes from January 2020 to present”), not just a vague “all records.”
• Who’s authorized to disclose it: The name of the current dental practice releasing the records.
• Who can receive it: The practice, specialist, insurer, or other recipient named to receive the disclosure.
• The purpose of the disclosure: Why the records are needed, such as “continuing care” or “insurance claim review.”
• An expiration date or event: When the authorization ends, either a date or an event like “upon completion of treatment.”
• Signature and date: The patient’s signature (or a personal representative’s, with their authority described), dated.

HIPAA also mandates three additional statements on the same form, and none of them are optional. It must state the patient’s right to revoke the authorization in writing, note whether treatment, payment, enrollment, or benefit eligibility can be conditioned on signing, and warn that information could be redisclosed once it leaves HIPAA’s protection.

The revocation clause in particular is a requirement, not an add-on some templates skip.

What a dental records release form actually has to include

The free template above covers what most everyday transfer requests need: full patient information (name, date of birth, phone, email, and address), your current practice’s details, the new practice’s details, a plain-language consent statement, a release date line, and signature blocks for the patient, or a parent or guardian, plus a witness or provider.

A fully HIPAA-compliant authorization goes a bit further than that. If your own form is missing any of these, it’s worth adding them:

• Purpose-of-disclosure field: A line spelling out why the records are being shared.
• Expiration date or event: So the authorization doesn’t stay valid indefinitely.
• Record-type checkboxes: X-rays, treatment notes, radiographs, or “all records,” so nothing gets missed or over-shared.
• Copying-fee acknowledgment: A line letting patients know a reasonable fee may apply, before they ask.
• Written revocation clause: This one isn’t optional under HIPAA, so don’t leave it off even on a simple form.

Add those five fields and you’ve got a form that satisfies HIPAA’s core elements and required statements in full, not just the basics.

What’s included in a dental records release

A patient can request any record that’s part of their official dental chart. That includes:

• Radiographs (x-rays): Bitewings, panoramic, periapical, and CBCT scans, if they exist in the file.
• Treatment notes: Clinical documentation of past treatments, procedures, diagnoses, and outcomes.
• Periodontal charting: Pocket depth measurements, bleeding indicators, and gum health assessments.
• Extraoral and intraoral photographs: Before-and-after images of cosmetic work or clinical conditions.
• Lab invoices and material records: Documentation of crowns, bridges, implants, or other lab work.
• Consent and treatment plans: Signed treatment authorizations and planning documents.
• Billing and insurance records: Statements of services rendered and correspondence with insurers.
• Prescription records: Documented prescriptions tied to dental care.

Practices typically send copies rather than originals of radiographs and other materials. State law may specify when originals must be released, so check your state dental board’s rules if that comes up.

Filling out a dental records release form as a patient

From the patient’s side, this takes only a few minutes once you know what’s being asked for.

1. Get the form. Ask your current practice for it. Many now offer a version through a secure patient portal instead of paper.
2. Fill in your full name and date of birth. These need to match your records exactly, or processing slows down.
3. Specify which records you need. Check boxes for x-rays, treatment notes, or “all records.” Be specific if you only need certain procedures.
4. Enter the recipient’s name and address. If you’re transferring to a new dentist, include their practice name, address, and fax or email.
5. State the purpose. Write “for continued dental care” or your actual reason. If the form doesn’t already have a field for this, add a line.
6. Set an expiration date. Six to twelve months is typical, enough time for your new practice to receive and file everything. Add this field yourself if it’s missing.
7. Sign and date. Use pen if you’re printing, or an electronic signature if the form allows it. Your signature needs to match the name on file.
8. Submit and confirm. Mail, fax, or upload the signed form to your current practice, and confirm they’ve received it. If your new provider offers virtual visits, ask whether records need to arrive before a scheduled telemedicine visit so nothing holds things up.

How a records request moves through your practice

From the practice side, a records request is a compliance task with a paper trail attached. Front desk staff usually take the request first, a records custodian or office manager verifies the patient’s identity and checks the authorization is complete, and whoever pulls the chart handles preparation and transmission. Every step gets logged.

None of this is unique to dentistry. Any patient-facing practice, from a solo dental office to a multi-provider setup like a GP clinic, runs into the same identity-verification and deadline pressure once a request lands.

1. Receive the signed authorization. Check that all six HIPAA elements are present. If something’s missing, contact the patient to correct it before doing anything else.
2. Verify patient identity. Confirm the name and date of birth match your patient database, so records go to the correct person.
3. Locate and prepare records. Pull the full chart, including x-rays and notes. Make copies for transmission and keep originals in the file.
4. Organize for transmission. Prepare records for fax, email, or secure electronic transfer if sending to another practice, or seal them in a labeled envelope for pickup.
5. Calculate and collect any fee. HIPAA allows a reasonable cost-based fee for copying, typically $1 to $3 per page depending on the state. Send a cost sheet or invoice.
6. Transmit or release the records. Use the patient’s preferred method, and get a signed receipt if you’re handing them over in person.
7. Document and retain proof. Keep a record of the authorization, the release date, how records were sent, and to whom. This is what you’d show an auditor.

Before you release: A quick checklist

• Authorization is signed, dated, and complete, with no missing HIPAA elements.
• Patient identity is confirmed against your records.
• Recipient name and details are correct, especially if records are going to another practice.
• Any fee has been disclosed to the patient in writing before you send anything.
• The response deadline for your state is noted somewhere staff will actually see it.

Common mistakes that create compliance risk

• Releasing records without a valid authorization, including acting on a verbal request alone.
• Skipping the purpose or expiration, which leaves an authorization open-ended when it shouldn’t be.
• Sending records to the wrong recipient because the form’s recipient details weren’t double-checked.
• Missing the state deadline because nobody was tracking it against the date the request came in.
• Overcharging for copies beyond what state law or HIPAA’s reasonable-cost standard allows.

What you can charge for copying dental records

HIPAA lets practices charge a reasonable, cost-based fee for copying and preparing records. It’s reimbursement for materials and labor, not a charge for the service of releasing them.

The HHS Office for Civil Rights defines “reasonable” as the practice’s actual cost: copying, printing, scanning, disk or media costs, labor to prepare the records, and postage or transmission fees where they apply.

Say a patient asks for a complete chart, including bitewings and a panoramic x-ray, three years after their last visit. At $1 to $3 per page for a 40-page chart, plus a flat scanning fee, that’s usually a $40 to $75 invoice in most states, not $200.

State law varies significantly, though: some states mandate free copying, others set specific caps, and a few allow practices to charge more. Confirm your state dental board’s fee guidance before you set a policy.

Practices must tell patients in writing about any fee before releasing records, and can’t deny access just because a patient objects to an unreasonable amount. If a fee is ever disputed, audit documentation from a compliance management system, and the HHS Office for Civil Rights guidance behind it, will back you up.

Special cases: Minors, deceased patients, and closed practices

What if the patient is a minor? A parent or legal guardian signs and dates the form on the minor’s behalf, and should provide proof of guardianship if asked. State law sometimes grants minors independent rights to certain sensitive records, so check for exceptions around mental health or reproductive care documentation.

What if the patient has died? Records can go to the executor of the estate, a court-appointed representative, or next-of-kin if state law allows it. Whoever’s requesting needs legal documentation of their authority, such as a death certificate, probate letter, or court order. Rules vary widely here, so check with your state dental board.

What if the practice has closed? Records get handled according to state law. Many states require the dentist to notify patients and offer to release records, and some require transfer to the state board or a designated custodian.

Contact your state dental board if you need records from a closed practice. They can usually point you to the successor practice or the board itself.

How long you have to keep and release records, by state

Federal HIPAA sets the floor for records release, but state dental boards layer their own retention periods and response timelines on top. No two states are identical.

These figures are examples; your state’s exact requirements may differ. The American Dental Association (ADA) offers general guidance on releasing dental records, but for state-specific rules, confirm directly with your state dental board or a healthcare attorney before you set a policy.

Where practice management software like Pabau fits in

Manual records-release workflows tend to break down in predictable ways: paper forms that go missing, spreadsheet trackers nobody updates, and deadlines that slip because no one flagged them. Workflow automation in Pabau turns a request into a tracked process instead.

A patient submits it through your client portal, which logs the request, tracks its status, and reminds staff of the response deadline. Every release gets a timestamp, a record of who approved it, and how it was sent.

The authorization itself can be signed electronically through Pabau’s digital forms, so patients aren’t printing, scanning, and emailing a PDF back and forth. Once it’s signed, it sits against the patient’s record, and staff can pull and transmit the file without leaving the system.

Conclusion

A dental records release form is easy to overlook until a request actually lands on your desk, and then it becomes a deadline. Get the basics right, a complete authorization, a verified identity, a documented release, and most requests take minutes to process, not days.

Layer in your state’s specific retention and response rules, and you’ve got a process that holds up under any audit.

Practice management software like Pabau brings the signed authorization, the patient’s record, and the release log into one system, so a request can be tracked from the moment it arrives to the moment it’s closed. If that’s the kind of setup your front desk needs, book a demo.

Continue your research

Need help with the business side of running a dental practice? Our dental business plan template covers the operational and financial planning a records-release form doesn’t touch.

Sending a patient out for bloodwork instead of a records transfer? Use our lab request form template for that separate document.

Want broader guidance for running your practice? Pabau’s industry pages cover compliance and operational considerations across specialties.

Frequently asked questions about dental records release