HIPAA release form Texas: Free template and compliance guide

Key takeaways

The template on this page is a blanket representative-access release, authorizing any and all of a patient’s health information to two named representatives.

Its only blanks are the patient’s name, their address, two representative blocks with name, address and phone, and a signature.

The form carries no description, purpose or expiration field. Clause 9 fixes its term at two years after the patient’s death, or their written revocation.

A fully customizable HIPAA authorization needs those extra elements added, including a specific description of the records, a purpose, and an expiration date or event.

Practice management software like Pabau turns either form into a digital, audit-tracked authorization your Texas practice can retrieve in seconds.

A patient’s daughter calls to ask how her mother’s biopsy went. Without a signed authorization on file, your front desk cannot tell her a thing.

The form on this page answers that call in advance. It is a blanket HIPAA authorization, so one signature lets two named people ask any provider for any of the patient’s health information.

This form works differently from the itemized authorization most guides describe. There is no field for a description of records, no purpose line, and no expiration date, because the form’s own clauses settle all three. Texas law then layers its own duties on top of the federal rules.

What a HIPAA release form does in Texas

A HIPAA release form is a written authorization signed by the patient. It lets a covered entity disclose their protected health information, known as PHI, to someone they name. Federal rules at 45 CFR 164.508 set out what it has to say.

Texas then adds a second layer. The Texas Medical Records Privacy Act, passed as HB 300, defines a covered entity far more broadly than HIPAA does. It reaches any person who assembles, collects, uses, stores, or transmits PHI in the state.

Employers, schools, gyms, and wellness programs can all fall under it. Skip the authorization and you face two enforcement paths instead of one. The federal Office for Civil Rights can act, and so can the Texas attorney general under Chapter 181.

This template releases everything, to two named people

This template is a standing access release. Once signed, it directs every covered entity holding the patient’s records to hand over any health information either named representative asks for.

The form also defines its own terms. Clause 1.1 reads “covered entity” broadly, from physicians and dentists through pharmacies, laboratories, nursing homes, and insurers. Health information under clause 1.2 covers history, condition, diagnosis, testing, prognosis, treatment, and billing.

Clause 3 then reaches beyond records. It also lets a representative discuss the patient’s health information with your staff and ask questions about it. That holds whether or not the patient is incapacitated.

Where the fixed scope stops working

Because the scope is fixed, this form cannot carry a narrower disclosure. Two everyday requests show where the line falls.

• A daughter calls about her father’s test results. If the form already names her, your staff can talk her through them the same day.
• An attorney wants one year of imaging only. That needs a customizable authorization naming the records, the recipient, and an end date.

Two mechanical quirks to know before you print

The file has no interactive form fields. So print it and complete it by hand, or add text with a PDF annotation tool.

There is also no date line on either page, not even beside the signature. Log the day it reached you in your records management system, so you can show when the authorization took effect.

Where Texas law goes further than federal HIPAA

HIPAA sets the national floor. HB 300 raises it for anyone who handles health information in Texas.

That first row has a practical edge to it. A Texas employer or school holding employee health records answers to HB 300, even though HIPAA never reached it. Your authorization has to satisfy both layers.

The notice of privacy practices you already publish covers the federal duty to inform patients. Texas wants a second notice as well, posted where patients will see it, saying PHI may be disclosed electronically.

Practices holding records in more than one state need a release that satisfies each of them. Our Illinois release form and Florida release form cover those two states.

Nine elements make a customizable authorization valid

A customizable authorization has to carry every element in 45 CFR 164.508(c). Miss one and the authorization is invalid, which puts every disclosure you made on it at risk.

• Patient identification: full legal name, date of birth, and record number where you hold one.
• Specific description of the information: which records the authorization covers, named by type, date range, or treatment episode.
• Who discloses and who receives: name the covered entity releasing the records and the person or organization receiving them. A generic “any healthcare provider” will not do.
• Purpose of the disclosure: say why the records are moving. “At the request of the individual” is enough when the patient asks for the disclosure themselves.
• Expiration date or event: a date such as December 31, 2027, or an event such as the end of the current treatment episode.
• Signature and date: the patient or their representative signs and dates the form. A representative also states the authority they are signing under.
• Right to revoke: a statement of the right to revoke in writing, how to do it, and the exceptions, under 45 CFR 164.508(c)(2)(i).
• Conditioning statement: whether treatment, payment, enrollment, or eligibility for benefits depends on signing, under 45 CFR 164.508(c)(2)(ii).
• Re-disclosure statement: a warning that the recipient may re-disclose the information, which then loses HIPAA protection, under 45 CFR 164.508(c)(2)(iii).

Practices working from a HIPAA compliance framework can build these elements straight into a digital form, so a required field cannot be left blank.

Texas adds five duties on top of HIPAA

Federal compliance is not the finish line in Texas. Five HB 300 obligations sit on top of that baseline.

• Broader entity coverage: any Texas business that maintains health information complies with HB 300, not only healthcare providers. That includes employers, schools, gyms, and wellness programs.
• Authorization for each electronic disclosure: §181.154 requires a separate authorization every time PHI is disclosed electronically.
• Exceptions to that rule: §181.154(c) drops the requirement for disclosures to another covered entity. That covers treatment, payment, health care operations, and insurance functions, plus anything other law requires.
• Posted electronic-disclosure notice: tell patients their PHI may be disclosed electronically. Post it in your practice, on your website, or anywhere else they will see it.
• Consent for HIV test results: Health and Safety Code Chapter 81 treats these results as confidential. A sexual health practice releasing them needs specific authorization rather than a general one.

HB 300 also sets a training deadline. Train anyone who handles PHI by their 90th day of employment, on material matched to their duties. Keep their signed verification for six years.

Two commonly quoted restrictions are federal rather than Texan. Psychotherapy notes need their own separate authorization under 45 CFR 164.508(a)(2). Federally protected substance use disorder records need one under 42 CFR Part 2.

Both rules apply in every state, so treat them as national requirements you meet in Texas. A mental health practice will keep a second authorization on file for notes alone.

Compliance management tools help here, because they flag the record categories that need separate consent before anything leaves the practice.

How to complete the form in six steps

Six steps cover the whole form. There is no purpose step and no expiration step, because neither field exists on the page.

1. Enter the patient’s identity: print the patient’s full legal name on the “My name is” line and their residential address on “I reside at”. Verify identity with photo ID before they sign. The form has no field for date of birth or record number, so note both in your own system.
2. Walk the patient through clauses 1 to 3: these define covered entity and health information, and they authorize any and all disclosures a representative requests. Confirm the patient understands that nothing on the page narrows that scope.
3. Name the first designated representative: complete the name, address, and phone in the Representative 1 block. This is the person who will be able to request and discuss the records.
4. Name a second representative, or leave the block empty: clause 5 gives both representatives co-equal authority and does not require them to act together. A patient who wants only one point of contact leaves the second block blank.
5. Take the signature: the patient signs on the signature line at the end of page two. Electronic signatures are acceptable, and there is no date line, so timestamp your receipt in the patient record.
6. File it and give the patient a copy: clause 10 makes a copy or fax as good as the original. Point out clause 9 while you are there, so the patient knows a written revocation has to reach you to take effect.

If the patient wants a narrower release, stop and switch documents. Build a customizable authorization with the nine elements above, and keep the blanket form for family and representative access.

Tracking the medical forms and documentation side of this by hand gets slow. Digital forms pre-fill the patient’s details and capture the signature before they arrive.

How long the release lasts, and how a patient revokes it

This template ends at the first of two events. Those are two years after the patient’s death, or the day your practice receives their written revocation. Clause 9 sets both, and nobody selects a shorter term.

Right to revoke. A patient may revoke any HIPAA authorization in writing at any time, under 45 CFR 164.508(b)(5). Clause 9 asks for proof that the revocation was received, by certified mail, registered mail, fax, or any other receipt showing it arrived.

What revocation does not undo. It takes effect when you receive it, except where the practice has already acted in reliance on the authorization. Information already sent to a representative cannot be pulled back, and clause 6 warns the patient that the recipient may re-disclose it.

Later incapacity changes nothing. Clause 9 states that the authorization survives the patient’s subsequent disability or incapacity. That is the point of this form, and it is why families use it.

A customizable authorization behaves differently. There, the expiration date or event you wrote on the form controls the end date, and any disclosure after it needs a fresh authorization.

Either way, keep the signed page long after it stops working. Federal rules ask for six years, and the medical record retention clock in Texas runs longer still.

Who can sign a HIPAA release form in Texas?

The patient signs, unless someone else holds legal authority to sign for them. Verify that authority before you accept the form.

• An adult patient with capacity: any competent adult signs their own authorization. Competent means they understand the form, the scope of what they are releasing, and the consequences of signing.
• A parent or legal guardian: for a patient under 18, a parent or court-appointed guardian signs, subject to the exceptions below.
• A minor who consented to the care: Texas Family Code §32.003 lets a minor consent to their own treatment. It covers reportable infections, sexually transmitted infections, and drug or chemical dependency, with no minimum age. Where the minor consented, the minor controls disclosure of those records.
• A minor aged 16 or over, for mental health: Health and Safety Code §572.001 lets them request mental health services in their own name. The 16-year threshold belongs to this rule alone, not to substance use or sexual health care.
• A healthcare agent: where a medical power of attorney is on file, the named agent signs for a patient who lacks capacity.
• A personal representative of a deceased patient: this is the executor, administrator, or another person with legal authority over the estate. See 45 CFR 164.502(g)(4), and ask for documentation.

Contraception is not on the minor self-consent list. Texas requires parental consent for a minor’s contraceptive care, which the Fifth Circuit confirmed in Deanda v. Becerra in 2024.

This template adds one more route after a death. Clause 9 runs for two years, so representatives named on a signed form keep their access during that window. That often resolves a records request without an estate document.

How Pabau keeps Texas authorizations digital and audit-ready

Paper authorizations fail in two familiar ways. Staff leave fields blank on a form nobody checks. Then the signed page goes missing on the day a request or a chart audit lands.

Practice management software like Pabau moves the whole workflow onto the patient record. You build your authorization as a digital intake form, send it before the appointment, and mark the fields that have to be completed.

The patient then signs electronically, and the signed version files itself against their record with a timestamp. Paper works the same way. Scan the signed form, attach it to the record, and the representative names sit alongside the rest of the chart.

Access control matters just as much as storage. Pabau’s security settings let you force two-factor authentication and set password rules, which supports the patient data security side of HB 300. For a multi-site Texas practice, every location then works from the same set of authorizations.

Capture HIPAA authorizations digitally and keep them audit-ready

Pabau's digital forms take the authorization, capture the patient's signature, and file it on the patient record with a timestamp. Your team stops chasing paper, and a Texas records request or HB 300 audit gets answered in seconds.

Book a demo

Conclusion

Match the document to the job before anyone signs. The template on this page gives two named people standing access to everything, for two years past the patient’s death. That is exactly right for family and representative access.

It is the wrong tool for a single disclosure to an attorney, an employer, or an insurer. Those need the nine federal elements, including the description, the purpose, and an expiration you choose. Keep both on hand and the choice takes seconds at the front desk.

Then keep the signed page somewhere you can find it, because Texas gives you two regulators to satisfy rather than one. Book a demo to see how Pabau captures these authorizations digitally and keeps them audit-ready for your practice.

Continue your research

Working outside Texas? HIPAA medical release form gives you the general version, with no state layer on top.

Treating patients under 18? Consent to treat minor form covers the permission you need before treatment starts.

Running a dental practice? Dental records release form handles chart requests without reworking this template.

Taking card payments at the desk? HIPAA-compliant payment processing shows how billing data stays protected in transit.

Opening a med spa? Do med spas have to be HIPAA compliant? sets out where the rules start to bite.

Frequently asked questions