Medical record request form

Key takeaways

A medical record request form is a HIPAA authorization that lets a patient reach their own records or send them to a third party.

HIPAA requires eight elements under 45 CFR 164.508, including a statement that the recipient may redisclose the records.

Providers must respond within 30 days, may take one 30-day extension, and can charge only reasonable, cost-based copying fees.

State law wins where it is stricter, so California expects copies within 15 days rather than 30.

Pabau’s form builder and patient portal let practices collect, track, and fulfill record requests without paper.

A medical record request form is the document a patient signs to have their health records released, either to themselves or to someone else. HIPAA decides what has to appear on it. Miss one required element and the authorization is invalid, so the records stay where they are.

This page covers the eight elements HIPAA requires and how to complete the form. It also covers the response deadlines, the fees you may charge, and where state law tightens both. The template above is free to download.

What is a medical record request form?

A medical record request form is a standardized legal document with two jobs. It lets patients ask for their own medical records. It also lets them authorize a provider to release those records to a third party, such as an insurer, an attorney, or a new provider.

Under HIPAA (Health Insurance Portability and Accountability Act), patients hold a right of access to their health information. The provider then has 30 days to answer the request.

The form does two jobs at once. It documents the patient’s consent for disclosure, which protects the provider. It also holds the release to the records the patient named, and no others.

Without a signed authorization, a provider cannot disclose protected health information (PHI) except in narrow circumstances such as an emergency or a law enforcement request.

Some practices keep the request form separate from the authorization for release of information form. The first is a patient asking for their own copy. The second sends records to someone else. A single combined form covers both cases, which is what most practices use.

What HIPAA requires the form to include

Under 45 CFR 164.508, a valid HIPAA authorization must include eight mandatory elements. Omit one and the authorization is invalid, which leaves the provider unable to release the records.

• Patient identification and signature: Full name, date of birth, and a dated signature, or the signature of an authorized representative.
• Description of PHI: The record types being released, such as “all records,” “mental health records only,” or “records from January 2024 to present.”
• Recipient identification: Name and address of the organization or individual receiving the records.
• Purpose of disclosure: Why the records are being released, such as continuity of care, legal representation, or an insurance claim.
• Expiration date: When the authorization runs out, such as 90 days, one year, or “upon receipt of records.”
• Right to revoke: A clear statement that the patient can revoke the authorization in writing at any time.
• No condition on treatment: A statement that treatment, payment, or enrollment does not depend on whether the patient signs.
• Potential for redisclosure: A statement that the recipient may redisclose the records, and that HIPAA may no longer protect them once released.

Five of the eight are details you collect from the patient. The other three are statements the form itself has to print, and they are the ones most often missing.

Beyond the required elements, four additions save the front desk a follow-up call:

• A phone number and named contact for the requesting organization.
• The date the requester needs the records by.
• Fee information, so an invoice does not surprise the patient.
• A space to note any records withheld, and the reason.

A compliant authorization form is one control among many. Our guide to HIPAA compliance for medical offices covers the policies, training, and audits that sit around it.

Types of forms and when each applies

Not every request follows the same rules. The record type and the state both change which form you need, and what extra consent it has to carry.

Standard patient release form

This is the common case. A patient wants records sent to a new provider, an insurer, or an attorney. The standard form carries all eight HIPAA elements and covers general medical, surgical, and diagnostic records. Most disclosure requests need nothing more than this version.

Mental health and substance use records

Mental health records carry stricter confidentiality rules, and substance use disorder treatment records fall under 42 CFR Part 2. That federal rule is tighter than HIPAA in places, so these records need their own authorization form. The form has to name the mental health or substance use records being released. Several states add requirements on top, such as a signature witnessed by a staff member.

Requests to amend a record

Under HIPAA’s right of amendment (45 CFR 164.526), a patient can ask for a correction to their record. This takes a different form. The patient is not authorizing disclosure. They are asking the provider to change or add information, and the provider has 60 days to respond. The answer is either the amendment itself or a written denial with a reason.

How to fill out the form, step by step

For patients, the process is short. For staff handling incoming requests, checking each form for completeness is what prevents a second round of correspondence.

1. Print or open the form digitally. If the provider offers a patient portal, the form is often there for online completion.
2. Complete the patient identification section. Enter full name, date of birth, current address, phone number, and email.
3. Specify the records needed. Give the date range and the record type, such as office visit notes from January to March 2024, or imaging reports only. Vague requests delay processing.
4. Name the recipient. Give the full name and address of the person or organization receiving the records. For example: Dr. Sarah Chen, New Primary Care, 123 Health Ave, Portland, OR 97201.
5. State the purpose. Common purposes are continuity of care, an insurance claim, a disability evaluation, or legal representation. The purpose tells the provider which restricted records need extra handling, such as psychotherapy notes.
6. Set an expiration date. “Until receipt of records” is the simple option, or give a date such as 90 days from the request.
7. Sign and date the form. The signature can be in ink, or electronic where the form supports e-signatures. For a minor or an incapacitated adult, a legal guardian or healthcare power of attorney signs instead.
8. Submit the form. Mail, fax, or send it electronically through the patient portal, per the provider’s instructions.

Collecting these requests through a patient portal removes the paper handling and date-stamps every step for the audit trail.

How to submit a request and what to expect

Once a completed form arrives, HIPAA sets both the clock and the rules for the provider’s response.

• Submission methods: Mail, fax, in-person delivery, or electronic submission through a secure patient portal.
• Response deadline: The provider must respond within 30 days of receiving the request. Where that is not feasible, they may take one 30-day extension and must tell the patient in writing.
• Fees: A provider may charge a reasonable, cost-based copying fee, typically $0.50 to $1.00 per page. Search and retrieval fees are not allowed. Some states cap electronic access fees at the cost of production.
• Format options: Where a patient asks for records electronically, the provider must comply if feasible, or explain why not.
• Withheld records: A provider may withhold records where disclosure would endanger the patient, or where a third party has not consented. The patient must be told in writing, with the reason.

Handling requests inside a medical records management system keeps the request date, the deadline, and the fulfillment status on one screen.

State rules that override the federal baseline

HIPAA is the floor, not the ceiling. Where a state law gives the patient more, the state law applies. The usual differences are shorter deadlines, lower fee caps, and extra consent for mental health records.

Check your state medical board or health department for the current rules, since many states publish their own official form. State law also sets medical record retention periods, which decide how far back a request can reach.

How Pabau streamlines record requests for practices

Paper forms leave the tracking to staff. Someone has to log the request, check it is complete, diary the deadline, and chase the records. Compliance management software like Pabau does that work in the background.

Patients submit through the secure patient portal, so requests never sit in a pile at reception. Our form builder lets you add state-specific fields, your practice’s logo, and submission instructions.

Each submission joins a tracked queue with deadline alerts, so the 30-day clock stays visible to the whole team. Staff attach the released records to the patient record, which leaves a dated audit trail.

Every view of a record is logged, which supports the audit controls the HIPAA Security Rule requires. Records go out by secure portal download rather than open email.

Track every records request to its deadline

Pabau’s digital forms and patient portal collect record requests, log every access, and flag the 30-day deadline before it passes. Your team works from one audit trail instead of a paper file.

Book a demo

Conclusion

The form itself is the cheap part. The costs come later. An invalid authorization, a missed deadline, or a fee your state never allowed all land on the practice.

So download the template, check it against the eight elements, and add whatever your state asks for on top. Then decide who owns the clock once a request arrives, because that is the part a form cannot do for you.

Book a demo to see how Pabau tracks record requests, deadlines, and access logs in one place.

Continue your research

Need the general release version? HIPAA medical release form gives you a one-page authorization for disclosure to a third party.

Sending records to another provider? Authorization for release of protected health information covers the wording a receiving practice expects.

Still drafting the privacy notice patients sign for? Notice of privacy practices sets out what you have to tell patients about their data.

Unsure how long to keep the file? How long to keep medical records explains the federal and state retention periods.

Frequently asked questions