A records clerk receives a signed page that says, “Send all PHI to my lawyer.” The signature is present. The authority is not yet clear.
A medical records release form is useful only when staff can answer five questions without guessing: whose records, which records, released by whom, sent to whom, and for how long. Treat the form as a routing instruction backed by an authorization, not as a decorative signature page.
Route the request before choosing a form
Start by naming the route. They are not interchangeable.
| Request | Working route | First owner |
|---|---|---|
| Patient asks the practice for a copy | HIPAA right of access workflow | Release-of-information staff |
| Patient asks the practice to send records to a named third party | Authorization review | Privacy or records staff |
| Another provider asks for records for treatment | Approved disclosure workflow | Records staff under practice policy |
| Lawyer, insurer, employer, school, or family member asks | Authority-specific review | Privacy or legal lane |
| Court order, subpoena, law-enforcement request, or oversight request arrives | Legal process | Privacy counsel or approved legal owner |
HHS OCR’s access guidance describes an individual’s right to inspect or obtain a copy of protected health information in a designated record set, subject to the rule’s scope and exceptions. Do not make that patient-access route depend on a broad third-party authorization form when a different process applies.
Build the authorization field by field
45 CFR 164.508 supplies the federal authorization framework. Translate it into a controlled field map, then have privacy counsel review the final wording and any state overlays.
MEDICAL RECORDS RELEASE AUTHORIZATION: FIELD MAP
Patient name: __________________________________________
Date of birth or approved identifier: ___________________
Person or organisation authorised to disclose:
Name: __________________________ Contact: _______________
Person or organisation authorised to receive:
Name: __________________________ Contact: _______________
Information described in a specific and meaningful way:
Record types: ___________________________________________
Date range or encounter: _________________________________
Excluded items, if any: __________________________________
Purpose of the disclosure: _______________________________
Expiration date or expiration event: _____________________
Delivery route requested: ________________________________
Identity and destination verified by: _____________________
Required authorization statements reviewed: _____________
Individual or authorised representative signature: _______
Date: ____________________________________________________
If signed by a representative:
Name: __________________ Relationship and authority: _____
Authority evidence checked by: ___________________________The field map is not finished legal language. It is a completeness control for the approved form.
Describe the records without making staff infer intent
HHS says an authorization can describe an “entire medical record” or “complete patient file” when that wording is specific and meaningful and the authorization is otherwise valid. The same HHS answer warns that “all protected health information” may be too broad without more definition.
Give the signer practical choices. A date range, encounter, clinician, facility, and record category make fulfillment easier to test. Include an “entire medical record” option only in counsel-approved wording. Do not hide specially protected categories inside a generic checkbox.
Psychotherapy notes have their own authorization rule under 45 CFR 164.508. Substance-use-disorder records, reproductive-health information, minors’ records, genetic information, and other categories may trigger separate federal or state requirements. A universal internet template cannot settle those questions. The approved workflow needs a stop-and-review lane.
Treat destination verification as part of the release
A perfectly drafted authorization can still fail at the last mile. One transposed fax digit sends the right records to the wrong place.
Record the destination from a trusted source. Confirm the recipient name and route using the practice’s approved method. Keep the verified destination separate from free-text notes. If the patient changes the destination, capture a new instruction rather than editing history without a trace.
For electronic delivery, define how staff verify an address, protect the file, send any password or access code, and record successful delivery. For paper, define pickup identity checks, mailing steps, and returned-mail handling. The form starts the work; the disclosure log closes it.
Keep expiration and revocation operational
An expiration field cannot live only on paper. Store the date or event in a form that staff can act on. A request received after expiration goes back to review.
The authorization must contain the required statement about the individual’s right to revoke and the exceptions described by the rule. The practice also needs a route to receive a revocation, timestamp it, stop work that has not already occurred, and preserve what was disclosed before the revocation took effect.
Use three statuses:
- Received. The instruction exists, but authority and scope are not yet cleared.
- Approved for fulfillment. Required fields, identity, authority, scope, and destination passed review.
- Released or closed. The disclosure log records what left, when, by which route, and who completed the work.
A signature should never jump a request from received to released.
Test the workflow with five synthetic requests
Run the approved form and process without real patient data.
| Test | Expected control |
|---|---|
| Patient requests one encounter for personal use | Correct access route, no unnecessary third-party authorization |
| Patient directs a complete file to a new physician | Meaningful scope, verified recipient, fulfillment log |
| Parent signs for a minor | Representative authority review and state-specific check |
| Request includes psychotherapy notes | Separate stop-and-review path |
| Patient revokes before staff send the file | Timestamped stop, preserved audit history |
Add a sixth test for the actual software: paste an incorrect fax number and then correct it. The history should show both values and the approval event. Silent replacement defeats the point of a controlled release.
Product boundary
Patient Square is an AI clinical platform. Its documentation and record features operate within the configured practice workflow. It does not decide whether an authorization is valid, resolve representative authority, interpret a subpoena, or approve a state-specific form.
Review Patient Square’s current security posture before mapping any record workflow. Keep legal authority with the practice’s privacy owner and counsel. Keep clinical content with the clinician. Keep a release log that can reconstruct what actually happened.