A fax arrives at 4:42 p.m. It asks for “the complete chart,” names a law office, carries the patient’s signature, and gives no expiration date. Calling it a records request doesn’t tell the release clerk which legal path applies. The first job is routing.
Key takeaways
- Separate a patient’s access request from an authorization for another disclosure before checking fields.
- A usable authorization names the information, sender, recipient, purpose, expiration, and signer.
- Preserve the received date when something is missing. Don’t make the request disappear into a new queue.
- Close the job with delivery evidence and an exception log, not a green checkbox alone.
This template is an operating aid, not legal advice. Federal and state law, substance-use records, minors’ records, psychotherapy notes, subpoenas, and other special cases can change the route. Have privacy counsel or the practice’s privacy officer approve the local version.
Route before you validate the form
The U.S. Department of Health and Human Services treats a patient’s HIPAA right-of-access request differently from an authorization. HHS warns that requiring a person to execute a HIPAA authorization for an access request can create an impermissible obstacle. A covered entity may use an access form and take reasonable identity-verification steps, but neither may become an unreasonable barrier or delay (HHS right-of-access guidance).
An authorization has another job. It permits a use or disclosure that HIPAA does not otherwise permit. HHS describes it as a detailed document with specific core elements and required statements (HHS consent and authorization FAQ).
Use a three-lane intake decision:
| Lane | First question | Working record |
|---|---|---|
| Patient access | Is the patient requesting their own information or directing a copy? | Access request and fulfillment log |
| Authorization | Is the patient permitting another use or disclosure? | Valid authorization plus disclosure log |
| Other authority | Is the request based on a court order, legal mandate, public-health route, or another permission? | Escalation record tied to the controlling authority |
Don’t ask the front desk to make the hard legal call. Ask staff to capture facts, choose the apparent lane, and escalate exceptions to the privacy owner.
Copyable authorization intake sheet
The core elements below track the authorization requirements summarized by HHS and codified in 45 CFR 164.508. It is a validation sheet for an approved form, not a universal form for every jurisdiction.
MEDICAL RECORDS DISCLOSURE INTAKE
Received date and channel: ______________________________
Patient name and second identifier: _____________________
Description of information: _____________________________
Date range or encounter range: __________________________
Person or class permitted to disclose: __________________
Recipient or recipient class: ___________________________
Purpose of disclosure: __________________________________
Expiration date or event: _______________________________
Signature: _______________________ Date: _______________
Authority if signed by a representative: _______________
REQUIRED-STATEMENT CHECK
Right to revoke and how to revoke: present / absent
Treatment, payment, or benefit condition: present / absent
Redisclosure warning: present / absent
ROUTING
Access request / authorization / other / privacy review
Owner: ____________________ Target date: _________________
Missing item or exception: ______________________________The HHS authorization summary lists the information, discloser, recipient, purpose, expiration, signature, and date as core elements. It also identifies statements about revocation, conditioning, and possible redisclosure (HHS authorization guidance). The local form should present those statements clearly enough for a person to understand what they are signing.
Scope needs nouns and dates
“Send the chart” sounds plain until the chart contains ten years of visits, outside reports, imaging, billing records, and material governed by a separate rule. Ask what information, which dates, which recipient, and which purpose the requester intends.
HHS says an authorization that specifies the “entire medical record” can be specific enough, but “all protected health information” may not describe the information with enough specificity (HHS entire-record FAQ). That distinction is useful for form design. Offer understandable record categories without steering the patient away from a scope they are entitled to request.
When the scope is unclear, send one concrete question. For example: “Should this include billing records and outside records, or clinical records created by this practice only?” Record the answer next to the original request.
The exception log keeps work honest
A release queue fails quietly. One request waits for representative paperwork, one contains a mismatched date of birth, and another needs privacy review. A single status labeled “pending” conceals all three.
Use a log with explicit states:
| State | Evidence to retain | Next owner |
|---|---|---|
| Received | Original request, channel, timestamp | Intake staff |
| Identity or authority check | Method and result, without unnecessary document copies | Records team |
| Scope clarification | Question, response, and revised scope | Requester liaison |
| Privacy review | Exact exception and decision | Privacy officer or counsel |
| Production | Record set, exclusions, and quality check | Release specialist |
| Delivery | Recipient, method, timestamp, and confirmation | Release specialist |
| Closed | Completion or denial notice and reason | Queue owner |
Keep dates visible. Preserve the first received date even if the request needs clarification. If a deadline pauses or changes under an applicable rule, have the privacy owner record the basis rather than letting software infer it.
Test the route with four awkward requests
A blank form doesn’t prove the process works. Run these fictional requests through a training queue:
- A patient asks for a PDF copy of the last two visits and uses a nickname that differs from registration.
- A parent requests a teenager’s complete record, but the chart contains a service that may follow a different authority rule.
- A signed authorization names a lawyer and the whole record but has no expiration date or event.
- A patient directs the practice to send a copy to another clinician and staff mistakenly demand the practice’s authorization form.
For each one, record the lane, missing fact, person allowed to decide, response to the requester, and closure evidence. The test passes only if two trained staff members reach the same route from the written policy.
Where software helps, and where it doesn’t
A records system can keep one request, one owner, dates, tasks, and delivery evidence together. It can’t decide a contested authority question or invent a valid authorization field. Those decisions belong to the practice’s approved policy and privacy reviewer.
Patient Square is an AI clinical platform. Practice Copilot brings the whole practice under one AI copilot: an ambient AI Medical Scribe that hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft minutes after the visit, plus a bundled AI EHR, scheduling, and messaging as you move up the plan. Hospitals get Hospital Copilot.
If your release queue exposes a broader records problem, compare the medical chart audit checklist with the record-amendment routing guide. Then review Practice Copilot and the current security posture against your own acceptance test.
The best release form won’t rescue a hidden queue. Route the request, name the exception, prove the delivery, and close the loop.