A request for records arrives on a Tuesday afternoon. An attorney wants a file, an insurer wants session notes, and a parent wants access to an adolescent's chart. The clinician needs to identify the authority for disclosure before anything leaves the practice.
Start with the legal trigger, not the template. A patient's permission to share a discharge summary isn't permission to release every note. A subpoena isn't interchangeable with a signed authorization. A caregiver's involvement doesn't automatically establish authority to make treatment decisions.
The medical release form templates below address common requests in US and UK practices. Each needs a defined purpose, an appropriate signer, and a workflow for checking the records before release. Some document consent. Others document an access request or the practice's response to legal process.
Practical rule: Choose the legal route before choosing the form. A complete signature field can't repair the wrong legal basis.
A free intake template can organize demographics, medications, and history before a first visit. A release form serves a different purpose: it documents permission or authority to disclose information. Neither replaces clinical consent, a guardianship document, or a jurisdiction-specific legal review.
For a small practice, the useful starting point is a short set of approved forms, not a folder full of interchangeable downloads. Staff need to know which form applies, who checks it, and where the completed release is recorded.
1. HIPAA authorization for release of records to a third party
Use this form when a disclosure requires the patient's written authorization. Typical recipients include a personal injury attorney, an employer, a school, or an insurer requesting information outside another permitted disclosure route.
Under 45 CFR §164.508(c), the authorization must identify the information, the disclosing party, the recipient, the purpose, and an expiration date or event, with the patient's signature and date. It also needs the required statements about revocation, conditioning of services, and potential redisclosure, as explained in the HHS authorization guidance.
Build the form around the actual disclosure
- Records covered: Name the relevant dates, encounters, and document categories rather than defaulting to the whole chart.
- Recipient details: Record the organization, named contact where appropriate, and verified delivery destination.
- Expiration and revocation: Provide a clear endpoint and instructions for submitting a written revocation.
- Representative signature: Include space for the signer's relationship and authority when someone signs for the patient.
For example, a primary care practice handling an injury claim could specify the injury-related visits and imaging reports rather than unrelated historical records. A physical therapy practice could release a discharge summary to an occupational health team without sending every treatment note.
The HIPAA authorization form guide provides related preparation guidance. The explanation of HIPAA authorization for medical record requests adds context for attorney requests, but the practice still needs to validate the actual form.
Give the patient a copy and log the recipient, scope, and release date. An employer's letterhead or an attorney's signature doesn't establish that the patient authorized the disclosure.
2. Psychotherapy notes authorization
An insurer requests session notes from a psychologist. Before sending a release form, the clinician needs to determine whether the request concerns ordinary clinical documentation or psychotherapy notes as HIPAA defines them.
Under 45 CFR §164.508(a)(2), most uses and disclosures of psychotherapy notes require specific authorization, subject to narrow exceptions. The HHS Privacy Rule overview explains their special protection and the distinction between these notes and the general medical record.
Separate the document types before requesting consent
Psychotherapy notes are separately maintained notes documenting or analyzing counseling conversations. The definition excludes medication information, session timing, clinical test results, and summaries of diagnosis, treatment plans, symptoms, prognosis, and progress.
A template should therefore identify the separately maintained material being requested. It shouldn't label every mental health progress note as a psychotherapy note or assume that a general chart authorization covers this category.
- Separate authorization: Don't combine permission for psychotherapy notes with a general records release.
- Separate storage: Keep the separately maintained notes distinguishable from the clinical summary.
- Separate review: Check applicable state mental health confidentiality rules before release.
For example, a psychiatrist responding to an employer's request could ask whether an authorized clinical summary answers the stated question. That avoids treating a request for work-related information as a reason to disclose private counseling material.
A note template can separate document categories. It can't decide whether a disclosure is legally permitted.
If the clinician believes an exception permits disclosure without authorization, the practice should document the exception and its reasoning. Uncertainty about the category of notes or the applicable exception calls for privacy or legal review, not broader consent wording.
3. Substance use disorder records consent (42 CFR Part 2)
A substance use diagnosis doesn't, by itself, determine whether Part 2 applies. The initial question is whether the records fall within the federal rules for federally assisted substance use disorder programs.
The governing provisions are 42 CFR Part 2, including the consent requirements in §2.31. These protections require a separate applicability check rather than an assumption that every addiction-related entry in a general medical chart follows the same disclosure process.
Confirm coverage before selecting the consent
A working template should prompt the practice to identify the program or other permitted disclosing parties, the recipient or permitted recipient description, the amount and kind of information, the purpose, expiration, signature, and revocation terms. It should also accommodate the current rule's requirements rather than preserve language from an older download.
- Program status: Record why the practice considers the information subject to Part 2.
- Consent scope: Specify the intended sharing and the information involved.
- Current wording: Have counsel verify the consent and any accompanying disclosure notice.
- Downstream handling: Flag records that need additional review before forwarding.
For example, an addiction treatment program arranging follow-up with a primary care clinician should establish the applicable consent route before sending records. A family medicine practice receiving those records should not assume that receipt permits unrestricted onward disclosure.
Federal changes have aligned parts of Part 2 with HIPAA, but that doesn't make an ordinary HIPAA authorization automatically sufficient. Conversely, a practice shouldn't assume that a wholly separate signature is always necessary if counsel has approved a combined form meeting the applicable requirements.
A generic template isn't enough when program status, consent scope, or litigation use is unclear. The practice needs a current, legally reviewed Part 2 workflow before first use.
4. Release of records to a family member or caregiver
A patient wants an adult daughter to discuss medication changes by phone. Another patient wants a partner to receive appointment reminders but nothing about test results. Those permissions need different scopes.
In US practice, 45 CFR §164.510(b) permits certain disclosures relevant to a person's involvement in care or payment when the patient agrees, has an opportunity to object and doesn't, or another applicable condition is met. A written permission form makes the patient's preference easier for reception staff and clinicians to apply, but formal authorization isn't required for every such conversation.
Record the boundary, not just the person's name
- Approved contact: Include the person's name, relationship, and a practical identity-verification method.
- Permitted subjects: Distinguish scheduling, medication discussions, results, and record copies.
- Limits: Record exclusions and whether messages may be left.
- Review trigger: Revisit permission after a change in relationships, care arrangements, or patient preference.
For England, NHS confidentiality guidance emphasizes establishing what information the patient wants shared, with whom, and in what circumstances, including explicit, informed consent for sharing with a carer.
Caregiver permission isn't decision-making authority. Permission to receive medication information doesn't appoint a healthcare proxy, establish guardianship, or authorize access to the complete chart.
Keep the current preference visible in both the clinical record and the relevant administrative workflow. A task reminder can prompt review, but staff still need to check whether the patient has changed or withdrawn permission before disclosing information.
5. Parent or guardian authorization for minors' records
The parent or guardian field is not an authority check. The practice needs to establish who may act for the child and whether the requested information falls within that authority.
Under 45 CFR §164.502(g), a parent is generally the personal representative of an unemancipated minor, subject to exceptions and applicable law. State rules concerning independent minor consent can change who controls information about particular services; a general overview of these issues appears in the HIPAA Journal's release form explanation.
Make representative authority a separate part of the form
The form should collect the patient's identity, the signer's relationship, the authority relied on, the requested records, and any supporting documentation needed for review. It should also prompt staff to identify confidential services before exporting a chart or enabling portal access.
- Authority documents: Review relevant guardianship, custody, or other legal documents rather than relying on a relationship label.
- Service-specific rules: Check the applicable minor-consent law for the treatment involved.
- Record separation: Use confidential note sections or access controls where available.
- Escalation: Refer disputed authority or unclear confidentiality rights for legal review.
For example, a pediatric practice receiving a parent's full-chart request should check whether the chart includes services for which the adolescent controls disclosure under applicable law. A practice near a state border needs to establish which jurisdiction's rules govern rather than infer them from the family's address.
The following video accompanies the parent and guardian workflow.
A release form also shouldn't double as blanket consent for treatment by a temporary caregiver. Record access, treatment consent, and proof of representative authority are separate questions, even when the same adult is involved.
6. Access to Medical Reports Act consent (UK insurance and employer reports)
An insurer asks a London GP for a medical report. The practice needs to distinguish that request from a patient asking for existing records and from a clinician sharing information for direct care.
The Access to Medical Reports Act 1988 applies to qualifying employment or insurance reports prepared by a medical practitioner who is or has been responsible for the patient's clinical care. Its scope shouldn't be extended automatically to every report by every healthcare professional.
Document consent and the patient's review choice
For a report within the Act, the workflow needs to address consent to the application, the patient's opportunity to see the report before supply, and the applicable process for requesting corrections, adding a statement, or withholding consent to release. A signature authorizing a report isn't permission to send an unrestricted medical history.
NHS England's information-sharing guidance distinguishes sharing for direct care from disclosures for other purposes. The practice should use the Act and current GMC confidentiality guidance to validate the report-specific procedure.
- Request details: Record the requesting organization, purpose, questions, and intended recipient.
- Patient choice: Record whether the patient wishes to see the report before release.
- Review outcome: Document corrections, any patient statement, and the final release decision.
- Release record: Retain the report version sent and the relevant correspondence.
For example, a GP preparing an insurance report should answer the relevant questions, record the patient's review choice, and complete the applicable review process before dispatch. A physiotherapist preparing an employer report needs an appropriate confidentiality and consent workflow, but shouldn't assume that the Act applies on identical terms.
The medical record retention guide provides related records-management context. Retention planning doesn't replace the statutory report-review process.
7. UK subject access request response (UK GDPR)
A subject access request isn't permission to disclose records to an unrelated third party. It is a person exercising a right of access to their own personal data.
Under UK GDPR Article 15, individuals have a right of access, subject to applicable restrictions. Article 12(3) generally requires a response within one month, with extensions available in specified circumstances. The practice needs a request-handling record, not a consent form that creates an unnecessary barrier to access.
Build a response record rather than a permission slip
Health information is special-category data, and the ICO's special-category guidance explains why consent to treatment and the lawful basis for processing aren't interchangeable. Processing an access request likewise requires the practice to identify the applicable duties rather than seek blanket consent.
- Receipt and deadline: Record when the request arrived and establish the applicable response date.
- Identity: Make proportionate checks without collecting unnecessary identification.
- Search scope: Identify the systems, archived material, correspondence, and images requiring review.
- Disclosure review: Assess third-party information and applicable restrictions rather than applying automatic redaction.
- Delivery evidence: Record what was supplied, how it was sent, and when.
For example, a Bristol dental practice receiving a patient's request should consider radiographs and correspondence as well as the main clinical notes. A Leeds GP practice should log the request when it arrives, even if the patient hasn't used the practice's preferred form.
Access requests need tracking, not extra consent hurdles. A well-designed form helps staff complete the process without making the form a condition of access.
The GDPR audit log retention guide offers related documentation guidance. Current ICO right-of-access guidance should govern deadline calculations, clarification, extensions, and restrictions.
8. Release of records to an attorney or in response to legal process (US)
An attorney's request, a subpoena, and a court order require different checks. The practice shouldn't treat legal letterhead as authority to release records.
Under 45 CFR §164.512(e), judicial and administrative disclosures depend on the type of process and the conditions met. A court order generally permits disclosure of the information expressly authorized; a subpoena without a court order may require satisfactory assurances about patient notice or a qualified protective order, or another compliant route.
Record the legal basis before exporting the chart
The practice's response form should capture the requester, service details, requested records, response deadline, authority relied on, reviewer, and final scope. It should distinguish a patient-authorized disclosure from a disclosure made under legal process.
- Authorization route: Validate the patient's authorization when that is the basis for release.
- Court-order route: Check the order's scope and any additional confidentiality protections.
- Subpoena route: Confirm the applicable conditions before disclosure.
- Special records: Escalate psychotherapy notes, Part 2 records, and other specially protected information.
For example, a cardiology practice handling a personal injury claim may release the specified records under a valid patient authorization. A psychiatry practice receiving a subpoena without an order should obtain legal review rather than assume that sending a patient notice is always sufficient.
The bodily injury guidance from Lein Law Offices explains claim context, not the practice's disclosure authority.
Use a response-letter template to acknowledge the request, identify missing documentation, or communicate the approved response. Keep that correspondence with the release record so another staff member can see why the practice acted.
How each release form differs by governing rule, setting, and typical use
| Item | Governing rule | Setting | Typical use |
|---|---|---|---|
| HIPAA authorization for release of records to a third party | 45 CFR 164.508(c); generally not required for treatment, payment, or health care operations disclosures | United States; HIPAA-covered providers | Authorizing a specific disclosure of records to an attorney, insurer, employer, or other named recipient |
| Psychotherapy notes authorization | 45 CFR 164.508(a)(2); generally requires a separate, specific authorization | United States; psychotherapy notes kept separately from the medical record | Authorizing disclosure of a mental health professional's psychotherapy notes |
| Substance use disorder records consent (42 CFR Part 2) | 42 CFR Part 2, including consent elements in 42 CFR 2.31 | Federally assisted substance use disorder treatment programs in the United States | Consenting to disclosure of protected substance use disorder treatment records |
| Release of records to a family member or caregiver | HIPAA permits relevant sharing with agreement or no objection; 45 CFR 164.510(b) | United States; patient care involving family or caregivers | Documenting who may receive information and what information they may receive |
| Parent or guardian authorization for minors' records | HIPAA personal representative rules and applicable state minor-consent laws | United States; care for minors | Clarifying parental access and protecting information about services a minor may consent to independently |
| Access to Medical Reports Act consent (UK insurance and employer reports) | Access to Medical Reports Act 1988 and GMC confidentiality guidance | United Kingdom; insurance or employment medical reports | Recording consent and the patient's opportunity to review a report before it is sent |
| UK subject access request response (UK GDPR) | UK GDPR Articles 12(3) and 15 | United Kingdom; responding to a patient's records-access request | Logging identity checks, records supplied, and response timing |
| Release of records to an attorney or in response to legal process (US) | HIPAA 45 CFR 164.512(e); requirements depend on the request type | United States; legal requests for medical records | Documenting the legal basis and responding to an authorization, subpoena, or court order |
Match the Form to the Request Before You Sign
The most useful medical release form templates make the legal basis visible. They help staff distinguish patient authorization, family permission, representative authority, Part 2 consent, legal process, a UK report request, and a patient's own access request. Those routes shouldn't collapse into a single general permission form.
A completed form is the start of the release check, not the end. Staff still need to verify the recipient, confirm the signer's authority, inspect the selected records, and use an appropriate delivery channel. The release log should identify what left the practice and why.
Keep the workflow usable after the signature
A multi-site medical-record retrieval study described authorization renewals and facility-specific submission channels as practical obstacles. The lesson for a small practice is operational: record the required submission method, expiration terms, request status, and person responsible for follow-up.
- Assign ownership: Give incoming requests a named staff owner and an escalation route.
- Control versions: Keep approved templates in a shared location and retire superseded copies.
- Separate requests: Don't assume that patient access follows the same process as third-party authorization.
- Review exceptions: Send unclear authority, disputed access, and specially protected records for appropriate review.
For US patient access, HHS explains that covered entities generally must act within 30 calendar days, with one additional 30-day extension subject to written notice requirements. That access rule shouldn't become a blanket deadline printed on every third-party release form.
Schedule an annual review of state and national requirements, and obtain legal review before a new form enters use. Review sooner when regulations, services, record systems, or disclosure workflows change. A template that worked for ordinary records may not fit a new behavioral health service or cross-border request.
For the documentation workflow alongside these forms, PatientNotes offers custom templates, specialty formats, and follow-up task extraction; its Team plan includes a BAA at no extra cost. A 7-day free trial requires no credit card, and setup questions go to the team that builds the product. Related guidance is available through the clinical documentation resources.
Clinical note software doesn't validate a release, establish guardianship, or interpret a subpoena. The practice remains responsible for the legal decision and final disclosure. Good documentation makes that decision easier to review and carry out consistently.
PatientNotes turns consultations into editable clinical notes and follow-up tasks, with customizable templates for the documentation that sits alongside release workflows. Visit PatientNotes to try the workflow without a credit card and keep disclosure decisions within the practice's approved legal process.
