HIPAA release form: free in Word, or sign it online
Reviewed in October 2026
A HIPAA release form, or HIPAA authorization, is a signed document that allows a doctor, hospital or health plan to share your health information with someone you choose. Federal rules list what it must contain, including what is shared, with whom, why and until when.
Ten documents free, no card. Signed by the patient or their personal representative.
Example filled in with sample data
The full HIPAA authorization
AUTHORIZATION FOR RELEASE OF PROTECTED HEALTH INFORMATION
Patient: [full name] · Date of birth: [date] · Address: [address] · Phone: [phone]
1. Who may release the information
[Name of doctor, hospital, clinic, pharmacy or health plan], [address].
2. Who may receive the information
[Name of person or organization], [relationship], [address], [phone or email].
3. Information to be released
[ ] All records [ ] Records from [date] to [date] [ ] Only: [lab results, imaging, discharge summaries, billing records, other].
Specially protected information is released only if I initial here: ___ mental health ___ substance use treatment ___ HIV/AIDS ___ genetic testing.
4. Purpose
[At my request / continuing care / legal matter / insurance claim / other].
5. Expiration
This authorization expires on [date] or on [event, for example the end of my legal case].
6. My rights
I may revoke this authorization at any time by writing to the provider named above. Revocation does not affect information already released.
My treatment, payment, enrollment or eligibility for benefits will not depend on whether I sign, except where the law allows.
Information released under this authorization may be disclosed again by the recipient and may no longer be protected by federal privacy rules.
I am entitled to a copy of this signed authorization.
I have read this form and I authorize the release described above.
PATIENT
Signature: ______________________
Name: [full name]
Date: [date]
PERSONAL REPRESENTATIVE (IF SIGNING FOR THE PATIENT)
Signature: ______________________
Name: [full name]
Authority: [parent of a minor / health care agent / legal guardian / executor]
Date: [date]
What the template includes
Patient details
Who releases the information
Who receives it
Which records, with separate initials for specially protected ones
Purpose of the release
Expiration date or event
Right to revoke in writing
Statement that care does not depend on signing
Warning that the recipient may share it again
Representative block with the source of authority
What you fill in
Field
Example
Patient
Thomas Wright, born February 2, 1955
Releasing
Mercy General Hospital, Springfield, IL
Receiving
Karen Wright, daughter
Records
All records from January 1, 2026 to today
Purpose
Helping coordinate my care
Expiration
December 31, 2027
How it gets signed
1Choose “Use this template”, fill in the fields and read the full HIPAA authorization once more.
2Send it by WhatsApp or email. The other party opens the link on their phone without an account.
3They tap the brown bar at the bottom that says “Sign as …” and draw their signature with a finger.
4Everyone gets the signed PDF with its signature certificate. Anyone can check it at signsolu.com/verificar.
Before signing, each signer agrees to sign electronically. The screen links to the electronic signature disclosure the ESIGN Act asks for.
Your first ten documents are free and need no card.
Want your signature as an image for other files? Create your signature online and download it as a transparent PNG, free.
What the law says
The HIPAA Privacy Rule, at 45 CFR 164.508, lists what a valid authorization must contain. It needs a specific description of the information, who may release it, who may receive it, the purpose, an expiration date or event, and the signature and date. If a representative signs, it must say what authority they have.
The same rule requires three statements. The right to revoke in writing, whether treatment depends on signing, and that information released may be shared again. Clause 6 includes all three in plain language.
HIPAA allows electronic signatures on authorizations when they are valid under applicable law. The ESIGN Act gives them the same effect as ink. Some providers still ask you to use their own form.
When you need a HIPAA release
A family member needs to talk to your doctors.
A lawyer needs your records for a claim.
A new doctor needs records from a former one.
An insurer or employer asks for records for a claim or leave.
A school or camp needs a health summary for a child.
You do not need an authorization to get your own records. You have a right of access and can request them directly.
Be specific about what you share
Share only what the recipient needs. A lawyer handling a car accident may need records from that year only. A caregiver may need everything.
Mental health notes, substance use treatment and some other records have extra protections. Initial them in clause 3 only if you mean to share them.
A worked example
Thomas wants his daughter Karen to help coordinate his care. He fills in the form for all records since January and sets an expiration at the end of next year.
He signs from his phone and sends the PDF to the hospital’s records office. The hospital adds it to his file, and his doctors can now talk to Karen.
Mistakes that get forms rejected
No expiration. The rule requires a date or an event.
Missing statements. Leave clause 6 as it is.
Vague recipient. Name the person or office in full.
Representative without authority. Write the source of authority and attach proof.
Sending the form to the provider
Most providers have a medical records office. Send the signed PDF by the method they accept, such as email, fax or their patient portal. Ask how long they take to release records.
Keep your own copy. Clause 6 gives you the right to one, and you will need it if you revoke the authorization later.
Revoking the authorization
Write to the provider named in clause 1 and say you revoke the authorization signed on a given date. Sign it and keep proof that you sent it.
Records already released before the revocation stay with the recipient. New releases stop.
Checklist before you sign
1Releasing provider named in full.
2Recipient named in full.
3Records chosen, with initials for protected ones if needed.
4Purpose and expiration filled in.
5Representative authority stated if you sign for someone else.
Sample purposes
“At my request.”
“To help my daughter coordinate my care.”
“For my personal injury claim handled by Smith Law Group.”
“For my new primary care doctor.”
“For my short-term disability claim.”
“At my request” is enough when you, the patient, ask for the release.
Minors and HIPAA releases
Parents usually sign for their minor children as personal representatives. Some state laws let minors consent to certain care on their own, and then the minor may control those records.
HIPAA release or medical power of attorney
A HIPAA release lets someone receive records. It does not let them make decisions. To name someone who can decide about your care, use a medical power of attorney. Many people sign both.
Give a copy of each to your main doctor so the office knows who may call and who may decide.
A HIPAA release and a medical power of attorney together cover both needs.
Is a HIPAA authorization signed online legally binding?
Yes. The ESIGN Act gives an electronic signature the same legal effect as a handwritten one. The signed PDF and its certificate show who signed the HIPAA authorization, when and from which device.
Can a provider refuse my HIPAA release form?
A provider may ask you to use its own form, but a form with every required element is valid under the rule.
Can I download the HIPAA release form in Word?
Yes. “Download in Word” gives you the full HIPAA release form with no email and no account. You can print it or edit it and sign it here later.
How long does a HIPAA authorization last?
Until the date or event you write in clause 5, or until you revoke it in writing.
Do I need this form to get my own records?
No. You can request your own records directly under your right of access.
Can I sign for my parent?
Only if you are their personal representative, such as a health care agent or guardian. Write your authority in the representative block.
Can I authorize release to more than one person?
Yes. Name each person in clause 2, or sign one form per recipient.
Is there a fee to get records released?
Providers may charge a reasonable fee for copies. Ask the records office before you send the form.
