A HIPAA release form is valid because of what it says, not because of where you got it

This is the part a downloadable template cannot settle for you. The Privacy Rule says “a valid authorization is a document that meets the requirements” in the paragraphs it then goes on to list (45 CFR 164.508, read 2026-09-27). Nothing in it prescribes a layout, a letterhead or a downloadable original, so there is no version of this document that is more official than another version carrying the same elements.

Which is why the practical answer is to use the form your provider, plan or records company hands you. Not because the rule prefers theirs, but because they are the ones deciding whether what arrives is complete, and starting from their own wording removes the argument. When they have no form, a signed page carrying the elements below is the same document.

These are the core elements. The phrase in quotation marks on each line is the regulation’s own wording (45 CFR 164.508, read 2026-09-27); the rest of the line is what it means in practice.

Which records

“A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.” Name the records precisely enough that the office knows exactly what to send.

Who may release them

“The name or other specific identification of the person(s), or class of persons, authorized” to make the disclosure: the office that holds the records.

Who may receive them

“The name or other specific identification of the person(s), or class of persons, to whom” the records may go. The lawyer, the insurer, the new practice, you.

What for

“A description of each purpose of the requested use or disclosure.” If you are the one asking for the release, you do not have to explain why: the rule accepts “at the request of the individual” as “a sufficient description of the purpose when an individual initiates the authorization”.

When it ends

“An expiration date or an expiration event that relates to the individual or the purpose” of the disclosure. Either form counts; neither is the same as leaving it blank.

Signature and date

“Signature of the individual and date.” If you are signing for someone else — a parent, a child, a person you hold a power of attorney for — “a description of such representative’s authority to act for the individual must also be provided.”

The six are not the whole checklist. “In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following” (45 CFR 164.508, read 2026-09-27), and a form missing one of them is as incomplete as a form missing a signature:

• —“The individual’s right to revoke the authorization in writing” — with either how to revoke it and its exceptions, or a reference to the provider’s privacy notice that says so.
• —“The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization” — in plain terms, whether you can still be treated if you do not sign.
• —“The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this subpart” — once the records reach a lawyer or an employer, the Privacy Rule may no longer cover them.

On top of those, “the authorization must be written in plain language” (45 CFR 164.508, read 2026-09-27). And where a provider or plan is the one asking you to sign, “the covered entity must provide the individual with a copy of the signed authorization” — so a copy for your file is theirs to give, not a favour to ask for.

The rule does not leave this to judgment. “An authorization is not valid, if the document submitted has any of the” defects it lists (45 CFR 164.508, read 2026-09-27), and four of the five are things you can check before you send:

• —“The expiration date has passed or the expiration event is known by the covered entity to have occurred” — the one that catches a form whose expiration date has already gone by when it arrives.
• —“The authorization has not been filled out completely, with respect to an element described by paragraph (c) of this section” — any of the six elements, or any of the three statements, left out.
• —“The authorization is known by the covered entity to have been revoked” — which is what the revocation statement above exists to make possible.
• —“Any material information in the authorization is known by the covered entity to be false.”
• —“The authorization violates paragraph (b)(3) or (4) of this section” — it is combined with another document where the rule forbids that, or signing it was made a condition of treatment, payment, enrollment or benefits where the rule forbids that. Those are questions for whoever drafted the form rather than for you.

Reading the second one against your own page before it goes is the whole value of this list, with the three statements above counted as elements. An incomplete element is not a slow release — it is a document the office may treat as invalid, and the time you lose is the time it takes them to tell you.

People arrive at this form for two different tasks, and the rule gives them two different routes. Sending records to somebody else can be done with the authorization above. Getting a copy for yourself is a right of access: “an individual has a right of access to inspect and obtain a copy of protected health information” about them in a designated record set (45 CFR 164.524, read 2026-09-27). Two things are carved out of that right itself: “psychotherapy notes”, and “information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding”. The rule also lists other grounds on which a provider may deny access, and for some of them it must give you “a right to have such denials reviewed”.

The access route can also send your records to someone else. If your request “directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual”, and the request “must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy” (45 CFR 164.524, read 2026-09-27).

That distinction is worth the two minutes because the access route has a clock on it. A provider “may require individuals to make requests for access in writing” if it tells people that is the requirement, and it “must act on a request for access no later than 30 days after receipt” (45 CFR 164.524, read 2026-09-27). If it cannot, it “may extend the time for such actions by no more than 30 days”, once, and only by telling you in writing within the first 30 days why, and the date it will act by. So the longest the rule allows is 60 days, and the first 30 end with either your records or a letter. That clock is written for access requests — so when the records are yours, whether they are going to you or to someone you name, the access request is the one that carries a deadline.

To the office that holds the records. The number to use is the one on their own authorization form, on their website, or on the letter that asked you for this — those are written by the people who will receive it.

This page publishes no fax number, and that is a policy rather than an omission. A number that has been reassigned since somebody wrote it down still produces a confirmed transmission, to whoever holds it now, and a page of provider numbers we could not re-read every few months would be a page that eventually sends a stranger somebody’s medical history. One agency’s destinations are published here, from a dated record with a build check on its age: the one place this site does publish fax numbers.

Whether a given office takes a faxed authorization at all is that office’s answer to give. What the rule says about it is a duty on them and not on you: a covered entity “must have in place appropriate administrative, technical, and physical safeguards” for protected health information (45 CFR 164.530, read 2026-09-27). So the call worth making before you send is not about the rule. It is whether that fax line is the one they want this on, and whether anyone is standing at it.

A confirmation says the receiving fax system answered and acknowledged the pages, with the number dialed, the page count and the time. It does not say the authorization was accepted, that it was found complete, or that anyone has looked at it — and it does not say the records have gone anywhere. What a fax confirmation actually proves draws the line precisely, and it is the right two minutes if the record is going in a file next to a claim or a case.

Upload the signed pages, check the preview, and send. No account, nothing to cancel, and the card is authorized when you press send and charged only once the receiving fax system acknowledges the pages. If it never does, you are not charged. A cover sheet is generated with the routing fields filled in from what you entered, which for a records office is the difference between a named desk and a pile.

If you are not sure the number on the form is still a fax line, send a test fax to it first. It costs nothing and it is the cheapest way to find out before a signed authorization with your date of birth on it goes to a number nobody answers.

• How do I send a fax from my iPhone?
• How do I send a fax from an Android phone?
• How do I send a fax from my computer?
• Can I send a fax from Gmail?
• How do I fax a PDF?
• How do I send a fax without a subscription?
• How do I fax something without a fax machine?
• What does a fax confirmation actually prove?
• Why did my fax fail?
• Do I need a fax cover sheet, and what goes on it?
• How do I send a test fax to check that a line works?
• What number can I send a test fax to?
• Can I fax from my email?
• Where can I fax something?