A patient walks up to your front desk and asks you to fax her medical records to a personal injury attorney. Your staff member grabs a blank piece of paper, has the patient scribble a sentence and sign it, then sends fifty pages of records across town. I've watched this exact scenario play out in clinics across the country — and it's a compliance disaster waiting to happen.

If you've ever searched what is an information release form, you're asking the right question. This single document stands between your organization and a potential HIPAA violation that could cost hundreds of thousands of dollars. Let me walk you through exactly what it is, what it must contain, and the mistakes I see covered entities make with it every single week.

What Is an Information Release Form, Exactly?

An information release form — known formally under HIPAA as an "authorization" — is a written document signed by a patient (or their personal representative) that gives a covered entity permission to use or disclose protected health information (PHI) for purposes not otherwise permitted by the HIPAA Privacy Rule.

Think of it this way: HIPAA already allows you to share PHI for treatment, payment, and healthcare operations without patient authorization. But anything outside those buckets — sending records to an employer, sharing psychotherapy notes, using PHI for marketing — requires a valid, signed authorization form.

The authorization is governed by 45 CFR § 164.508. It isn't optional, and a generic "consent" form won't cut it. HHS has been crystal clear on this point in multiple guidance documents published on their Privacy Rule guidance page.

The Six Core Elements Every Form Must Include

I've reviewed thousands of authorization forms over my career. Roughly half of them are missing at least one required element. Here's what 45 CFR § 164.508(c) demands:

  • Specific description of the PHI to be used or disclosed — not just "all records."
  • Name or class of persons authorized to make the disclosure.
  • Name or class of persons to whom the disclosure will be made.
  • Purpose of the disclosure — the patient can write "at the request of the individual" if they choose.
  • Expiration date or event — open-ended authorizations are a red flag.
  • Signature and date of the individual or personal representative, with a description of the representative's authority if applicable.

Miss even one of these, and the authorization is defective. A defective authorization means the disclosure was unauthorized — which means you've just committed a breach.

Required Statements You Can't Skip

Beyond those six core elements, the form must also include three specific statements:

  • The individual's right to revoke the authorization in writing.
  • The ability or inability to condition treatment, payment, enrollment, or eligibility on the authorization.
  • The potential for PHI to be re-disclosed by the recipient and no longer protected by HIPAA.

These aren't suggestions. They're regulatory requirements. I've seen organizations get tripped up on the re-disclosure statement more than any other element. If it's missing, the form fails.

The $1.5 Million Mistake: When Release Forms Go Wrong

Improper disclosures of PHI have led to some of the largest OCR enforcement actions on record. In 2018, Allergy Associates of Hartford agreed to pay $125,000 to HHS after a physician impermissibly disclosed a patient's PHI to a reporter — without a valid authorization. The OCR investigation revealed the practice had no policies governing media disclosures and no compliant information release form process in place.

In a broader context, Advocate Health Care Network paid $5.55 million in 2016 for multiple HIPAA violations, including failures in policies governing access to and disclosure of ePHI. While that case involved more than just authorization forms, it underscored how weak administrative safeguards — including poor documentation practices — compound into massive penalties.

You can review the full list of enforcement results on the OCR Resolution Agreements page.

Here's where confusion runs rampant. Many organizations use a general "consent to treat" form and assume it covers PHI disclosures. It doesn't.

A consent form under 45 CFR § 164.506 is optional and covers routine uses of PHI for treatment, payment, and healthcare operations. An authorization form under § 164.508 is mandatory for everything else.

When someone asks what is an information release form, they're almost always asking about the authorization — the document required for non-routine disclosures. Conflating the two has led to countless preventable violations. I've audited practices that hadn't updated their forms in over a decade. They were using a single-page consent form from 2009 and calling it an "authorization." It met none of the regulatory requirements.

When You Don't Need an Authorization

HIPAA carves out specific exceptions where PHI disclosure doesn't require a signed authorization:

  • Disclosures required by law (court orders, subpoenas with proper safeguards).
  • Public health activities reported to public health authorities.
  • Disclosures to avert a serious threat to health or safety.
  • Workers' compensation disclosures as permitted by state law.
  • Disclosures to the individual themselves (with identity verification).

These exceptions are narrow. If you're not sure whether one applies, default to getting a signed authorization. That form is your shield.

How to Build a Compliant Information Release Form

I tell every client the same thing: don't download a random template from the internet and slap your logo on it. Build it right, or hire someone who will.

Step 1: Use Plain Language

Your patients aren't lawyers. The form should be written at an eighth-grade reading level. Avoid legal jargon. If a patient doesn't understand what they're signing, the spirit of informed consent is violated — even if the technical elements are present.

Step 2: Be Specific About the PHI

"All medical records" is lazy and risky. Specify the date range, the type of records (lab results, imaging, clinical notes), and the relevant provider or department. Specificity protects both you and the patient.

Step 3: Include an Expiration

Never leave the expiration field blank. Some states have laws that automatically void authorizations after a set period. At minimum, use a reasonable date — 90 days is a common standard. "Until revoked" is permissible in some contexts but invites risk.

Step 4: Train Your Workforce

A perfect form means nothing if your front desk staff doesn't know how to use it. Every member of your workforce who handles PHI should understand when an authorization is required, what makes one valid, and what to do when one is defective. This is exactly the kind of knowledge gap that targeted HIPAA workforce training is designed to close.

What Happens When a Patient Revokes an Authorization?

Patients have the right to revoke an authorization at any time, in writing. Once you receive that revocation, you must stop all further disclosures under that form. However, you're not liable for disclosures that already happened while the authorization was still valid.

Document the revocation. Date-stamp it. File it with the original authorization. If a dispute arises six months later, that paper trail is your evidence.

State Laws Add Another Layer

HIPAA sets the federal floor, but state laws often go further. Some states require specific language for the release of mental health records, HIV/AIDS status, substance abuse treatment information, or genetic data. In those cases, the stricter standard applies.

For example, 42 CFR Part 2 imposes additional consent requirements for substance use disorder records that go beyond standard HIPAA authorization rules. If your organization handles any of these sensitive categories, your information release form needs to reflect those heightened requirements.

Your Authorization Form Is an Audit Target

During an OCR investigation or compliance audit, one of the first things investigators request is your authorization form and a sample of signed copies. They want to see that your form contains every required element and that your staff is applying it consistently.

I've seen audits derail because an organization had a compliant form on its website but was using a different — noncompliant — version at the front desk. Consistency matters. Conduct an internal review at least once a year.

If your team hasn't reviewed its authorization policies recently, now is the time. A comprehensive HIPAA compliance training program can walk your entire workforce through the requirements and give them the confidence to handle disclosures correctly.

The Bottom Line on Information Release Forms

An information release form isn't a formality. It's a legally binding document that controls how and when your organization shares the most sensitive data a person has — their health information. Get it wrong, and you face OCR penalties, patient complaints, and breach notification obligations under HHS breach notification rules.

Get it right, and you've built one of the strongest compliance safeguards available to any covered entity. Review your forms today. Train your staff tomorrow. Don't wait for an OCR letter to force the issue.