Free template · Updated October 18, 2026

Medical Records Release Form template

A medical records release form is a patient's written authorization for a healthcare provider or health plan to disclose specific health records to a named recipient, for a stated purpose, until a set expiration date.

A medical records release form is a patient's signed authorization allowing a doctor, hospital, or health plan to share their health information with a named person or organization, such as a lawyer, an insurer, an employer, a school, or a family member. In the US, a release for purposes not otherwise permitted by the HIPAA Privacy Rule must contain the specific elements and statements listed in 45 CFR 164.508(c), or the provider can't rely on it.

Use this template — sign onlineOpens as a ready-to-send document with signature fields placed.

Replace everything in [BRACKETS], export to PDF, then send it for signature.

1. Patient Information

Patient full name: [PATIENT FULL NAME] Date of birth: [DATE OF BIRTH] Address: [ADDRESS] Phone: [PHONE]. Email: [EMAIL] Patient or account number (if known): [NUMBER] Other names used in the records (if any): [PREVIOUS NAMES]

2. Who May Release the Information

I authorize the following person or organization to release my health information: [NAME OF PROVIDER, HOSPITAL, CLINIC, OR HEALTH PLAN], [ADDRESS], [PHONE / FAX / RECORDS EMAIL] (the "Releasing Party").

3. Who May Receive the Information

The Releasing Party may disclose the information described in Section 4 to: [NAME OF PERSON OR ORGANIZATION], [RELATIONSHIP OR ROLE, e.g. attorney, insurer, employer, spouse], [ADDRESS], [PHONE / EMAIL] (the "Recipient"). Preferred format and delivery: [PAPER COPY BY MAIL / ELECTRONIC COPY BY SECURE EMAIL OR PORTAL / OTHER].

4. Information to Be Released

Dates of service: [FROM DATE] to [TO DATE, or ALL DATES]. Records to be released (check all that apply): [ ] Complete medical record [ ] Visit or office notes [ ] Discharge summaries [ ] Laboratory and test results [ ] Imaging reports and images [ ] Medication list and prescriptions [ ] Immunization records [ ] Billing and payment records [ ] Other (describe specifically): [DESCRIPTION] Sensitive information. Some information may be released only if I specifically initial below, and some may need a separate authorization or consent under federal or state law: [ ] Mental health information (other than psychotherapy notes): [INITIALS] [ ] HIV/AIDS test results or treatment: [INITIALS] [ ] Genetic testing information: [INITIALS] [ ] Substance use disorder treatment records: [INITIALS] [ ] Reproductive or sexual health information: [INITIALS] Psychotherapy notes are not included in this authorization. They require a separate authorization.

5. Purpose of the Disclosure

The information will be used or disclosed for the following purpose(s): [PURPOSE, e.g. legal claim, insurance application, disability claim, school enrollment, continuity of care, personal records of the Recipient, or "at the request of the individual"].

6. Expiration

This authorization expires on [EXPIRATION DATE] or upon the following event: [EXPIRATION EVENT, e.g. the close of claim number CLAIM NUMBER], whichever is stated. If neither is filled in, this authorization is incomplete and may not be honored.

7. My Right to Revoke

I understand that I may revoke this authorization at any time by sending a written notice to [RELEASING PARTY NAME AND ADDRESS / RECORDS EMAIL]. A revocation will not apply to information already released in reliance on this authorization. If this authorization was obtained as a condition of obtaining insurance coverage, other law may give the insurer the right to contest a claim under the policy, or the policy itself, even after I revoke it. [ALTERNATIVELY, FOR A COVERED ENTITY: The exceptions to the right to revoke and how to revoke are described in our Notice of Privacy Practices, available at LOCATION.]

8. Treatment and Payment Are Not Conditioned on Signing

I understand that the Releasing Party may not condition my treatment, payment, enrollment in a health plan, or eligibility for benefits on whether I sign this authorization, except in the limited cases allowed by law. [IF ONE OF THOSE CASES APPLIES, REPLACE THIS SENTENCE WITH A STATEMENT OF THE CONSEQUENCES OF REFUSING TO SIGN.] I may refuse to sign this form.

9. Redisclosure

I understand that information disclosed under this authorization may be re-disclosed by the Recipient and may no longer be protected by federal privacy rules. Other laws may still limit what the Recipient can do with certain types of information.

10. Copy of This Form

I understand that I am entitled to a copy of this signed authorization. A copy or electronic version of this signed form is as valid as the original. The Releasing Party may charge only fees permitted by applicable law for copying and sending records.

11. Signature

I have read this form, or had it read to me, and I understand it. I agree that this authorization may be signed electronically, where permitted by applicable law. Signature of patient or personal representative: ____________________ Date: [DATE] Printed name: [NAME] If signed by a personal representative: Name of representative: [REPRESENTATIVE NAME] Relationship to patient and description of authority: [e.g. parent of a minor, legal guardian, health care agent under a power of attorney, executor of the estate] Documentation of authority attached: [YES / NO]

Our take: Our take: most rejected releases are rejected for being vague or incomplete, not for being the wrong form. HIPAA's rule is specific: the authorization has to describe the information in a specific and meaningful way, name who may disclose it and who may receive it, state each purpose, give an expiration date or event, and carry the patient's signature and date, plus statements about the right to revoke in writing, whether treatment can be conditioned on signing, and the risk that the recipient re-discloses the information. It must be in plain language, and an authorization that is incomplete or past its expiration is not valid. So fill in every field, and write "at the request of the individual" if the patient doesn't want to give a reason, which the rule allows. Two practical points. First, many providers prefer their own form, so ask the records office before sending ours. Second, if the patient simply wants a copy for themselves, that is a request under the HIPAA right of access, not this authorization. HHS says HIPAA authorizations may be obtained electronically, provided the electronic signature is valid under applicable law. eSignSimple can collect that signature with an audit trail, but we don't claim HIPAA compliance or sign Business Associate Agreements, so a provider or health plan should check with its compliance team before using any e-signature tool for patient records. For consent to treatment itself, use a medical consent form.

When should you use a medical records release form?

When a patient wants records sent to a lawyer, insurer, or claims adjuster for an injury or disability claim
When an employer, school, camp, or sports program needs specific health information and the patient agrees to share it
When a patient wants a family member or caregiver to be able to receive information from their provider
When a researcher, life insurer, or other third party asks for records for a purpose outside treatment and payment

How do you fill in this template?

Ask the provider's records office whether it requires its own form; if it accepts this one, use their exact name and address in Section 2.
Name the recipient specifically in Section 3 and describe the records narrowly in Section 4, with dates of service, instead of ticking "complete medical record" by default.
Initial each sensitive category you want released, and use a separate authorization for psychotherapy notes or anything your state treats as specially protected.
Fill in the purpose and an expiration date or event, because a form with a blank required element is not valid.
If a personal representative signs, describe their authority and attach the supporting document, such as guardianship papers or a health care power of attorney.
Upload the form to eSignSimple, save it as a template if you send releases often, and send it for e-signature, after confirming the provider accepts electronic signatures. Give the patient a copy of the signed form.

How do you get it signed online?

Save it as Word or PDF. Paste the filled-in text into Word or Google Docs and keep it as a .docx file, or export it as a PDF. eSignSimple accepts both, plus DOC, ODT and RTF, up to 25 MB; Word files are converted to PDF on upload.
Upload and place the fields. Sign up with Google, upload the file and drag signature, initials, date and text fields onto the page for each signer. Set a signing order if one party must sign first.
Send it for signature. Each signer gets a private link and signs in the browser without creating an account. Automatic email reminders go out every three days (up to three) until everyone has signed.
Keep the signed copy. When the last person signs, everyone can download the final PDF with a certificate of completion, an audit trail and a SHA-256 fingerprint you can verify later.

Signing on your own device only? The guide to signing a PDF covers the free built-in options, and the security page explains how signed files are stored and verified.

This template is general information, not legal advice. Laws differ by country and state; have a lawyer review contracts with high stakes.

Written by Buğra Sözeri, founder and editor, eSignSimple · Last reviewed October 18, 2026

Buğra builds eSignSimple and writes and maintains its guides. He researches each legal page against the official texts linked on it and updates pages when the law or the product changes. He is not a lawyer, and nothing here is legal advice. About eSignSimple

Frequently asked questions

What must a HIPAA authorization include?

Under 45 CFR 164.508(c): a specific description of the information, who may disclose it, who may receive it, the purpose, an expiration date or event, and the signature and date. It must also state the right to revoke in writing, whether treatment can be conditioned on signing, and that the recipient may re-disclose the information. It must be in plain language.

Can a HIPAA authorization be signed electronically?

HHS says the Privacy Rule allows authorizations to be obtained electronically, provided the electronic signature is valid under applicable law, and that providers may disclose information based on an electronic copy of a valid signed authorization. Individual providers can still set their own requirements.

Do I need this form to get my own medical records?

Usually not. Asking for your own records is a request under the HIPAA right of access, and a provider generally must act on it within 30 days. This release is for sending records to someone else.

How long is a medical records release valid?

Until the expiration date or event written on it, or until you revoke it in writing. HIPAA requires one of the two; an authorization past its expiration is not valid. Covered entities must keep signed authorizations for six years from when they were created or last in effect, whichever is later.

Is eSignSimple HIPAA compliant?

We don't claim HIPAA compliance and don't sign Business Associate Agreements. Healthcare providers and health plans should check their regulatory obligations before using any e-signature tool for protected health information.

Get your next document signed today.

Start with 3 free documents a month. No card needed.

Get started, it's free See pricing →