The Privacy Rule of the federal Health Insurance Portability and Accountability Act requires health records release forms to include a specific description of the information to be released, specify the person authorizing the release, identify the recipient of the information, have an expiation date and state that the authorization can be revoked, explains the U.S. Department of Health and Human Services. The form must be written using plain language.
An authorization to release protected health information requires the signature and date of the person requesting that her records be shared, and she must state the purpose for the disclosure of her health information, notes the American Health Information Management Association. Alternatively, an authorized legal representative may sign the form. The representative must identify his relationship to the patient.
A valid authorization form must include a statement that the health care provider or organization cannot withhold treatment or eligibility for benefits if the individual does not sign the form, according to the American Health Information Management Association, or AHIMA. The form also must contain a statement about the possibility of the health information being re-disclosed by the recipient and no longer protected under the Privacy Rule.
The release of sensitive or restricted health information requires additional disclosures and specific authorization, notes the AHIMA. Examples include psychotherapy notes, HIV test results and substance use treatment records.