Medical Records Release Form: What to Write and When You Need One

If you are changing doctors, moving out of state, or getting a second opinion, someone will hand you a "release of information" (ROI) or "authorization to release health information" form. This page explains what each field means, what to write, and when HIPAA does not require the form at all.

Reviewed October 2026. This is general information about US federal rules (HIPAA); state law can add requirements.

The short version

There is no single national release form. Use the sending office's form if it has one; most health systems post theirs online.
Provider-to-provider for treatment: HIPAA allows your old provider to send records to your new treating provider without your written authorization (45 CFR 164.506). Offices often ask for a form anyway.
Getting your own copy: that is a right-of-access request, not an authorization. It only has to be in writing, and the provider generally has 30 days to respond.
Sending records to anyone who is not treating you (a lawyer, employer, insurer, school, family member) usually requires a signed HIPAA authorization.
Be specific about which records, which dates, and which format. Vague requests are slower.

Three different documents that get called "a release"

Situation	What it legally is	Is your signature required by HIPAA?
Your new doctor needs your history	Disclosure for treatment	No, though many offices ask for one by policy or state law
You want a copy for yourself, or sent where you direct	Right of access request (45 CFR 164.524)	A written request is required; it does not need the formal authorization elements
Records to an attorney, employer, life insurer, school, or relative	HIPAA authorization (45 CFR 164.508)	Yes, with the required elements below

What to write in each field

Patient information. Full legal name, any previous names, date of birth, and the medical record number if you know it. Former names matter: records are filed under the name you had at the time.
Who releases the records. The practice, hospital, or clinic that holds them. If a practice has closed, been sold, or merged, name the current records custodian (see fees, refusals and closed practices).
Who receives them. The new clinician's name, practice name, street address, and fax number or secure email/Direct address. Call the new office and ask exactly how they want records sent; many prefer fax or electronic exchange over mail.
Which records. Tick specific boxes or write them out: visit/progress notes, consult notes, lab results, imaging reports, the images themselves (DICOM), pathology, operative reports, discharge summaries, medication list, immunizations, problem list. "Complete record" is allowed but slower and sometimes costlier.
Date range. For a new primary care doctor, the last two to three years plus key older items (surgeries, major diagnoses) is usually enough. For a specialist second opinion, everything related to the condition.
Purpose. "Continuing care," "transfer of care," or "at the request of the individual." You do not have to explain further.
Specially protected information. Many forms have separate check-boxes for substance use treatment records (42 CFR Part 2), mental health, HIV/STI, and genetic testing. If you want them included, tick them and initial where asked; if you leave them blank, they will usually be withheld.
Format. Electronic (portal, secure email, CD/USB for images) is usually fastest. Paper is fine for small records.
Expiration. A HIPAA authorization must have an expiration date or event, for example "one year from signature" or "upon completion of transfer."
Signature and date. If a parent, guardian, health care agent, or executor signs, include their authority (and usually a copy of the document that grants it).

Required elements of a valid HIPAA authorization

When an authorization is legally required, 45 CFR 164.508(c) says it must include: a specific description of the information; who may disclose it; who may receive it; the purpose; an expiration date or event; your signature and date; and statements that you can revoke it in writing, that treatment generally cannot be conditioned on signing it, and that information disclosed may be re-disclosed by the recipient and no longer protected. Any form that has these elements is valid; the practice cannot insist on a notarized signature for an ordinary request.

Requesting a copy for yourself instead

Often the fastest route is to download what you can from the patient portal and request the rest for yourself, then share it with the new doctor. A right-of-access request only needs to be in writing (the practice may require its own form, but cannot use that to create unreasonable delay). The provider has 30 calendar days to respond, with one 30-day extension if it tells you why in writing. Fees for your own copy must be reasonable and cost-based. See accessing your medical records.

Common mistakes that cause delays

Recipient fax number or address missing or wrong.
Leaving the date range blank, so the office has to call you.
Forgetting imaging: a radiology report is not the images. Ask for DICOM files separately; see getting X-rays and MRIs sent.
Not ticking the box for sensitive categories you actually want sent.
Sending the form to the wrong department. Hospitals usually route it through "Health Information Management" (HIM) or a release-of-information vendor.
Not keeping a dated copy of what you sent.

Follow up

Call the receiving office a week later and ask whether the records arrived and are in your chart. If the sending office stalls, follow up in writing; the steps are in transferring medical records between providers.

Frequently asked questions

Do I need to sign a release for my old doctor to send records to my new doctor?

Not under HIPAA itself. HIPAA (45 CFR 164.506) lets one health care provider share your records with another provider for your treatment without your written authorization. Many offices still ask for a signed form because of office policy, state law, or because the records include specially protected information such as substance use treatment records, psychotherapy notes, or some state-protected HIV, genetic or mental health information.

What should I write on a medical records release form?

Name the sending provider and the recipient (name, address, fax or secure email), list the specific records and date range you want, state the purpose ("continuing care" or "at the request of the individual" is enough), choose a format (electronic or paper), give an expiration date or event, then sign and date it.

Is there an official national form to transfer medical records?

No. There is no single federal form. Each practice or health system usually has its own authorization or release-of-information form, often downloadable from its website. A HIPAA authorization is valid on any form as long as it contains the required elements, and a request for your own copy only has to be in writing.

Can a new doctor request my records from my old doctor without my permission?

HIPAA permits it when the purpose is your treatment, so a new treating provider can request records directly. In practice the sending office decides whether it will release without a signed form, and specially protected categories still need your consent.

Medical records release forms: what to write and when you need one