HIPAA medical & gynecology records release authorization form

01What makes a HIPAA authorization valid

A HIPAA authorization is valid only when it contains every element listed in 45 CFR § 164.508(c). If one is missing, the regulation calls the authorization defective under § 164.508(b)(2), and the records office is not allowed to rely on it. The same is true once the expiration date has passed, if you have revoked it, or if information on it is known to be false. Most rejected requests fail on one of these points, so the generator prints each element with its label.

The six core elements of § 164.508(c)(1):

1. What will be released — described in a specific and meaningful way, such as “Pap and HPV results, 2018 to today”, not “all my stuff”.
2. Who may disclose — the clinic, hospital or lab that holds the records.
3. Who may receive — your new clinic or physician, or you.
4. The purpose — “continuity of care” works; when you start the request yourself, “at the request of the individual” is enough.
5. An expiration date or event — this generator defaults to 180 days from today and never prints it blank.
6. Your signature and the date — and, if a personal representative signs, a description of their authority to act for you.

The three required statements of § 164.508(c)(2) tell you that you can revoke the authorization in writing (and how, or where the exceptions are explained), that the provider generally cannot condition your treatment, payment, enrollment or eligibility for benefits on signing, and that information released may be redisclosed by the recipient and may no longer be protected by the federal privacy rule. The rule also requires plain language and that you receive a copy of the signed form, which is why both appear on the printed sheet.

02Which gynecology records to ask for so you don’t repeat tests

When you change gynecologists, the most expensive gap is not the visit note. It is the results and reports that decide what you need next. Ask for these by name:

• Pap, HPV and colposcopy history. Screening intervals depend on your previous results and their dates. Without them, a new clinic may repeat co-testing early or miss a follow-up that is due.
• Pelvic and transvaginal ultrasound, sonohysterogram (SIS) or pelvic MRI reports. Fibroid size and position, endometrial thickness and ovarian findings are compared over time, so earlier measurements matter.
• Mammogram and DEXA reports. Radiologists compare against prior studies; bone density trends guide decisions about hormone therapy and bone protection.
• Lab results. Past estradiol, FSH, thyroid, ferritin, lipid and A1c values show a trend that one new draw cannot. If you are planning new testing, the hormone & lab panel builder shows which tests usually go through insurance and which are cash-pay, so you only reorder what is missing.
• Operative and pathology reports. For endometriosis or fibroids, the operative note and pathology describe what was found and removed. The endometriosis care guide explains why surgical findings shape the plan afterwards.
• Visit notes and medication history. Useful when you are mid-treatment, for example on hormone therapy.

The first four categories are ticked by default because they are the ones most often re-ordered. Records travel faster when you bring your own summary too: the menopause symptom scorecard and the cycle, ovulation & pelvic pain log give a new clinician in one page what the chart takes an hour to show.

03Sensitive records, initials and what this form does not cover

Some records carry extra protection. Many records departments, and some state laws, want you to give specific written permission for categories such as reproductive and sexual health, sexually transmitted infection and HIV results, genetic testing, and mental or behavioral health. If they are not clearly authorized, the office may hold those pages back or return your request. The generator lists these categories with a tick box and an initials space for each. Tick only what you want released, then initial each one by hand when you sign.

Two kinds of records follow separate rules:

• Psychotherapy notes. A therapist’s separate session notes need their own authorization under § 164.508(a)(2) and cannot be bundled into a general records release. Your ordinary mental health treatment records, diagnoses and medication history are different and can be covered here.
• Substance use disorder treatment records from a federally assisted program are also protected by 42 CFR Part 2, which has its own consent requirements. The program may ask you to sign its own consent.

State rules on sensitive categories differ, and this page does not try to list them. If a records office tells you a state form is required for a category, use theirs for that category and this authorization for the rest. If you leave every sensitive box unticked, the office may still send your general gynecology records but leave out pages in those categories, so check the packet when it arrives and ask about anything missing.

04Sending records to yourself: authorization or right of access

If you want your own records sent to you, you also have a separate HIPAA right of access under 45 CFR § 164.524. Under that rule the provider generally has 30 days to act on your request, with one 30-day extension if it tells you in writing, and may charge only a reasonable, cost-based fee for copies. Many offices accept a signed authorization like this one as the request, and the generator has a release directly to me option with portal, encrypted email, mail or pick-up delivery.

When the records go straight to a new clinician, the authorization is the usual route. Either way, ask the records office three questions when you send it:

1. Do you accept this form, or do you need yours as well? Hospitals sometimes require their own form. Send theirs with this one attached as a cover sheet listing exactly what you want.
2. How will images be sent? Mammograms and ultrasounds are often sent on a portal link or disc, separately from the written reports.
3. When should I expect them? Write the date down and follow up if nothing arrives. Send the request two to three weeks before your first visit with a new clinician, so the chart is there when you are.

If you are leaving a membership or concierge practice, read the records clause in its agreement before you cancel. The membership agreement questions page covers what to check, including how and when records are released after you leave.

05How to use this generator in five minutes

1. Fill in your details, including any former or maiden name the records may be filed under.
2. Name the office that holds the records, with its fax number. Call ahead to confirm the medical records fax or portal upload.
3. Choose the recipient: your new clinic, or yourself. If you are still choosing who to transfer to, the integrative gynecologist vs functional medicine doctor vs naturopath comparison explains who can order and interpret which tests.
4. Tick the records and dates, then any sensitive categories you want included.
5. Check the purpose and expiration. The tool warns you if the date is in the past or missing, or if a representative signs without describing their authority.
6. Print, sign, date and initial, keep a copy for yourself, and send it. You can revoke it later in writing.

When the records arrive, open them before your visit. Check that the reports cover the dates you asked for, that imaging reports are attached and not just listed, and that operative and pathology reports are both there. If something is missing, call the same office and refer to your signed request rather than starting a new one.

Prefer to write by hand? Click Clear All Fields and print: every field prints as a clean blank line, with the expiration defaulting to 180 days. This is a private plain-language template, not an official government form, and it cannot guarantee that every office will accept it.

This page is educational and is not medical or legal advice; for questions about a specific request, ask the records office or a privacy attorney.