Show Summary Details
Page of

(p. 661) Elements of Authorization Forms to Release or Request Client’s Records 

(p. 661) Elements of Authorization Forms to Release or Request Client’s Records
(p. 661) Elements of Authorization Forms to Release or Request Client’s Records

Edward Zuckerman

Page of

Subscriber: null; date: 12 December 2018

The contents and formats of releases of information (also called authorizations, requests for records, releases) are based on federal and state statutes and laws like the Health Insurance Portability and Accountability Act (HIPAA), ethical codes of the helping professions, regulations and decisions of licensing boards, and local case law (court decisions) about privacy and consent. Each psychologist should construct a release of information (ROI) from the topics listed here tailored to location, clientele, and purposes. In choosing the exact wording, bear these factors in mind:

  • Client’s reading skill. Online resources can estimate the educational levels required to understand office forms.

  • “Plain English.” That is required by statue and our ethics, as is making available translations.

  • Choices of party. Do you want to speak as “Dr. Smith” or “I/we” or “The Smith Clinic”? Do you address “clients” or “you or your child”?

Elements of a Release of Information

To be legally valid, an ROI must address all of the following topics:

  1. 1. An accurately informative title such as “Patient Authorization for Use and Disclosure of Protected Health Information.” These are the HIPAA terms. What is done with the PHI (Protected Health Information) in your office is “use”; releasing it to other organizations or covered entities is “disclosure.”

  2. 2. Identifying information about the client:

    Complete name:

    Other names such as aliases and maiden names:

    Because names are not unique it is advisable to also ask for birthdate and Social Security number.


    Current and complete address:

    Parent/guardian (where applicable) and address of parent/guardian:

  3. 3. The specific intended recipient of the records.

    Name, position, affiliation, function.

    Full address:

    Telephone and fax numbers are advantageous.

    If the requester is unfamiliar or the purposes of the ROI are unclear, then “verify the requester’s identity and official capacity” before proceeding (Stromberg et al., 1988, p. 394).

  4. 4. The source of the records, either the name or general designation of the program.

    If you are the one to release the records, then provide your identifying information and address here or by referring to your letterhead. (p. 662)

    If you will charge for sending records, show your federal tax identification number or Social Security number or you will waste a lot of time on the phone when requesters want to pay you.

  5. 5. The desired interchange, which can be indicated in several ways. One way is a simple format arranging the above as “From” the source or releaser and “To” the recipient of the records. Another way is to provide a single space and precede it by text such as “By signing, I authorize the practice listed on this letterhead to use and/or disclose the indicated protected health information to ____” or [] Obtain from: [] Release to:

  6. 5. The purpose of the request. Why is this information sought and exactly how will it be used? A variety of purposes are listed from which a checklist can be constructed.

    The information will be used or disclosed for the following purpose(s):

    [] Continuation/Coordination of care or treatment/Changing or adding providers

    [] Consultation

    [] Disability certification

    [] Insurance claim/Application

    [] Attorney inquiry/Legal matter

    [] Other: (specify):

    If disclosure is requested by the patient, the purpose may be listed as “at the request of the individual.” A possibly protective addition is: “In consideration of this consent, I hereby release the source of the records from any and all liability arising therefrom.”

  7. 6. The contents or nature of the information to be disclosed. I recommend the following language: “I hereby authorize the source named above to send, as promptly as possible, the records marked by an X in the boxes below. The items not to be released have a line drawn through them. Page numbers are indicated where appropriate.”

    [] Inpatient or outpatient treatment records for physical and/or psychological, psychiatric, or emotional illness or drug or alcohol abuse with date(s) of admission/treatment.

    Admission and discharge summaries. Treatment recommendations and plans, recovery plans, aftercare plans.

    [] Psychological evaluation(s) or testing records, and behavioral observations or checklists completed by any staff member or by the patient.

    Psychological/Educational/Achievement/Vocational and other test results.

    Academic or educational records.

    Reports of teachers’ observations.

    [] Psychiatric evaluations, reports, or treatment notes and summaries.

    [] Social histories, assessments with diagnoses, prognoses, recommendations, and all similar documents.

    Developmental history.

    [] Information about how the patient’s condition affects or has affected his or her ability to complete tasks, activities of daily living, or ability to work.

    Workshop reports and other vocational evaluations and reports.

    Case management records.

    A release that authorizes you to “release and disclose all information and to discuss anything pertaining to this client and the client’s progress” appears to be illegally vague and broad, and may be prohibited by HIPAA regulations concerning the “minimal necessary” disclosure rules (see Section 164.502 of the HIPAA Act).

    Some information is considered more sensitive and requires a more specific release. Consider adding: “HIV-related information and drug and alcohol information contained in these records will be released under this consent unless indicated here: _ [] Do not release.”

    When the records are extensive they can be limited with this: “Dates of treatment covered by this release: [] All prior episodes of care. Limited to the following dates/programs: ____

    For ease of communication, this caveat can be added: “I authorize the source and recipient named above to speak by telephone about history, diagnoses, treatment and similar information.”

  8. 7. When, how, or on what condition upon which the consent will expire if not revoked earlier. ROIs must give enough time to allow for verifying the validity of the request and processing the paperwork. Sixty days is common but, if HIPAA applies, a 30-day extension can be sought. Alternately: “It shall be valid no longer than is reasonably necessary to meet the purposes stated above, and not (p. 663) to exceed 1 year.” ROIs must have time limits because records may change over time as new information is added and so they should be re-requested.

    Ethical and legal principles do not permit withholding records needed for immediate or emergency care or as required by law solely because payment for them or previous services has not been made.

  9. 8. The client must be told of his or her right to revoke, in writing, an ROI. Describe the means for doing so and the exceptions to such revocation. “I hereby revoke this consent effective ________. I understand that this revocation has no effect on information released prior to the date of this revocation.”

  10. 9. Electronic records have risks of loss of confidentiality different from those of paper records. If you plan to use electronic records, then you might include this language: “The designated information about me/my child [] may [] may not be transmitted by fax, electronic mail, or other electronic file transfer mechanisms.”

  11. 10. Who may see these records. HIPAA allows sharing of PHI among all treaters and consultants without any release (beyond the consent signed with the NPP), but state laws are usually more restrictive. Thus, clarify who has access and, if any might cause difficulties, get an ROI signed.

    Re-disclosure is a foreseeable risk and must also be addressed. Consider adding: “Although applicable law may prohibit re-disclosure of these records, I understand that if the person or organization that receives this information is not a health care provider or health insurer the information may no longer be protected by federal or state privacy regulations.” Also consider adding that “Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse client.”

  12. 11. A statement that the client does not have to agree to and sign the authorization. This HIPAA rule is designed to prevent nontreating covered entities (CEs), such as insurers, from requiring (“conditioning”) the release to them of more information than is present in the routine progress notes (“the Clinical Record” in HIPAA terms) before they agree to pay for services.

    Presumably all clients would agree to your use of their PHI. You can, of course, treat them without their agreement to release your records to someone else. However, caution suggests that you not treat a client who denies you access to get others’ records, for both therapeutic and risk management reasons. “I understand that I do not have to sign this authorization in order to receive treatment from this practice. In fact, I have the right to refuse to sign this authorization.”

  13. 12. An indication that you will be paid directly or indirectly for this release, if that is true. This pertains to the marketing restrictions created by HIPAA and rarely if ever applies to psychotherapists. “This office [] will [] will not receive payment or other remuneration from a third party in exchange for using or disclosing the/your PHI.”

  14. 13. The fact that you will change a reasonable fee when releasing records. “This office charges for the cost of retrieving, reproducing, and mailing records, according to the amounts allowed by law, and payment is required before releasing the records.”

  15. 14. Clients have the right, under HIPAA, to access their records. HIPAA does not define “access” but indicates that any mutually agreeable format is acceptable so reading them, having them read, perusing, or obtaining a copy is possible. “I have had access to my records and am satisfied that I know what they contain.”

  16. 15. How the information in the records can be corrected or amended. Along with access comes the right to correct errors and make qualifications of what is contained in your records and to have those changes accompany the records. Consider using the language, “I have reviewed the contents of my records and have made written amendments to them which will be included in the records whenever they are released after this time.”

  17. 16. Clients have the right to a copy of their records. “I understand that I have the right (granted by HIPAA) to inspect and copy any of the information I request/authorize for release.” (p. 664)

  18. 17. Clients have the right to a copy of the ROI. Make two copies of the ROI: one for the client if he or she wants it and, if not, keep that in your files and one for your own files. The original goes to the source of the records requested. When releasing records, make a single copy for the client, if accepted. “I understand that I have the right to receive a copy of this form upon my request.”

  19. 18. The ROI must be consensual: informed, voluntary, and executed by a competent client.

    For fuller comprehension, your release-of-records form should be available for the client to read; anything the client does not understand must be explained at his or her level of comprehension, and in his or her native language if necessary. “I affirm that everything in this form that was not clear to me has been explained.”

    This may seem obvious, but the client must believe that it is in his or her long-term best interest to release the records. Voluntary consent requires attending to and explaining what decision(s) will be based on it and what repercussions would follow from granting or withholding permission. You can then add, “This clinician and I have explored the likely consequences of waiving the privilege of confidentiality about these records. The information to be obtained or disclosed was fully explained to me and this consent is given on my own free will.”

    As to competency, consider adding a statement like “I, a licensed psychologist, have discussed the issues above with the patient and/or his or her parent or guardian. My observations of behavior and responses give me no reason to believe that this person is not fully competent to give informed and willing consent.” Then provide space for signature of the psychologist, printed name of the psychologist, and date.

  20. 19. Signatures. A signature is not consent but the public acknowledgement of consent. In the simplest case, the signature of the client, the printed name of the client, and the date will suffice.

    Because records change, the patient’s signature must usually be given within 90 days of the time an ROI is received, but local legal and professional contexts may alter this.

    Substitute or surrogate consent is required for a minor, for someone adjudicated incompetent, or for a dead person. In one of those instances, add:

    Signature of parent/ Printed name Relationship Date

     guardian/legal representative/judge

    In family therapy, the “family” or “couple” cannot have legal confidentiality; only individual members have this privilege. Thus, you will have to clarify and negotiate rules for release with each adult family member. Ideally, you have specified in your introductory materials that all members must sign a release.

    If there is joint legal custody, then either parent can have access to the records.

    When the client consents (perhaps orally) but cannot create a legitimate signature, witnessing is required. “I witnessed that this client understood the nature of this ROI and freely gave his or her consent, but was physically unable to provide a signature.”

  21. 20. Do not comply with a request to release your records if the release form sent to you is faulty, such as missing some of the necessary contents listed earlier. Should there be a legal, ethical, or clinical problem, responsibility cannot be assigned to the requesting party.

    Finally. many health care practitioners provide a cover letter accompanying a request or release of information. Many topics can and probably should be addressed in such a letter. For example, the letter could include the cost for collecting, copying, and mailing the records and how and to whom this is to be paid. Perhaps add a certifying note that the records released are copies of the entire clinic record or all records requested, or that no records were found or that the records are incomplete and will be forwarded when complete.

References and Readings

Stromberg, C. D. (1988). The psychologist’s legal handbook. Washington, DC: National Register of Health Service Providers in Psychology. (p. 665) Find this resource:

    Zuckerman, E. (2008). The paper office (4th ed.). New York: Guilford Press.Find this resource:

      The educational level required and reading difficulty of your documents can be assessed at anyof these sites: /,

      Related Topics

      Chapter 107, “Dealing with Subpoenas”

      Chapter 128, “Understanding Fundamentals of the HIPAA Privacy Rule”