Free HIPAA consent / release
form generator

Let a patient authorize the release of their health records the way HIPAA requires. This generator builds an Authorization for Release of Health Information with the core elements and statements set out in the HIPAA Privacy Rule (45 CFR §164.508). Preview it as you type, then download it as an editable Word document or PDF. Everything runs locally in your browser, so no data leaves your device and no sign-up is needed.

Authorization details

Patient

Who may release the information

Who may receive it

What information

Purpose

Expiration

Provide an expiration date or an event. Whichever you fill in appears on the form.

Preview

HIPAA AUTHORIZATION FOR RELEASE OF HEALTH INFORMATION

Patient: [Patient Name]

Date of birth: [Date of birth]

Authorization

I, [Patient Name], authorize [Provider or Organization] to release the health information described below to [Recipient Name].

Information to Be Released

The following health information may be released: [describe the records to be released, for example office visit notes from January to June 2026].

Purpose of Disclosure

The information is being released for the following purpose: [purpose of the disclosure, for example continuing care, personal use, or legal].

Expiration

This authorization expires on [expiration date or event].

Your Rights

I understand that I have the right to revoke this authorization at any time by submitting a written request to the organization named above that holds my records. Revoking it will stop any further release of my information, but it will not apply to information that was already released while this authorization was in effect.

I understand that the organization may not condition my treatment, payment, enrollment in a health plan, or eligibility for benefits on whether I sign this authorization, except where the law specifically allows it, such as research-related treatment or an evaluation performed solely to create records for a third party.

I understand that information released under this authorization may be redisclosed by the recipient and may then no longer be protected by federal privacy law.

Signature

Patient (or personal representative) signature: __________________________ Date: ________________

If signed by a personal representative, print name: __________________________

Relationship to patient and authority to act: __________________________

Generated by BlockSurvey

How the consent / release form generator works

1

Fill in the details

Enter the patient, who may release the records, who may receive them, the information to be shared, the purpose, and an expiration in a short guided form.

2

Review the live preview

Watch the authorization assemble in real time, with the HIPAA-required elements and statements written in plain language.

3

Download and sign

Export a ready-to-sign PDF or an editable Word file. Nothing you enter ever leaves your device.

Free, secure, and HIPAA-standard by default

Releasing records should not mean paying for a template or handing patient details to someone else's server. Every form this tool produces follows the authorization requirements of 45 CFR §164.508:

01

100% in-browser

The form is built on your device; nothing is uploaded.

02

No account required

No sign-up, no email wall, no tracking.

03

Free, real download

The complete form as Word or PDF at no cost, not a watermarked sample.

What a valid HIPAA authorization must include

Under 45 CFR §164.508(c), a valid authorization has to contain, in plain language:

  1. A specific and meaningful description of the information to be released.
  2. The name of the person or organization allowed to release the information.
  3. The name of the person or organization allowed to receive the information.
  4. The purpose of the requested disclosure.
  5. An expiration date or an expiration event that relates to the patient or the purpose.
  6. The patient's signature and the date, or the signature and authority of a personal representative.
  7. Three required statements: the right to revoke, whether treatment or payment can be conditioned on signing, and the risk that released information may be redisclosed.

Built For Every Healthcare Organization

Records move between providers, patients, attorneys, and insurers every day. This tool helps you capture clean, compliant permission before anything is shared, and it works alongside HIPAA-compliant survey software when you collect health data through forms.

Clinics sending records to specialists

Get written permission before you refer a patient and forward their chart.

Patients requesting their own records

Direct a copy of your records to a new doctor, family member, or app.

Attorneys & insurers

Collect a signed release before you request records for a claim or case.

Behavioral health practices

Handle the extra care that mental health and psychotherapy records require.

Dental & vision offices

Release imaging and treatment history to other providers on request.

Billing companies & MSOs

Authorize claims and payment records for the practices you support.

Collecting PHI through forms or surveys?

HIPAA-compliant survey software from BlockSurvey signs a BAA with you, so the tool you use to gather health data is covered too.

More free HIPAA tools

Explore more

Frequently asked questions

What is a HIPAA authorization for release of health information?

It is a written form a patient signs to let a provider share their protected health information with a specific person or organization. HIPAA generally requires this signed authorization before a covered entity discloses health records for anything other than treatment, payment, or routine health care operations. The form has to identify what information may be shared, who may share it, who may receive it, the purpose, an expiration date or event, and the patient's signature and date, under 45 CFR 164.508. This generator prompts you for each of those elements.

What is the difference between consent and authorization under HIPAA?

People use the terms loosely, but HIPAA treats them differently. Consent is a general, optional permission a provider may ask for to use your information for its own treatment, payment, and health care operations. Authorization is the specific, signed permission required before your information can be shared for other reasons, such as sending records to an attorney, an insurer, or a family member. This tool produces a HIPAA authorization, which is the form most record releases actually require. It is sometimes labeled a consent or release form in everyday use.

What has to be on the form for it to be valid?

HIPAA lists specific core elements. The form needs a specific description of the information to be released, the name of the person or organization allowed to release it, the name of the person or organization allowed to receive it, the purpose of the disclosure, an expiration date or event, and the patient's signature and date. It also has to include three statements: the right to revoke, whether treatment or payment can be conditioned on signing, and the possibility that released information may be redisclosed. Leaving out any of these can make the authorization invalid, so this generator includes all of them.

Can the patient cancel the authorization after signing?

Yes. A patient can revoke the authorization at any time by putting the request in writing to the organization holding the records. Revoking it stops future disclosures, but it does not undo any release that already happened while the authorization was in effect. The form generated here states this revocation right, as HIPAA requires, and points the patient to submit the request in writing.

Does the information stay protected once it is released?

Not always. Once information is disclosed to someone who is not a covered entity or business associate, such as a personal attorney or a life insurer, HIPAA may no longer protect it and the recipient could share it again. The form includes the required statement warning the patient about this so the permission is genuinely informed. Where mental health, substance use, HIV, or genetic information is involved, extra state and federal rules can apply, so review those before releasing that kind of record.

Is this a substitute for legal advice?

No. This tool generates a starting-point draft aligned with the authorization requirements of the HIPAA Privacy Rule (45 CFR 164.508), but it is not legal advice and is not guaranteed to be complete or suitable for your situation. State law and special categories of records, such as mental health or substance use records, can add requirements. Have the form reviewed by qualified legal counsel and tailored to your circumstances before you rely on it.

Do you store the information I enter?

No. The entire form is assembled locally in your browser. The patient names, record details, and recipients you enter are never sent to or stored on any server, which is why no sign-up is required.
Scripts are blocked. This site won’t work properly. If you’re using Brave, click the Shields icon and turn off Block scripts. Otherwise disable your ad blocker for this site.