On this page
A HIPAA release form is the written authorization a patient signs so a provider or health plan can use or share their health information for a purpose the Privacy Rule doesn't already allow, such as a disclosure to a life insurer or an employer (HHS). HIPAA calls it an authorization, and 45 CFR 164.508(c) lists what it must contain: a specific description of the information, who may disclose it, who will receive it, the purpose, an expiration date or event, the patient's signature and date, and three required statements. Curve Compliance, which helps healthcare marketers keep protected health information (PHI) out of ad platforms, checked each rule on eCFR and HHS on November 2, 2026.
Book a call. A release form covers the uses and disclosures a patient agrees to. Curve Compliance replaces browser ad pixels with one script, sends conversions server-side and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What a HIPAA release form is and when you need one
The Privacy Rule starts from a default. Unless another part of the rule permits or requires it, a covered entity “may not use or disclose protected health information without an authorization that is valid under this section” (45 CFR 164.508(a)(1)). HHS states the same rule from the other side: “A covered entity must obtain the individual's written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule.” Its examples include “disclosures to a life insurer for coverage purposes, disclosures to an employer of the results of a pre-employment physical or lab test, or disclosures to a pharmaceutical firm for their own marketing purposes” (HHS).
Many everyday disclosures need no release form: HHS lists treatment, payment, sharing with family or friends involved in your care unless you object, public health reporting and required reports to the police (HHS). A patient asking for their own records doesn't sign one either. That is the right of access in 45 CFR 164.524, and the rule requires a covered entity to disclose PHI to an individual who requests it under that section (45 CFR 164.502(a)(2)).
Release form, authorization and consent: the differences
People use release form, authorization and consent as if they were one document. Under HIPAA they are different things:
| Document | What it does | Required? | Rule |
|---|---|---|---|
| Release form (HIPAA authorization) | Permits a use or disclosure the rule doesn't otherwise allow, to the recipient it names | Yes, for those uses and disclosures | 45 CFR 164.508 |
| Consent | Permission to use and disclose PHI for treatment, payment and health care operations | No. It is optional, and HHS leaves its content to the covered entity | 45 CFR 164.506(b); HHS FAQ |
| Notice of privacy practices acknowledgment | The patient confirms they received the notice | Providers with a direct treatment relationship make a good faith effort to get it | 45 CFR 164.520(c)(2)(ii) |
| Request for your own records | The patient asks for a copy of their own records | No authorization; the right of access applies | 45 CFR 164.524 |
HHS draws the line plainly: “Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization” (HHS). See the HIPAA consent form and notice of privacy practices guides.
The required elements: a template checklist
Use this as the outline for a release form. Every row comes from 45 CFR 164.508, which lets you add more, as long as the extra elements are “not inconsistent with the elements required by this section” (45 CFR 164.508(b)(1)(ii)).
| Section of the form | What it must say | Rule |
|---|---|---|
| What will be shared | A description that identifies the information “in a specific and meaningful fashion” | 164.508(c)(1)(i) |
| Who may share it | The name or other specific identification of the person or class of persons authorized to make the disclosure | 164.508(c)(1)(ii) |
| Who will receive it | The name or other specific identification of the person or class of persons who will receive it | 164.508(c)(1)(iii) |
| Why | A description of each purpose. The statement “at the request of the individual” is enough when the patient starts the request and does not give a purpose | 164.508(c)(1)(iv) |
| When it ends | An expiration date, or an expiration event that relates to the patient or the purpose | 164.508(c)(1)(v) |
| Signature | The patient's signature and date. If a personal representative signs, a description of their authority to act for the patient | 164.508(c)(1)(vi) |
| Right to revoke | The right to revoke in writing, with the exceptions and how to revoke, or a reference to the notice of privacy practices if the notice explains them | 164.508(c)(2)(i) |
| Conditioning | That treatment, payment, enrollment or eligibility for benefits can't depend on signing or, where the rule allows conditioning, what happens if the patient refuses | 164.508(c)(2)(ii) |
| Redisclosure | That the recipient may redisclose the information, and it may then no longer be protected by the Privacy Rule | 164.508(c)(2)(iii) |
| Language | Plain language throughout | 164.508(c)(3) |
| Copy | A copy of the signed form for the patient, when the covered entity asked for the authorization | 164.508(c)(4) |
| Third-party payment | For marketing that involves financial remuneration, a statement that remuneration is involved. For a sale of PHI, a statement that the disclosure will result in remuneration | 164.508(a)(3)(ii) and (a)(4)(ii) |
HIPAA does not override a state privacy law that is more stringent (45 CFR 160.203(b)), so state rules can add to this list for some records. Which state rules apply to your forms is a question to talk to your counsel about. When the patient has died, the personal representative signs; see does HIPAA apply after death.
The required statements, in plain words
Revocation: “An individual may revoke an authorization provided under this section at any time, provided that the revocation is in writing,” except where the covered entity already acted in reliance on it or, for an authorization obtained as a condition of getting insurance, other law lets the insurer contest a claim (45 CFR 164.508(b)(5)). Conditioning: a covered entity may not make treatment, payment, enrollment or eligibility depend on signing, apart from research-related treatment, some health plan enrollment decisions and care given only to create information for a third party (45 CFR 164.508(b)(4)). Redisclosure: once a recipient HIPAA doesn't cover has the information, the Privacy Rule may no longer protect it.
Release forms for marketing
Marketing has its own rule. A covered entity “must obtain an authorization for any use or disclosure of protected health information for marketing,” except for a face-to-face communication or a promotional gift of nominal value (45 CFR 164.508(a)(3)). The rule defines marketing as “a communication about a product or service that encourages recipients of the communication to purchase or use the product or service,” and carves out refill reminders, where any payment for sending them is reasonably related to the cost, and communications about the covered entity's own health-related services that no third party pays it to make (45 CFR 164.501).
This is where websites come in. HHS's tracking bulletin says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures.” It adds that cookie banners “do not constitute a valid HIPAA authorization” (HHS). The same page notes that a federal court vacated part of the bulletin on June 20, 2024: the part about IP addresses on unauthenticated public pages about health conditions or providers. A signed release covers only the disclosure it describes, to the recipient it names; a pixel sending page visits to an ad platform is a separate disclosure. See HIPAA marketing authorization and ad tracking.
Book a call. Want to know what your site sends to Meta, Google and TikTok today? Curve's team reviews it with you, shows what's likely triggering a flag, and sets up server-side conversions that strip PHI before data reaches an ad platform. Book a call with Curve.
Mistakes that make a release invalid
The rule lists five defects that make an authorization invalid (45 CFR 164.508(b)(2)):
- The expiration date has passed, or the covered entity knows the expiration event has happened.
- A required element is not filled in completely.
- The covered entity knows the patient revoked it.
- It breaks the rules on compound authorizations or on conditioning.
- The covered entity knows that material information in it is false.
The compound rule shapes intake paperwork: an authorization “may not be combined with any other document to create a compound authorization,” apart from listed exceptions such as research (45 CFR 164.508(b)(3)), so a release tucked into a consent form or a new-patient packet can fail. For how disclosures are judged more broadly, see PHI disclosure rules.
Keeping signed releases: the six-year rule
A covered entity “must document and retain any signed authorization under this section as required by § 164.530(j)” (45 CFR 164.508(b)(6)). That section sets the period: “six years from the date of its creation or the date when it last was in effect, whichever is later” (45 CFR 164.530(j)(2)). See HIPAA document retention.
How Curve Compliance helps
Curve Compliance works on the marketing side. Ad tracking can send data to a vendor every time a page loads, and HHS's bulletin says the HIPAA Rules apply when that data includes PHI (HHS). Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok.
Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry), and Curve's team does the setup, typically live in about a week. Start with Curve's free website scan to see which pixels and trackers your pages load.
Sources, checked November 2, 2026: 45 CFR 164.508; 45 CFR 164.501; 45 CFR 164.502; 45 CFR 164.506; 45 CFR 164.510; 45 CFR 164.520; 45 CFR 164.524; 45 CFR 164.530; 45 CFR 160.203; HHS, Summary of the HIPAA Privacy Rule; HHS, consent vs authorization; HHS, Your Rights Under HIPAA; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What is a HIPAA release form?
It is the written authorization a patient signs so a covered entity can use or share their health information for a purpose the Privacy Rule doesn't otherwise allow. It must contain the core elements and statements in 45 CFR 164.508(c).
Who can access my medical records without my permission?
Your providers and health plan, for treatment, payment and their operations, plus family or friends involved in your care unless you object, and listed purposes such as public health (HHS). Without your authorization, HHS says your provider generally cannot give your information to your employer or use it for marketing or advertising.
Is a HIPAA release form the same as an authorization?
Yes. Release form is the everyday name; the rule calls it an authorization and sets its contents in 45 CFR 164.508. A consent form is different: it covers treatment, payment and health care operations, and it is optional (45 CFR 164.506(b)).
How long is a HIPAA release form valid?
Until the expiration date or event written on it, unless the patient revokes it in writing first (45 CFR 164.508(c)(1)(v) and (b)(5)). The rule requires an expiration date or event, though “none” is enough for research, and it does not set a maximum length.
Do I need a release form to share information with family?
Not when the family member is involved in the patient's care or payment for care. A covered entity may share the information directly relevant to that involvement if the patient agrees, or doesn't object when given the chance (45 CFR 164.510(b)).
How long must a signed release be kept?
Six years from the date it was created or the date it was last in effect, whichever is later (45 CFR 164.530(j)(2)).
Can a patient revoke a HIPAA release form?
Yes, at any time, in writing. The revocation doesn't undo action the covered entity already took in reliance on the form, and authorizations obtained as a condition of insurance coverage have a further exception (45 CFR 164.508(b)(5)).
Talk to Curve Compliance
Book a call. Release forms handle the disclosures your team makes on purpose. Curve Compliance handles what your website sends to ad platforms: it strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Book a call with Curve.