Form · Privacy
Release of information form (medical records request)
What it is, who uses it, and field-by-field help. Publisher: HHS rules (45 CFR 164.524 and 164.508). Links checked October 23, 2026.
Quick answer
"Release of information" covers two different requests. A patient asking for their own records uses the HIPAA right of access (45 CFR 164.524): the covered entity must act within 30 days, with one 30-day extension. Sending records to someone else, such as a lawyer or employer, needs a HIPAA authorization (45 CFR 164.508). Each provider has its own form; there is no single government form.
Run it in Rivvi
Get help with the 45 CFR 164.524
Ask RivviFree to start, no card. Opens Rivvi, the AI workspace for healthcare teams, with this question filled in.
At a glance
- Your own records
- Right of access, 45 CFR 164.524
- Deadline
- 30 days, one extension of up to 30 more with written notice
- Format
- The form and format you ask for, if readily producible; electronic copies of electronic records
- Records to a third party
- HIPAA authorization, 45 CFR 164.508
- Government form
- None. Providers use their own.
- Government form
- None published nationally; see the links below
Who uses it
- Patients and their personal representatives
- Health information management and release-of-information staff
- Attorneys, insurers, and employers receiving records with an authorization
What a records request usually asks
- Patient identification
- Name, date of birth, and other details the provider needs to find the records.
- Records requested
- Which records and dates (for example, visit notes and imaging from 2025).
- Format and delivery
- Paper or electronic, and where to send it. You may ask for the form and format you want if the provider can readily produce it.
- Recipient
- Yourself (right of access) or a named third party (needs an authorization).
- Signature and date
- Yours, or your personal representative's with their authority.
Related pages
Questions
How long does a provider have to send my records?
30 days after receiving the request. It may extend once by up to 30 more days if it tells you in writing why and when it will finish (45 CFR 164.524(b)(2)).
Is a release of information the same as a HIPAA authorization?
Not always. Asking for your own records is a right of access request. Sending records to someone else needs an authorization with the 164.508 elements.
Government sources
- Regulation45 CFR 164.524 (access of individuals)
- Regulation45 CFR 164.508 (authorizations)