An Arizona medical release form is the written authorization that lets a healthcare provider share your protected health information with someone outside your treatment, billing, and routine operations circle. Federal HIPAA rules require it before records go to an attorney, insurer, family member, or any other third party, and the form has to contain specific elements to be valid. Arizona layers on extra protection for mental health and substance use records, so the right form in the right situation is what gets your records moving.
What the Form Must Contain
A release form that is missing any required element is not legally valid, and a provider who relies on a defective authorization risks violating privacy rules. Federal regulations at 45 CFR 164.508 set both the core elements and the required statements every authorization has to include.1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
The Six Core Elements
- A specific, meaningful description of the records to be released, such as “all records from January 2025 through December 2025” or “lab results only.”
- The name or identification of the person or entity authorized to make the disclosure, typically the provider holding the records.
- The name or identification of the specific person or entity who will receive the information.
- A description of the purpose, such as “for a disability claim.” The phrase “at the request of the individual” is enough when you initiate the authorization yourself and prefer not to state a reason.
- An expiration date or event, such as “one year from signing” or “upon resolution of claim.”
- Your signature and the date. If a personal representative signs for you, the form must also describe that representative’s authority to act on your behalf.
The Three Required Statements
The form also has to carry three notices so you do not unknowingly waive your rights:
- A statement that you can revoke the authorization in writing at any time, with the exceptions to that right or a reference to the provider’s privacy notice where those exceptions are explained.
- A conditioning notice telling you whether the provider can refuse treatment or deny benefits if you decline to sign. In most situations, treatment cannot be conditioned on signing an authorization.
- A warning that once the recipient has your information, it may no longer be protected by federal privacy rules and could be shared again.
If a form you are handed is missing any of these pieces, flag it with the provider before you sign.
Who Can Sign the Release
The default signer is the patient, provided they are a competent adult aged 18 or older. When the patient cannot sign, a personal representative does. Under HIPAA, a personal representative has the same rights as the patient to authorize disclosure of records.2eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information
In Arizona, an agent holding a healthcare power of attorney under ARS 36-3221 can make healthcare decisions for the principal, which includes authorizing release of medical records. The power of attorney must be in writing, signed or marked by the principal, and either notarized or witnessed by at least one adult. The designated agent cannot also serve as the notary or witness.
For minor children, a parent or legal guardian signs the release in most situations. Arizona law carves out exceptions where the minor controls access to their own records.
When a Minor Signs Their Own Release
Arizona lets minors consent to certain treatments on their own, and that consent authority carries the right to control who sees those particular records:
- A minor of any age who may have contracted a sexually transmitted disease can consent to diagnosis and treatment without parental involvement, and controls release of those records.3Arizona Legislature. Arizona Code 44-132.01 – Capacity of Minor to Obtain Treatment for Venereal Disease Without Consent of Parent
- A minor aged 12 or older diagnosed as being under the influence of a dangerous drug or narcotic, including withdrawal, is treated as an emergency case and is considered to have consented to the necessary care without parental consent.4Arizona Legislature. Arizona Code 44-133.01 – Capacity of Minor to Consent to Treatment for Use of a Dangerous Drug or Narcotic
- Emancipated minors, married minors, and minor veterans have the legal capacity to contract and can sign for all of their own records. A minor aged 16 or older can petition an Arizona court for emancipation if they are a state resident and financially self-sufficient.5Arizona Legislature. Arizona Code 12-2451 – Petition for Emancipation Order; Requirements; Notification
A parent asking for records tied to a minor’s independently consented treatment can be legally denied access. If you are a minor in one of these categories, those specific records should not go to your parent without your permission.
Signing for a Deceased Patient
When a patient dies, the right to authorize disclosure passes to the executor or administrator of the estate, who HIPAA treats as a personal representative for the deceased patient’s health information.2eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information The representative’s access is limited to records relevant to their estate responsibilities. Providers typically ask for a court certificate showing the appointment. If no estate has been opened, expect the provider to require some written documentation of your relationship and authority; practices vary.
Submitting the Form and Timing
Deliver the completed, signed authorization to the medical records or privacy department of the provider holding the information. Most providers accept it in person, by mail, by fax, or through the patient portal. Some require an original signature or a verifiable copy, so check before submitting electronically.
Once the provider receives a valid authorization, federal rules give them 30 days to act on the request. They may take one 30-day extension, but only if they notify you in writing within the original 30-day window with the reason for the delay and a specific completion date.6eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information No second extension is allowed. Unreasonable delay beyond this window is grounds for a complaint.
Revoking an Authorization You Already Signed
You can cancel any authorization you signed, at any time, for any reason. The revocation must be in writing and directed to the provider that received the original authorization. It takes effect when the provider receives it, not when you send it.7U.S. Department of Health and Human Services. Can an Individual Revoke His or Her Authorization
Revocation does not undo disclosures that already happened. If the provider sent records to your attorney last week and you revoke today, that prior release stands. Going forward, the provider must stop any further release under the revoked authorization. If you signed through a third party such as an insurance company or law firm, send your revocation directly to the healthcare provider, not just to the third party.
Fees for Copies
Arizona law lets providers charge a reasonable fee for reproducing records, but ARS 12-2295 forbids a charge in three situations: records sent to another provider for continuing care, records given to the patient for the demonstrated purpose of obtaining healthcare, and records provided to the patient or their legal representative for appealing a denial of Social Security benefits.8Arizona Legislature. Arizona Code 12-2295 – Charges
For other requests, the statute allows “reasonable” fees but sets no per-page rate. When you request your own records directly as the patient, HIPAA also applies: under 45 CFR 164.524, the provider can only charge for the labor of copying, supplies, and postage if you want it mailed. Search and retrieval fees are prohibited for patient-directed requests.6eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Attorney-initiated and other third-party requests follow Arizona’s state fee rules. Providers can require payment in advance except when the records are needed for continuing care.
Mental Health and Substance Use Records Need More
Arizona treats mental health records held by healthcare entities as confidential and not public. Under ARS 36-509, they can only go to a defined list of recipients: providers involved in the patient’s care, persons authorized by the patient or their healthcare decision maker, persons authorized by court order, and researchers operating under applicable federal or state rules.9Arizona Legislature. Arizona Code 36-509 – Confidential Records; Immunity; Definition Family members and close friends sit in a nuanced spot: a provider can share with them if the patient agrees, has the opportunity to object and doesn’t, or if the provider reasonably infers based on professional judgment that the patient would not object. In an emergency or when the patient is incapacitated, the provider can disclose if it is in the patient’s best interests.
Substance use disorder treatment records carry a separate federal layer under 42 CFR Part 2. A 2024 final rule brought Part 2 closer to HIPAA, so patients can now provide a single consent covering all future uses and disclosures for treatment, payment, and healthcare operations rather than signing a new consent each time.10eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records Substance use counseling notes still require a separate, standalone consent and cannot be bundled with consent for other records. A substance use program in Arizona may present you with a Part 2-specific consent form in addition to or instead of the standard HIPAA authorization, and ARS 36-509 can add further restrictions on who may receive the records.
If You Think a Provider Released Records Without Your Permission
You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights within 180 days of the date you discovered the violation. The Secretary of HHS can waive that deadline for good cause.11U.S. Department of Health and Human Services. If I Believe That My Privacy Rights Have Been Violated, When Can I Submit a Complaint Complaints can be submitted electronically, by fax, or by mail. You can also file directly with the provider using the process described in their notice of privacy practices.