How to Complete and Submit a Washington State Release of Information Form

A Washington State release of information form authorizes a healthcare provider to share your medical records with a person or organization you name. The state Health Care Authority publishes a standard version, Form HCA 80-020, that you can download from its website, and most hospitals and clinics also offer their own templates through patient portals or the front desk.¹ Whichever version you use, it must contain every element listed in RCW 70.02.030 or the provider will reject it. Once the provider has a valid form, they have 15 working days to deliver the records or explain the delay.

What the Form Must Contain to Be Valid

Washington law lists specific items every authorization must include in writing. Miss one and the provider has grounds to refuse the request. Under RCW 70.02.030, your form must have all of the following:²

Enough information to identify you as the patient. Most forms ask for your full legal name and date of birth; the statute simply requires that the authorization identify the patient.
The name of the provider or facility that currently holds the records.
The name or clear identification of whoever will receive the records: another doctor, an attorney, an insurance company, or yourself.
A brief reason for the disclosure, such as “continuity of care” or “personal injury claim.”
A description of the records to be shared. “All records” is allowed, but narrowing the request to a date range or treatment type (“orthopedic office notes from January through June 2025”) speeds processing and lowers copying costs.
An expiration date or expiration event, such as “conclusion of my legal case.”
A statement that you can revoke the authorization at any time, except where the provider has already acted on it.
Your signature and the date. If someone else is signing on your behalf, the form must describe their legal authority to do so.

One point worth flagging, because it circulates online in the wrong form: an authorization without an expiration date does not default to 90 days. RCW 70.02.030 makes the expiration date or event a condition of validity, and there is no statutory fallback.² Leave that line blank and the provider can reject the whole form. A separate rule applies to authorizations sending records to a financial institution or employer for non-payment purposes; those expire automatically one year after signing whether you write in a date or not.

Extra Consent for Sensitive Records

Standard records — visit notes, labs, imaging — move under a general authorization. But Washington treats three categories differently and requires explicit, separate consent before a provider can include them. Sign the bottom of the form and skip these sections and the provider must redact the protected information before sending anything.

Mental Health Records

Records related to mental health services carry heightened protection under RCW 70.02.230, which restricts who can receive the information and gives patients a private right of action for wrongful disclosure. Damages are the greater of $1,000 or three times actual damages, plus attorney fees.³ Most release forms have a separate checkbox or initial line for mental health records. Check it only if you affirmatively want those records shared.

Sexually Transmitted Disease and HIV Records

RCW 70.02.220 bars anyone from disclosing, or being compelled to disclose, the identity of a person tested or treated for a sexually transmitted disease, except through narrow exceptions such as public health reporting or a court order.⁴ Forms include a dedicated line for this category. Initialing it opts you in; leaving it blank keeps those records sealed.

Substance Use Disorder Records

Alcohol and drug treatment records carry federal protection under 42 CFR Part 2 in addition to state law.⁵ A 2024 final rule now lets a single patient consent cover future uses for treatment, payment, and health care operations, and HIPAA-covered recipients can re-disclose in line with HIPAA rules.⁶ Even so, these records still cannot be used in legal proceedings against you without your specific consent or a court order. Your form must include a separate acknowledgment for substance use records, and many Washington providers use a standalone Part 2 consent rather than folding it into the general release.

How to Submit the Form

Once the form is filled out and signed, deliver it to the provider that holds the records. Three routes are standard.

Online Patient Portals

Most Washington hospital systems, including those on MyChart and similar platforms, let you upload a scanned or photographed copy through a secure portal. Digital submissions reach the health information management department immediately and usually generate a confirmation receipt. This is the fastest route for non-urgent requests.

Mail

Address the envelope to the medical records or health information management office at the specific facility, not the general clinic address. Some recipients, particularly courts and certain insurance carriers, require an original ink signature rather than a photocopy; if that applies, mail is the only option. Certified mail with return receipt gives you proof of the date the processing clock starts.

Fax

Fax is still common for time-sensitive requests between professional offices, like an attorney sending a form on a litigation deadline. Call the records department for the correct fax number; it is almost never the main clinic line. Follow up by phone the same day to confirm the fax arrived legibly. An illegible fax sitting in a tray for a week does not start your 15-day clock.

How Long the Provider Has to Respond

Under RCW 70.02.080, a provider must respond within 15 working days of receiving a valid written request. Responding does not necessarily mean handing over the records. The provider meets the statute by doing any of the following within that window:⁷

Making the records available for review or sending copies to the designated recipient.
Notifying you in writing of a delay, with the reason and a commitment to a date no later than 21 working days from the original request.
Telling you the records don’t exist or are held elsewhere, and, if possible, pointing you to the right place.
Denying access under RCW 70.02.090. Grounds include situations where disclosure could reasonably be expected to endanger your life or physical safety, or where records contain information provided by someone other than a healthcare provider under a promise of confidentiality.

If a provider passes the 21-working-day outer limit without any explanation, you can file a complaint with the Washington State Department of Health, or contact an attorney if the records tie to a pending legal or insurance matter.

What Copies Cost

Washington caps what providers can charge for record duplication under WAC 246-08-400, and the Secretary of Health periodically adjusts the rates. As of the most recent adjustment reflected in state legislative records:⁸

Clerical fee for searching and handling: up to $28.
First 30 pages: $1.24 per page.
Pages beyond 30: $0.94 per page.
Confidential editing, when the provider must personally redact information you did not authorize: the equivalent of a basic office visit for that labor.

These rates apply to paper copies sent to third parties like attorneys or insurance companies. Providers generally do not charge when records go directly to another healthcare provider for continuity of care. If you request your own records in electronic format, federal law sets a flat cap of no more than $6.50 per request, covering all labor, supplies, and postage.⁹ If a provider tries to charge more than that for your own electronic records, point them to the HHS guidance on HIPAA’s right-of-access fee limits.

Payment is typically required before the facility releases the documents. Records requested for a Social Security disability appeal must be provided free to the patient under Washington law.²

Signing for a Minor or Deceased Patient

Minor Patients

A parent is generally the personal representative of an unemancipated minor and can sign the release on the child’s behalf.¹⁰ Washington carves out exceptions. When a minor consents to care independently, which the state permits for reproductive health, mental health, and sexually transmitted disease treatment among others, the parent is not the personal representative for those specific records. A provider can also block parental access if, in their professional judgment, they believe the minor has been or may be subject to abuse or neglect.

Deceased Patients

An executor or personal representative of the estate steps into the patient’s shoes for record access. Bring the facility proof of death (usually a death certificate), documentation of your authority such as letters testamentary or a court appointment, and a written request or completed authorization form.¹¹ The provider will verify these documents before releasing anything. Access mirrors the rights the patient had while alive, limited to what your legal responsibilities require: administering the estate, pursuing a wrongful death claim, or handling insurance.

Revoking an Authorization

You can cancel a release at any time by submitting a written revocation to the provider. Under RCW 70.02.040, the revocation takes effect when the provider receives it, but it does not undo disclosures the provider already made in good-faith reliance on the original authorization.¹² You also cannot revoke an authorization the provider still needs to process payment for care already given.

No special form is required. A signed letter clearly identifying the authorization you want to revoke is enough. Send it the same way you sent the original (portal, mail, or fax) and keep a copy. If you are worried about ongoing disclosures, call the records department to confirm receipt rather than waiting for a written response.

If Records Go Out Without Your Consent

Your remedy depends on the record type. For mental health records released in violation of RCW 70.02.230, you can sue the person who disclosed the information and recover the greater of $1,000 or three times your actual damages, plus attorney fees.³ You do not have to prove a specific financial loss; the statute allows recovery for general damages.

For other record types, federal HIPAA rules do not give you a direct right to sue the provider. You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, which investigates HIPAA violations and can impose civil penalties.

1
Washington State Health Care Authority. Authorization for Release of Information Form (80-020)
2
Washington State Legislature. RCW 70.02.030 – Patient Authorization of Disclosure
3
Washington State Legislature. RCW 70.02.230 – Mental Health Services, Confidentiality
4
Washington State Legislature. RCW 70.02.220 – Sexually Transmitted Diseases, Permitted and Mandatory Disclosures
5
Washington State Legislature. RCW 70.02.250 – Substance Use Disorder Records
6
U.S. Department of Health and Human Services. Fact Sheet – 42 CFR Part 2 Final Rule
7
Washington State Legislature. RCW 70.02.080 – Patient Examination and Copying of Health Care Record
8
Washington State Legislature. House Bill Report HB 1496
9
U.S. Department of Health and Human Services. Is $6.50 the Maximum Amount That Can Be Charged
10
U.S. Department of Health and Human Services. The HIPAA Privacy Rule and Parental Access to Minor Children’s Medical Records
11
U.S. Department of Health and Human Services. Personal Representatives and Minors
12
Washington State Legislature. RCW 70.02.040 – Revocation of Authorization