A Wisconsin HIPAA release form lets a healthcare provider send your protected health information to a specific person or organization you name: an attorney, an insurer, a family member, or another doctor. You can use the state’s standardized version, Form F-82009, available from the Wisconsin Department of Health Services, or the authorization form your provider hands you. Either works as long as it contains every element federal law requires and, where applicable, the additional language Wisconsin requires for sensitive records.
What the Form Must Contain
Federal HIPAA regulations at 45 CFR § 164.508 list six core elements. If any one is missing, the authorization is defective and the provider will reject it.1eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
- A specific description of the records being released. “Office visit notes from January 2025 through March 2026” works; “all records” usually does not.
- The name of the provider or organization authorized to disclose the records.
- The name of the person or organization that will receive them.
- The purpose of the release. If you are making the request yourself and prefer not to explain, “at the request of the individual” satisfies the rule.
- An expiration date or triggering event, such as “conclusion of my personal injury lawsuit.” An authorization with no expiration is invalid.
- Your signature and the date. If someone else signs for you, the form must describe that person’s legal authority.
The form also has to carry three notices: that you can revoke the authorization in writing, whether the provider can refuse to treat you based on your decision, and that information released could be re-shared by the recipient and lose its HIPAA protection.
Wisconsin DHS Form F-82009 is a single page that captures all of this, including fields for the record subject, date of birth, releasing agency, recipient, the specific records and date ranges, purpose, expiration, and signature lines for the patient and any authorized signer.2Wisconsin Department of Health Services. Confidential Information Release Authorization, F-82009 Most Wisconsin hospitals and clinics use their own in-house forms instead. Before you sign anything, check that the expiration line is filled in. A blank expiration is the single most common reason releases bounce back.
Extra Consent Required for Mental Health, HIV, and Substance Use Records
A general HIPAA release does not automatically pull every type of record out of your file. Wisconsin treats three categories separately, and providers will hold these portions back even if you signed a broad release for everything else.
Mental Health and Developmental Disability Records
Records from treatment for mental illness, developmental disabilities, alcoholism, or drug dependence are governed by Wisconsin Statute § 51.30, not the general medical records statute. The statute requires written informed consent that separately identifies the recipient, your name, the purpose, the specific type of information, the time period covered, the date of signing, and your signature.3Wisconsin State Legislature. Wisconsin Code 51-30 – Records A standard HIPAA form that doesn’t call out these records by type won’t satisfy § 51.30. Either use a form designed for it or make sure your general release includes a clearly marked section that meets each statutory element.
HIV Test Results
Wisconsin Statute § 252.15 sets its own consent requirements for HIV test results: your name, a description of the information to be released, the discloser, the recipient, your signature, the date, and the effective time period.4Wisconsin State Legislature. Wisconsin Code 252.15 – Restrictions on Use of an HIV Test A minor who is 14 or older controls disclosure of their own HIV results. A parent cannot override that.
Federally Protected Substance Use Treatment Records
If you received substance use disorder treatment from a federally assisted program, 42 CFR Part 2 governs those records on top of HIPAA. Part 2 generally requires your written consent before any disclosure, and that consent must identify the specific recipient and the records being shared. A 2024 amendment allows a single consent to cover treatment, payment, and healthcare operations, but records shared under that broader consent can be re-disclosed and lose Part 2 protection downstream. Law enforcement still cannot reach Part 2 records with an ordinary subpoena or warrant.
Who Can Sign the Form
Wisconsin Statute § 146.81(5) defines who counts as a “person authorized by the patient” when the patient does not sign personally.5Wisconsin State Legislature. Wisconsin Code 146.81(5) – Health Care Records Definitions
- An adult with decision-making capacity signs for themselves.
- A parent, guardian, or legal custodian generally signs for a minor child.
- A minor who legally consented to their own treatment controls release of those records. Wisconsin allows minors to consent to care for sexually transmitted diseases (any age), HIV testing (14 and older), and outpatient substance abuse services (12 and older).6Wisconsin State Legislature. Health Care and Confidentiality of Records for Minors
- A court-appointed guardian signs for an adult who has been adjudicated incompetent.
- A health care agent named in a power of attorney for health care can sign once the patient has been found incapacitated by two physicians, or by one physician and one licensed advanced practice clinician, unless the POA instrument limits that authority.
- For a deceased patient, the personal representative, surviving spouse, or surviving domestic partner may sign. If none survives, an adult member of the immediate family qualifies.
Anyone signing for someone else should bring documentation: letters of guardianship, an activated power of attorney, or proof of the family relationship. Providers verify these credentials before releasing anything.7HHS.gov. Guidance – Personal Representatives
Submitting the Form and How Long the Provider Has to Respond
Send the signed form to the facility’s Health Information Management or medical records department. Most Wisconsin health systems accept submissions through a secure patient portal or encrypted email. Certified mail gives you a paper trail. In-person drop-off is fastest when you are working against a deadline.
Under federal HIPAA rules the provider must act within 30 calendar days of receiving your request. If more time is needed, the provider can take one additional 30-day extension, but it must send you a written explanation and a completion date within that initial 30-day window.8U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals Requests for Access to Their PHI
What Providers Can Charge for Copies
Wisconsin Statute § 146.83 caps the fees a provider can charge for copies of medical records, whether you or someone you authorized requests them.9Wisconsin State Legislature. Wisconsin Code 146-83 – Access to Patient Health Care Records
- Paper copies: $1.00 per page for pages 1–25, $0.75 for pages 26–50, $0.50 for pages 51–100, and $0.30 for page 101 and above.
- Microfiche or microfilm: $1.50 per page.
- X-ray prints: $10.00 per image.
- Third-party requests: a one-time $8.00 certification fee and a one-time $20.00 retrieval fee may be added when the requester is not the patient or the patient’s authorized person.
- Shipping: actual costs plus applicable taxes.
The statute does not list electronic formats among the categories a provider may charge for. The Wisconsin Supreme Court confirmed this in Banuelos v. University of Wisconsin Hospitals & Clinics Authority, 2023 WI 25, holding that providers cannot impose per-page fees for records delivered electronically.10Wisconsin State Legislature. Wisconsin Code 146.83(3f) – Access to Patient Health Care Records If you want to avoid copy fees, request your records in electronic form.
Revoking an Authorization
You can cancel a HIPAA authorization at any time by sending a written revocation to the provider. An oral request will not do it. Identify the authorization you are revoking so the records department can match it to the right file. The revocation takes effect when the provider receives it, but it cannot undo disclosures the provider already made while the authorization was still in force. If records went to your attorney last week, revoking today does not pull them back.11U.S. Department of Health and Human Services. Can an Individual Revoke His or Her Authorization
One narrow exception applies in the insurance context. If you signed the authorization as a condition of obtaining insurance coverage, and the insurer has a legal right to contest a claim or the policy itself, your revocation may not stop the insurer from continuing to use the information for that purpose.
When a Provider Can Require Your Signature
A provider generally cannot refuse to treat you because you declined to sign a HIPAA release. Federal regulations at 45 CFR § 164.508(b)(4) prohibit conditioning treatment, payment, or eligibility for benefits on your signing an authorization. The exceptions are narrow. A provider can require your signature when the service exists solely to generate information for a third party, such as a pre-employment physical, a court-ordered drug test, or a fitness-for-duty exam. Research-related treatment may also be conditioned on authorization when the study has institutional review board approval. Outside those situations, a demand that you sign a release to a third party as a condition of being seen conflicts with federal rules.