How to Fill Out a Massachusetts HIPAA Release Form: Sensitive Records and Fees

A Massachusetts HIPAA release form directs a healthcare provider to send your medical records to a specific person or organization. You can download a sample authorization from the Massachusetts Department of Public Health at mass.gov, or get one directly from the hospital or clinic that holds your records.¹ Either works, as long as the form contains everything federal law requires and includes separate consent for any sensitive records Massachusetts singles out for extra protection.

Where to Get the Form

The fastest option is the HIPAA-compliant sample authorization prepared by the Massachusetts Department of Public Health, available at mass.gov. Most Massachusetts hospitals and clinics also have their own forms, which you can pick up at the Health Information Management department (sometimes called medical records) or download through the facility’s patient portal. A provider’s custom form is fine as long as it contains every element federal law requires.

What to Have in Front of You Before You Start

Gather these details first so you can complete the form in one sitting:

Your full legal name, date of birth, and home address. Massachusetts hospital regulations list name, date of birth, sex, and address as the standard identifiers for matching records. A Social Security number is not required under state regulations, though some providers ask for it as an added safeguard against mix-ups.²
The name and address of the provider who holds the records.
The full name and address of the person or organization that will receive the records, whether that is another doctor, an attorney, an insurer, or yourself.
A description of the records specific enough that staff can pull the right file. “All records from January 2024 through December 2025” works; “my medical records” with no timeframe may not.
A purpose for the disclosure. If the records are for you and you’d rather not explain, federal rules accept the phrase “at the request of the individual.”³

What the Form Must Contain

Federal regulation 45 CFR 164.508(c) lists six core elements that every valid authorization must include. If any is missing, the provider can reject the form.³

A specific, meaningful description of the information to be released, such as by date range, type of treatment, or provider name.
The name of the person or entity authorized to release the records.
The name of the person or organization that will receive them.
The purpose of the disclosure.
An expiration date or event, such as “conclusion of my personal injury claim.” Without one, the authorization has no built-in endpoint.
Your handwritten or electronic signature and the date you signed.

The form also has to carry three required statements: notice that you can revoke the authorization in writing, a statement about whether the provider can condition treatment or payment on your signing, and a warning that once the records leave the provider, the recipient may not be bound by HIPAA’s privacy protections. The DPH sample and most hospital forms already print these in the boilerplate, so you usually only need to read them.

Most Massachusetts hospital portals accept electronic signatures on authorization forms. If you are filling out paper, a wet-ink signature is still standard.

Signing on Behalf of Someone Else

If you are signing for another person, the form must describe your authority to act on their behalf.³ A parent signing for a minor child would write “parent” in the representative-authority field. Someone with a healthcare power of attorney would note that and ideally attach a copy of the document. Without that description, the provider will reject the form.

Minors and Parental Access

Parents generally act as the personal representative for a minor child’s records. Under federal rules, three situations change that: when the minor lawfully consented to the care on their own, when a court ordered the treatment, or when the parent agreed to a confidential relationship between the child and the provider.⁴

Massachusetts law lets a minor consent to their own treatment in several categories, including married minors, minors who are parents, members of the armed forces, pregnant minors, and minors living independently and managing their own finances. A minor who consented to drug treatment under M.G.L. c. 112, § 12E also controls those records. In these cases, the minor signs the authorization, not the parent.

Sensitive Records That Need Separate Consent

A standard HIPAA authorization does not automatically cover every category of health information in Massachusetts. Several types of records carry extra consent requirements, and providers will redact or withhold them unless you supply the specific consent each category requires.

HIV/AIDS Test Results

M.G.L. c. 111, § 70F bars any facility or provider from disclosing HIV antibody or antigen test results without separate written informed consent. The consent must state the purpose for which the information is requested and must be distinct from a general release.⁵ Many Massachusetts authorization forms include a checkbox or separate signature line for HIV-related records. If yours does not, you need a standalone consent form for that category.

Genetic Testing Results

M.G.L. c. 111, § 70G requires informed written consent before any provider can release genetic test results. The consent has to include the purpose of the disclosure, confirmation that you discussed the reliability of the test results with the ordering provider, a statement that you were told about genetic counseling, a description of each disease or condition tested for, and the name of the person or entity receiving the results.⁶ A general HIPAA authorization will not meet these requirements.

Substance Use Disorder Treatment Records

Records from substance use disorder treatment programs are governed by 42 CFR Part 2, a federal regulation that operates independently of HIPAA. Part 2 requires its own written consent with specific elements, including the patient’s name, who may disclose, who receives the records, the purpose, and an expiration date.⁷ Consent to disclose these records in a legal proceeding cannot be combined with consent for any other purpose. Expect to sign two separate forms if you want substance use treatment records released alongside your other medical records.

Psychotherapy Notes

Psychotherapy notes, meaning a therapist’s private session-by-session notes kept separate from your main chart, require their own authorization under 45 CFR 164.508(a)(2). They are distinct from diagnosis summaries, treatment plans, progress notes, and medication records, all of which can be released under a standard authorization.⁸ Even another treating provider cannot see psychotherapy notes without a separate signed authorization from you.

Submitting the Form and Avoiding Rejection

Send the signed form to the Health Information Management department at the facility holding your records. Most Massachusetts hospitals accept submissions through their patient portal, by fax, or by mail. If the authorization supports a legal or insurance matter, certified mail gives you a tracking number and delivery confirmation, which helps if you need to prove the request went in on a particular date.

Check the form for these common rejection triggers before you submit:

Missing expiration date or event.
No signature, or a signature without a date.
A description of the records too vague to act on.
HIV, genetic, or substance use disorder records requested without the separate consent each one requires.
A representative signing without noting their authority.

Fees and How Long It Takes

Under HIPAA, a provider must act on your request within 30 days of receiving it. If records are stored off-site or the request is complex, the provider can take a single 30-day extension, but must notify you in writing with a reason and a date for the response.⁹

Massachusetts caps copying fees for hospital and clinic records at a base charge of $15 per request, plus $0.50 per page for the first 100 pages and $0.25 per page after that. The amounts are subject to adjustment by the Consumer Price Index.¹⁰ For providers covered by HIPAA, the fee must be reasonable and cost-based, limited to copying supplies, labor, and postage if mailed. The provider cannot charge you for the time spent searching for and retrieving the records.¹¹

Revoking Your Authorization

You can revoke a HIPAA authorization at any time by sending a written request to the provider. The revocation takes effect when the provider receives it. It does not undo disclosures already made while the authorization was active; it only stops future releases. Send the revocation to the same Health Information Management department that received the original form, and keep a copy.

If Your Request Is Denied or Ignored

A provider can deny access only on specific grounds listed in federal law. Some denials are final: a request for psychotherapy notes, or for records compiled in anticipation of a legal proceeding, cannot be appealed. Other denials are reviewable. If a provider decides that releasing records could endanger you or someone else, you have the right to have that decision reviewed by a different licensed health care professional who was not involved in the original denial.⁹

If the provider ignores your request, misses the 30-day deadline without explanation, or denies access without a legitimate reason, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Complaints can go through the OCR Complaint Portal online or in writing, and you have 180 days from the date you became aware of the violation, though OCR can extend that deadline for good cause.¹²

1
Mass Legal Services. HIPAA Compliant Release Form to Allow Others to See Your Medical Records and Protected Health
2
Legal Information Institute. 105 CMR 140.302 – Patient Records
3
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
4
U.S. Department of Health and Human Services. Does the HIPAA Privacy Rule Allow Parents the Right to See Their Children’s Medical Records?
5
General Court of Massachusetts. Massachusetts General Laws Chapter 111 Section 70F – HIV Test
6
General Court of Massachusetts. Massachusetts General Laws Chapter 111 Section 70G
7
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
8
U.S. Department of Health and Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health
9
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
10
General Court of Massachusetts. Massachusetts Code Chapter 111 Section 70 – Records of Hospitals or Clinics; Custody; Inspection; Copies; Fees
11
Mass.gov. Medical Records Obligations
12
HHS.gov. How to File a Health Information Privacy or Security Complaint