How to Fill Out and Submit a Connecticut HIPAA Release Form

A Connecticut HIPAA release form tells a healthcare provider to send your protected health information to a specific person or organization you name. You complete the form, sign it, and deliver it to the provider holding the records; the provider then sends copies to the recipient. The form has to meet federal HIPAA requirements and Connecticut’s stricter rules for HIV, mental health, and substance abuse records, and the Connecticut-specific checkboxes are where most people unknowingly leave records behind.

What to Gather Before You Fill Anything Out

Missing information is the most common reason a records request stalls. Pull these together first:

Your full legal name, date of birth, and current mailing address, matching what the provider has on file.
The name and address of the provider or facility that holds the records.
The full name, mailing address, and phone number of whoever will receive the records — another doctor, an insurance company, an attorney, or you.
The scope: your entire chart, records from specific dates, or a narrow category like lab results or imaging.
A short statement of purpose, such as continuing treatment, an insurance claim, or a legal proceeding. Federal rules require this field.

Most hospitals and physician offices keep blank authorization forms in their medical records departments or on their patient portals. Connecticut’s Department of Mental Health and Addiction Services publishes its own HIPAA release forms online, and many large health systems use standardized templates that satisfy both federal and Connecticut requirements. If your provider doesn’t offer a form, ask the medical records office directly.

What a Valid Authorization Must Contain

Under 45 CFR 164.508, an authorization is defective — and a provider can refuse to act on it — if any of these elements is missing:

A meaningful description of the information to be released. Vague language like “all records” with no further detail can be rejected.
The name or specific identification of the provider authorized to disclose.
The name or specific identification of the person or entity who will receive the records.
A description of the purpose. If you don’t want to state a reason, “at the request of the individual” is sufficient under the federal rule.
An expiration date or event. “Valid until revoked” also satisfies the requirement.
Your signature and the date you signed. If a representative signs for you, the form must describe their authority.

The form must also tell you that you can revoke the authorization in writing and warn you that information disclosed can be re-disclosed by the recipient and lose HIPAA protection.¹

The Connecticut Checkboxes Most People Miss

A signed general release — even one that covers your full chart — does not authorize disclosure of certain sensitive categories. Each one needs its own affirmative mark on the form. Leave the box blank and the provider strips those records from the disclosure, no matter what else you signed.

HIV and AIDS Records

Connecticut law states explicitly that a general authorization for release of medical information is “NOT sufficient” to release HIV-related records. You need specific written consent that separately addresses HIV or AIDS testing and treatment information, and when the provider discloses, it must include a written warning to the recipient that any further redisclosure requires your specific written consent.² On the form, this usually appears as a separate checkbox or initial line.

Mental Health Records

Communications with mental health professionals — psychiatric evaluations, therapy records, and treatment notes — are confidential under Connecticut General Statute 52-146e. No provider can release them without your consent, and the consent must specify who receives the information and how it will be used.³ The law also requires that you be told your refusal to consent will not affect current or future treatment, except where disclosure is necessary to that treatment.

Psychotherapy Notes

Federal HIPAA rules treat a therapist’s private session notes — kept separate from the rest of the chart — differently from general mental health records. Medication lists, session dates, diagnoses, treatment plans, and progress summaries sit in your general mental health record and move under a standard mental health authorization. The therapist’s analytical notes about what was said in session need their own specific authorization, separate even from the one covering the rest of your mental health file.⁴

Substance Abuse Treatment Records

Substance use disorder treatment records carry a second layer of federal protection under 42 CFR Part 2. A final rule effective February 2026 allows a single patient consent for future treatment, payment, and healthcare operations uses, but separate consent is required for disclosures tied to civil, criminal, administrative, or legislative proceedings. Substance use disorder counseling notes need their own specific consent and cannot ride on a broad authorization.⁵ Look for a separate checkbox or signature line on the form and mark it if you want those records included.

Filling It Out Step by Step

Start at the top with your identifying information. Make sure your name matches the provider’s records exactly. A married name against a maiden name, or a nickname instead of a legal name, is enough to delay the request.

Identify the releasing provider and the recipient next. Write out full names and addresses for both. If the recipient is a specific doctor inside a larger practice, name the doctor rather than just the practice, especially when the practice has multiple locations or providers.

In the section describing which records to release, be as specific as your situation allows. If you only need records from a hospital stay last March, list those dates. If you only need lab work or imaging, say so. Narrowing the scope protects your privacy and usually speeds processing because the records department pulls fewer files. If you genuinely need everything, write “complete medical record” and understand the provider will pull your entire chart.

State the purpose. For a care transfer or second opinion, “continuity of care” or “transfer of treatment” works. For a legal matter, “legal proceeding” or “at the request of the individual” is enough. Don’t skip this field.¹

Now the sensitive-records section. If your file includes HIV-related information, mental health treatment, psychotherapy notes, or substance abuse treatment and you want those included, affirmatively mark each applicable box. This is the step most people miss.

Set the expiration. A calendar date 90 days or six months out gives the provider room to process the request. If you tie it to an event, describe the event clearly, such as “upon conclusion of my personal injury case.” Then sign and date. If someone signs on your behalf, the form must describe their authority, such as “healthcare power of attorney” or “court-appointed guardian.”

Signing for a Minor or a Deceased Patient

A parent, guardian, or person acting in loco parentis generally signs for an unemancipated minor. Under HIPAA, a parent with legal authority to make healthcare decisions for the child is treated as the child’s personal representative and can authorize disclosure.⁶ There are three situations where parental authority doesn’t apply:

When state law allowed the minor to consent to specific care without parental approval, the parent is not the personal representative for records tied to that care.
When a court or court-appointed person authorized the child’s treatment.
When the parent agreed that the provider-child relationship would be confidential; access is then limited to the scope of that agreement.

A provider may also deny parental access when the provider holds a reasonable, individualized belief that the child has been or may be subjected to abuse or neglect and that access could endanger the child.

For a deceased patient, the personal representative of the estate — usually an executor or administrator — signs. The representative must provide documentation of legal authority, such as letters testamentary or a court appointment. HIPAA protections on a deceased person’s records last 50 years from the date of death.⁷

Submitting the Form

Deliver the completed form to the medical records department of the provider holding your records. Common submission methods:

Patient portal upload, which gives you an instant confirmation.
Secure fax. Keep the confirmation page as proof.
Certified mail, with a tracking number and delivery confirmation.
In-person delivery. Ask for a date-stamped copy as your receipt.

Keep a copy of the signed form and your proof of delivery. The processing clock starts when the provider receives the request, so the delivery date matters.

Fees and the 30-Day Clock

Connecticut caps what institutional healthcare providers can charge for medical record copies at 65 cents per page. That cap includes research fees, clerical fees, handling fees, and first-class postage. The only exception is for materials like X-ray copies or pathology tissue blocks, where the provider can charge the actual cost of the materials.⁸

If the request supports a Social Security claim or appeal, or a veterans’ benefits claim under Title 38, the provider cannot charge you anything, but you must include documentation of the claim or appeal with the request.

Providers must fulfill the request within 30 days of receiving it. If you were recently discharged and the request arrives before the records are complete, the provider has to furnish them as soon as they are finalized.⁸ Under federal HIPAA rules, a provider can extend the deadline by an additional 30 days if they notify you in writing of the reason and the expected completion date, and they only get one extension.⁹

If 30 days pass with no records and no written explanation, contact the provider’s privacy officer. Reference the date you submitted your authorization. Most delays trace to misfiled paperwork or an incomplete form.

Revoking an Authorization

You can cancel a signed authorization at any time by submitting a written revocation to the provider. Oral requests do not count. Identify the authorization clearly enough that the provider can locate it, including the date you signed and the recipient’s name.¹

A revocation cannot undo disclosures that already happened. If the provider already sent records to the recipient before receiving your revocation, that disclosure was valid. Going forward, the provider must stop releasing records under the revoked authorization. Deliver the revocation the same way you’d submit a new one and keep proof.

If a Provider Won’t Comply

Start with the provider’s privacy officer in writing. Most disputes resolve faster through a direct conversation than through a federal investigation. If that fails, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights electronically through the OCR Complaint Portal at ocrportal.hhs.gov or in writing.¹⁰ OCR has settled dozens of cases against providers who failed to produce records on time or charged excessive fees.

1
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
2
Justia. Connecticut Code 19a-585 – Requirements for Disclosure of HIV-Related Information
3
Justia. Connecticut Code 52-146e – Disclosure of Communications
4
American Psychiatric Association. Psychotherapy Notes Under HIPAA
5
HHS.gov. Fact Sheet 42 CFR Part 2 Final Rule
6
U.S. Department of Health and Human Services. The HIPAA Privacy Rule and Parental Access to Minor Children’s Medical Records
7
HHS.gov. Health Information of Deceased Individuals
8
Justia. Connecticut Code 19a-490b – Furnishing of Health Records and Veterans’ Information
9
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
10
HHS.gov. Filing a Health Information Privacy Complaint