How to Fill Out and Submit a Maryland HIPAA Authorization Form

A Maryland HIPAA authorization form is the written document you sign to tell a healthcare provider to release your medical records to a specific person or organization. To be enforceable in Maryland, it has to satisfy both the federal HIPAA rule at 45 CFR § 164.508 and the state’s own medical records statute at Health-General § 4-303, which caps validity at one year and adds a handful of Maryland-only requirements. Get one element wrong and the records department can reject the entire form, so the work is in assembling the right details before you sign.

Information to Have Ready Before You Fill It Out

Missing details are the most common reason a request bounces back. Pull these together first:

Your full legal name, date of birth, and current contact information, so the provider can match you to their records.
The exact name of the provider that holds the records. Use the specific hospital, clinic, or practice, not the parent health system. The University of Maryland Medical System, for example, will not accept a request addressed to “UMMS” instead of the individual hospital where you were treated.¹
The recipient’s full name (or a described class of people, such as “my attorneys at Smith & Jones LLP”) along with a mailing address or fax number.
The scope of what you want released. You can send everything, or you can limit the disclosure to categories like lab results, imaging, and discharge summaries, or to a specific date range. Narrow language keeps the provider from sending more than you intend.
A stated purpose. If you are the one asking, “at the request of the individual” satisfies the federal requirement.²
An expiration date or event, which under Maryland law cannot be more than one year from the day you sign.

What a Valid Authorization Must Contain

Federal rules set the baseline. Under 45 CFR § 164.508, the form must specifically describe the information to be released, name the person or entity authorized to disclose it, name the recipient, state the purpose, set an expiration date or event, and carry your signature and date. It has to be written in plain language.²

Three written notices also have to appear on the form:

A statement that you can revoke the authorization in writing at any time, along with instructions or a reference to the provider’s privacy notice explaining how.
A statement that the provider generally cannot condition your treatment on whether you sign. Narrow exceptions exist (research studies are the classic example), but for ordinary clinical care, treatment cannot be withheld because you refuse.
A warning that once your records reach the recipient, that recipient may not be bound by HIPAA and could share the information further.

Maryland layers its own requirements on top. Health-General § 4-303 requires the authorization to be in writing, dated, and signed by a “person in interest,” a defined term covering the adult patient, an authorized representative, a personal representative of a deceased patient, and certain minors or their parents.³ The form must also name the specific provider being asked to disclose and identify who is receiving the records.⁴

Maryland’s One-Year Cap and the Specific-Provider Trap

Under § 4-303(b)(4), no Maryland authorization can be valid for more than one year from the date of signature.⁴ You can pick a shorter window or a triggering event, such as the conclusion of a specific lawsuit, but one year is the ceiling. Leaving the expiration blank or writing in something longer gives the provider grounds to treat the form as invalid.

Two exceptions exist. Authorizations tied to a criminal justice referral remain valid until 30 days after final disposition of the case. Nursing home resident authorizations remain valid until revoked, or for a shorter period the form specifies.⁴

One trap catches people repeatedly. A Maryland authorization only covers records the named provider developed itself. If that provider is also holding records it received from another doctor or facility, those outside records are not released unless your form specifically says so in writing, and unless the originating provider has not prohibited redisclosure.⁴ If you want the complete file, say so on the form.

Who Can Sign

An adult patient signs and dates the form. If someone else signs on your behalf (a healthcare agent under a power of attorney, a guardian, or a court-appointed representative), the form must describe that person’s authority, and the provider will usually ask to see the underlying document.²

Minors

For most patients under 18, a parent or guardian signs. Maryland carves out categories where the minor has adult capacity to consent to treatment, and for those records the minor controls disclosure. Under Health-General § 20-102, a minor can consent to treatment for drug or alcohol abuse, sexually transmitted infections, pregnancy-related care, contraception (other than sterilization), HIV prevention, and examination or treatment related to sexual assault.⁵ A married minor, a minor who is a parent, and a minor living independently and self-supporting also have full adult capacity. A minor 16 or older can consent to mental health treatment on their own.

When the minor consented to treatment independently, the minor is the “person in interest” for those records, and a parent’s signature does not authorize their release.³

Deceased Patients

A duly appointed personal representative of the estate qualifies as a “person in interest” and can authorize the release.³ Expect the provider to require a death certificate and the court document establishing your authority as executor or administrator. A HIPAA authorization the patient signed while living and a medical power of attorney both expire at death; neither one grants access afterward.

Records That Need a Separate Form

Some records cannot travel on a general authorization.

Psychotherapy Notes

Psychotherapy notes (the personal notes a therapist keeps separate from the regular medical record) require their own standalone authorization under federal law. A general HIPAA authorization covering your medical records does not reach them.² A provider cannot condition treatment on your willingness to sign one.

Substance Abuse Treatment Records

Records from federally assisted substance abuse programs are governed by 42 CFR Part 2, which is separate from and stricter than HIPAA. Maryland’s statute expressly exempts these records from the general disclosure rules in Title 4, Subtitle 3.⁶ The treatment program will have its own consent form built for 42 CFR Part 2; a standard HIPAA authorization will not work.

Where to Get the Form and How to Submit It

Most Maryland providers issue their own authorization form through their Health Information Management or medical records department, and many hospitals post a downloadable version on the patient portal. The Maryland Department of Budget and Management publishes a generic HIPAA release form, though that version is built for state employee benefits and may need adaptation for a medical records request.⁷ Using the provider’s own form is safer, because many will reject a third-party form that lacks their internal tracking fields.

Once signed, deliver the form to the medical records department. Common routes are uploading through a secure patient portal, faxing to the records office, or mailing by certified mail for proof of delivery. If you fax, call to confirm receipt. Faxed pages disappear into queues more often than anyone admits.

How Long It Takes and What Copies Cost

Maryland law gives the provider up to 21 working days from the date you submit your request to disclose the records, so in practice you may wait roughly a month.⁸ A provider that knowingly refuses to release records within that window is liable for your actual damages.⁹

Health-General § 4-304 caps what you can be charged:

A preparation and retrieval fee of up to $22.88.
Paper copies at up to $0.76 per page, including mailing.
Electronic copies at the same $22.88 preparation fee, with a per-page rate of 75 percent of the paper rate (currently about $0.57), capped at $80 in per-page charges.
For patients enrolled in the Maryland Medical Assistance Program (Medicaid), a total fee no higher than $20 per 100 pages.

The per-page rate is the same whether you request 10 pages or 500. A provider charging above these amounts is exceeding the statutory cap.¹⁰

How to Revoke

You can cancel the authorization in writing at any time before it expires. The revocation takes effect when the provider receives it, and it does not undo any disclosures that already happened. After processing your notice, the provider must stop further disclosure under that authorization.²

No special form is required. A dated letter identifying the original authorization (by signing date and recipient) and stating clearly that you are revoking it is enough. Send it the same way you sent the original, and keep a copy.

If the Provider Mishandles Your Records

Maryland treats unauthorized disclosure as a criminal misdemeanor under Health-General § 4-309, with fines that escalate based on intent and can reach $250,000 and up to ten years’ imprisonment for disclosures made for commercial gain or malicious harm. A provider who knowingly violates the subtitle is also liable in a civil action for your actual damages.⁹

You can also file a federal complaint with the U.S. Department of Health and Human Services Office for Civil Rights through its online portal at ocrportal.hhs.gov.¹¹ Federal enforcement runs on a six-year window from the date of the violation, not the date you discovered it, so the clock can run before you know a breach happened.

1
University of Maryland Medical System. Medical Records
2
eCFR. 45 CFR 164.508
3
Maryland General Assembly. Maryland Health-General Code 4-301
4
Maryland General Assembly. Maryland Code Health-General 4-303
5
Maryland General Assembly. Maryland Health-General Code 20-102
6
Maryland General Assembly. Maryland Code Health-General 4-302
7
Maryland Department of Budget and Management. HIPAA Authorization Form
8
Maryland Department of Health. Medical Records
9
Maryland General Assembly. Maryland Code Health-General 4-309
10
Maryland General Assembly. Maryland Health-General Code 4-304
11
HHS.gov. Filing a Health Information Privacy Complaint