How to Fill Out and Submit a Texas HIPAA Release Form

The Texas HIPAA release form, formally titled the Authorization to Disclose Protected Health Information, is the standardized document the Texas Attorney General adopted under Health and Safety Code Section 181.154 for authorizing the electronic disclosure of your medical records.¹ You can download it free from the Attorney General’s consumer protection page, and providers may substitute their own form as long as it complies with HIPAA and the Texas Medical Records Privacy Act.² Each authorization covers one disclosure at a time; a different recipient or a different purpose requires a new form.

Where to Get the Form

The Attorney General posts the standardized form as a fillable PDF on the patient privacy section of its website.³ Most doctor’s offices, hospitals, and health plans also keep copies at the front desk or on their patient portals. If a provider hands you its own authorization instead of the AG’s version, that is permitted as long as the substitute meets the same HIPAA and Texas Medical Records Privacy Act standards.²

Filling Out the Form Section by Section

The form moves top to bottom in a fixed order. An incomplete or vague field gives the provider a reason to reject the request or delay the release, so work through each section carefully.

Patient Identification

Start with the patient’s full legal name (last, first, middle), date of birth, mailing address, phone number, and email address.² The form does not ask for a Social Security number. Use the name exactly as it appears in the provider’s records. A married name on the form paired with a maiden name in the chart creates matching problems that slow everything down.

Who Discloses and Who Receives

Two separate fields identify the parties. First, name the person or organization currently holding the records (typically your doctor, hospital, or health plan). Second, name the person or organization you want those records sent to, whether a new physician, an attorney, an insurance company, or yourself. Include the recipient’s address, phone, and fax where available so the disclosing provider can transmit the records without follow-up.²

Selecting Which Records to Release

The form provides a checklist of record categories. You can check “All health information” or pick specific types, including:

Clinical records: history and physical exams, progress notes, physician’s orders, consultation reports, operation reports, and discharge summaries
Diagnostic records: lab results, radiology reports and images, EKG and cardiology reports, pathology reports, and other diagnostic test reports
Other categories: past and present medications, patient allergies, billing information, or a write-in line for anything not listed

Checking only what you need limits the amount of personal data in circulation. If you are sending records to a new specialist for a shoulder injury, there is no reason to include your full psychiatric history.²

Sensitive Records Requiring Separate Initials

Four categories of records receive extra protection and will not be released unless you separately initial next to each one:

Mental health records (excluding psychotherapy notes)
Genetic information, including genetic test results
Drug, alcohol, or substance abuse records
HIV/AIDS test results and treatment records

Skipping the initials on these lines means the provider must withhold those records even if you checked “All health information” above. This is the section people most often overlook, and it is the most common reason a release comes back incomplete.²

Reason for Disclosure

Write the purpose. “At the request of the individual” is a sufficient description under federal HIPAA rules when you are the one initiating the authorization.⁴ You can also write something more specific, like “transfer of care to new provider” or “personal injury claim,” but the form does not require you to justify why you want your own records.

Expiration

The authorization automatically expires at the earliest of three events: the patient’s death, a minor patient reaching the age of majority, or the patient withdrawing permission. You can also fill in a specific calendar date.² Setting a date, such as six months or a year out, is a good practice when the release is tied to a finite event like a lawsuit or an insurance claim. Leaving the date blank means the authorization stays active until one of the three automatic triggers occurs or you revoke it in writing.

Re-Disclosure Warning and Signature

Near the bottom, the form includes a preprinted statement warning you that once your records leave the original provider, the recipient may re-disclose them and federal or state privacy protections may no longer apply.² Read it; signing below confirms you were notified. The signature line requires both your signature and the date. If someone other than the patient signs, the form also requires a description of that person’s authority to act on the patient’s behalf.⁴

Who Can Sign If the Patient Cannot

Competent adults sign their own authorization. When a patient cannot sign because of incapacity, age, or death, a legally authorized representative steps in.

Parents and guardians. A parent or legal guardian signs for a minor child. Attach a copy of the guardianship order when the signer is a court-appointed guardian rather than a biological parent.
Medical power of attorney agents. Texas Health and Safety Code Chapter 166, Subchapter D governs medical powers of attorney and establishes how an agent proves authority. Include a copy of the executed power of attorney with the release form.⁵
Estate representatives. After a patient’s death, a personal representative or executor of the estate can authorize disclosure. Attach letters testamentary or other probate documentation.

Texas also recognizes situations where minors can consent to their own treatment, including care for reportable communicable diseases, substance abuse counseling, and pregnancy-related treatment. A minor who consented to that treatment controls the authorization for those specific records.

How to Submit the Completed Form

Deliver the signed authorization to the provider or facility that holds the records. The most reliable methods are:

Certified mail with return receipt. Creates a paper trail proving the provider received the request and starts the clock on the response deadline.
Secure patient portal. Many health systems accept scanned authorizations through their online portal, which timestamps the upload automatically.
Fax. The form includes a fax number field for the disclosing provider. Keep the confirmation page as proof of delivery.
In person. Hand-deliver a copy to the medical records or health information management department and ask for a date-stamped receipt.

Whichever method you choose, keep a copy of the signed form and your proof of delivery. If a dispute arises later about whether or when the provider received the request, that documentation is your leverage.

When You Do Not Need to Submit a Form

Not every transfer of your medical information requires a signed authorization. Section 181.154 carves out exceptions for electronic disclosures made between covered entities for treatment, payment, and healthcare operations.¹ In practical terms, your current doctor can send records to a specialist for a referral, your hospital can submit claims to your insurer, and a health plan can share data with a clearinghouse, all without asking you to sign anything.

Disclosures required or authorized by other state or federal laws are also exempt, including mandatory reporting of certain infectious diseases, child abuse reporting, responses to law enforcement requests, and disclosures ordered by a court.¹ You need the form when someone outside those exceptions wants access to your records, such as a personal attorney, a life insurance company, a family member, or an employer.

How Long the Provider Has to Respond

If a provider uses an electronic health records system capable of fulfilling the request, it must provide the records in electronic form within 15 business days of receiving a valid written request.⁶ Physicians responding to any records request under the Texas Occupations Code also face a 15-business-day deadline. Federal HIPAA gives covered entities up to 30 calendar days, with one 30-day extension available if they notify you in writing of the delay and the expected completion date.⁷ Because Texas law is more restrictive, the 15-business-day deadline controls for most requests directed to Texas providers.

What the Provider Can Charge

Fee limits depend on whether the records come from a hospital or a physician’s office. Texas adjusts hospital caps annually. As of September 1, 2025, hospitals can charge up to $61.79 for the first 10 paper pages (a combined retrieval and processing fee), with per-page rates that step down as the request gets larger, and up to $111.94 for retrieval and processing of electronic copies plus actual delivery costs.⁸ Hospitals can also add actual mailing costs and up to $11.86 for written responses to questions about the records.

Physician offices operate under a separate schedule set by the Texas Medical Board, with lower caps:

Paper copies: $25 for the first 20 pages, then $0.50 per page
Electronic copies: $25 for 500 pages or fewer, $50 for more than 500 pages
Certifying affidavit (a sworn statement that the records are true and correct): up to $15 extra

Unlike hospitals, physician offices cannot charge a separate retrieval or search fee. The cap covers copying, labor, supplies, and postage only.

Revoking the Authorization

You can withdraw your permission at any time by submitting a written revocation. The form itself directs you to deliver written notice of your intent to revoke to the person or organization you originally authorized to receive the records.² Under federal HIPAA guidance, however, the revocation only takes legal effect once the covered entity that was making the disclosures (your provider) actually receives it.⁹ The safest approach is to send the written revocation to both the disclosing provider and the recipient.

A revocation is not retroactive. Any records already shared before the provider receives your withdrawal are lawfully disclosed and cannot be unshared.⁹ Once the provider processes your revocation, it must stop all future disclosures to the named recipient under that authorization. Verbal requests to stop sharing records are not enough. Put it in writing, send it by a method you can prove, and keep a copy.

If a Provider Ignores a Valid Authorization

A provider that fails to release records after receiving a valid, completed authorization can be reported to two enforcers. The Texas Attorney General has authority under Health and Safety Code Section 181.201 to seek injunctive relief and civil penalties that scale with the severity of the violation.¹⁰ The federal Office for Civil Rights at HHS investigates patient right-of-access complaints and accepts them through an online complaint portal.¹¹

1
State of Texas. Texas Health and Safety Code Section 181.154 – Notice and Authorization Required for Electronic Disclosure of Protected Health Information; Exceptions
2
Office of the Attorney General of Texas. Authorization to Disclose Protected Health Information
3
Office of the Attorney General. Patient Privacy
4
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
5
Justia. Texas Health and Safety Code Title 2 Subtitle H Chapter 166 Subchapter D – Medical Power of Attorney
6
State of Texas. Texas Health and Safety Code Section 181.102 – Consumer Access to Electronic Health Records
7
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
8
Texas Health and Human Services Commission. Maximum Fees Allowed for Providing Health Care Information
9
U.S. Department of Health and Human Services. Can an Individual Revoke His or Her Authorization?
10
State of Texas. Texas Health and Safety Code Section 181.201 – Injunctive Relief; Civil Penalty
11
U.S. Department of Health and Human Services. Complaint Portal