Ohio’s standard medical release form is ODM 10221, a one-page HIPAA authorization published by the Ohio Department of Medicaid that you fill out to authorize one party to release your protected health information to another. You can download a fillable copy from the Ohio Department of Medicaid’s website. Because the form is designed to meet both federal HIPAA rules and the stricter federal rules governing substance use disorder records, every healthcare provider, insurer, and governmental entity in Ohio must accept it when it is properly completed.1Ohio Legislative Service Commission. Ohio Revised Code Chapter 3798 – Section 3798.10 Standard Authorization Form
How to Fill Out ODM 10221
The form tracks the elements federal law requires for a valid HIPAA authorization.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required Work through it section by section.
Patient Identification
Enter the patient’s full legal name, date of birth, and contact information. Errors here cause the most delays. A nickname instead of a legal name, a transposed digit in a birth date, or a stale address can all slow things down. If your name has changed since you received the treatment, use the name on file with the provider so they can locate your records.
Who Is Releasing and Who Is Receiving the Records
Identify the party currently holding the records and the party who should receive them. For the releasing side, give the provider’s full name and address, not just “my doctor.” Name the specific practice, hospital, or clinic. For the receiving side, include the full name, mailing address, and fax number or email of the person or organization that should get the records. Vague entries like “my lawyer” without an address will delay processing.
Purpose of the Disclosure
State why the records are being released. Federal rules accept “at the request of the individual” when you initiate the authorization yourself and don’t want to explain further.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required Common reasons include insurance claims, legal proceedings, transferring care to a new doctor, or personal review. Being specific helps the provider pull the right files, but you are not required to justify the request beyond a basic description.
Types of Records
Check only the categories you actually need: office visit notes, lab results, imaging reports, billing statements, and others. Authorizing your entire medical history when you only need one lab result exposes more information than necessary. If you want records from a specific date range, fill in those dates so the provider doesn’t pull your whole file.
The form also lists categories that carry extra federal protections: substance use disorder treatment, mental health evaluations, and HIV/AIDS testing results. Ohio’s form is designed to cover them because ORC 3798.10 requires it to comply with 42 CFR Part 2 in addition to 45 CFR 164.508.1Ohio Legislative Service Commission. Ohio Revised Code Chapter 3798 – Section 3798.10 Standard Authorization Form If you check one of these boxes, the recipient may be able to redisclose the information, and the form includes the required notice about that.3eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required For substance use disorder records specifically, 42 CFR Part 2 gives you the right to revoke consent at any time, and the authorization explains how.4eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
Expiration Date or Event
Every valid authorization must include either an expiration date or a triggering event that ends it. You might write a specific calendar date, such as December 31, 2026, or tie the end to an event like “upon resolution of my insurance claim.” Leaving this blank can invalidate the form. If you are unsure, pick a date far enough out to cover the purpose but not so open-ended that the authorization sits active for years.
Signature and Date
The patient signs and dates the form. Both are required. An undated signature or a signature on an otherwise incomplete form makes the authorization invalid under federal rules.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required The date should reflect the actual day you sign.
Signing on Behalf of Someone Else
When a parent, legal guardian, or healthcare power of attorney signs for the patient, that person must print their name and describe their legal authority on the form. Federal law calls this person the patient’s “personal representative.” The provider will ask for proof of that authority, so attach a copy of the relevant court order, guardianship letter, or power of attorney. Without it, expect the request to be rejected.
One boundary worth knowing: Ohio law lets minors consent to certain kinds of treatment on their own, and for those records the minor, not the parent, controls the authorization. That includes drug or alcohol abuse treatment, outpatient mental health services for anyone 14 or older (except medication), diagnosis and treatment of sexually transmitted infections, and HIV testing.5Ohio Legislative Service Commission. Ohio Revised Code Section 3701.242 A parent who tries to use ODM 10221 to reach a teenager’s records in one of those categories can be turned away.
Submitting the Signed Form
Deliver the completed form to the healthcare provider that holds the records. Most hospitals route these requests through a Medical Records or Health Information Management department. You can usually submit by fax, through the provider’s secure patient portal, or by mailing a hard copy. If you mail it, send it with delivery confirmation so you can prove receipt if a dispute arises later. Call the provider first to confirm the correct fax number or mailing address. Records departments at large health systems often use different contact information than the main office.
Response Timeline and Fees
Under federal HIPAA rules, a provider must act on your request within 30 calendar days of receiving it.6U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI? If the provider cannot meet that deadline, it may take a one-time 30-day extension, but only if it sends you a written explanation and expected completion date within the original 30-day window.
When you request your own records, or someone requests them at your direction, the provider can charge up to $50 total for electronic copies or electronically transmitted records under Ohio law.7Ohio Legislative Service Commission. Ohio Revised Code Section 3701.741 Federal guidance offers a separate flat-fee option of no more than $6.50 for electronic copies of records maintained electronically, which some providers use as a simpler alternative.8U.S. Department of Health & Human Services. Clarification of Permissible Fees for HIPAA Right of Access
When someone other than the patient requests paper copies, for example an attorney or insurer using your signed authorization, Ohio’s per-page rates apply:7Ohio Legislative Service Commission. Ohio Revised Code Section 3701.741
- Search fee: $16.84 to locate the records
- Pages 1–10: $1.11 per page
- Pages 11–50: $0.57 per page
- Pages 51 and up: $0.23 per page
- Imaging (X-ray, MRI, CT scan): $1.87 per page
- Postage: actual cost
These per-page rates are adjusted periodically under ORC 3701.742, so they may shift slightly from year to year. Providers cannot charge you for the labor of searching for or retrieving the records when you request your own copies under the HIPAA cost-based standard. Those search-and-retrieval charges apply only to third-party requests.8U.S. Department of Health & Human Services. Clarification of Permissible Fees for HIPAA Right of Access
Revoking the Authorization
You can cancel an authorization at any time by submitting a written revocation to the provider. A phone call will not do it.3eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required Describe which authorization you are revoking, including the date you signed it and the provider’s name, so the records department can match it to the right file.
Revocation does not undo disclosures the provider already made while the authorization was active. If your records went to an insurer last week and you revoke today, that prior disclosure stands. The revocation only stops future releases going forward.
If a Provider Refuses or Delays
If a provider ignores your authorization, refuses the standard form, or misses the response deadline without explanation, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. The fastest route is the online OCR Complaint Portal at ocrportal.hhs.gov, though complaints can also go by mail, fax, or email.9U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint You need to file within 180 days of when you became aware of the problem, and your complaint should identify the specific provider and describe what happened and when. OCR investigates by contacting the provider, reviewing documents, and in some cases conducting on-site evaluations.