A New Jersey HIPAA release form is the written authorization you sign to let a doctor, hospital, or other healthcare provider share your protected health information with a specific person or organization — an attorney, an insurer, a family member, or another physician. Federal regulation at 45 CFR 164.508 sets out exactly what has to appear on the form, and New Jersey layers additional consent rules on top for sensitive categories like HIV status and genetic testing. If any required element is missing or vague, the records department will reject the form and you’ll start over, so it pays to get it right on the first try.
What the Form Must Contain to Be Valid
Federal rules require six core elements. Leave any one out and the provider has grounds to refuse the request.
- A specific description of the information you want released. “All orthopedic treatment records from January 2024 through June 2025” works; “my medical records” usually does not.
- The name of the provider, hospital, or other covered entity holding the records.
- The name of the person or organization who will receive the records.
- The purpose of the disclosure. If you initiated the request and prefer not to explain, “at the request of the individual” satisfies the rule.
- An expiration date or event. This can be a calendar date or a triggering event like “conclusion of my personal injury lawsuit” or “upon termination of enrollment in the health plan.” Never leave this line blank.
- Your signature and the date. If someone signs for you, the form also has to describe that person’s authority to act.
The form also has to carry three required statements: that you can revoke the authorization in writing, whether the provider can condition treatment or payment on your signing it, and that the recipient could re-disclose the information and it may lose HIPAA protection at that point.1eCFR. 45 CFR 164.508
Filling Out the Form Step by Step
New Jersey has no single statewide template. Each physician office and hospital designs its own version, usually available at the front desk or through a patient portal. As long as the form covers the federal elements and any state add-ons for sensitive records, the provider can use its own format. If the form in front of you looks unfamiliar, check it against the list above before signing.
Start with identifying information. Print your full legal name, date of birth, address, and any patient ID or medical record number the facility uses. Misspelled names and missing birth dates are a surprisingly common cause of processing delays at large hospital systems where similar names collide.
Fill in the disclosing provider’s name and the recipient’s full name and address. “My lawyer” gives records staff nothing to work with; the attorney’s name and firm address do. If you want records sent to more than one recipient, ask whether the provider requires a separate authorization for each.
Then decide on scope. You can authorize release of your entire medical history or narrow it to specific dates of service, a particular condition, or a single type of record such as imaging reports or lab results. A narrow request protects your privacy but may bring the recipient back asking for more. For litigation, your attorney will normally tell you exactly what to request.
State the purpose. “At the request of the patient” is enough under the federal rule, but a more specific reason — “for continuity of care” or “for insurance claim review” — can help records staff prioritize what to pull.
Write in an expiration date or event, sign, and date the form. Common choices are one year from signing or the resolution of a specific legal matter.
Sensitive Records That Need Extra Consent
A standard authorization is not enough to release certain categories of records in New Jersey. If your general form doesn’t specifically address these, it won’t authorize their disclosure — and the records department will hold them back even while releasing the rest of your chart.
HIV and AIDS Records
New Jersey’s AIDS Assistance Act at N.J.S.A. 26:5C-1 and following treats records identifying a person who has or is suspected of having HIV or AIDS as confidential, and release requires specific written consent.2Justia Law. New Jersey Revised Statutes 26:5C-7 Many provider forms include a separate checkbox or signature line for HIV information. If yours doesn’t and you want those records included, ask for a supplemental consent or write a specific notation authorizing release of HIV-related information.
Genetic Testing Information
Under the Genetic Privacy Act at N.J.S.A. 10:5-43 through 10:5-49, no one may disclose genetic information in a way that identifies the tested individual unless the person has signed a consent that meets Department of Health requirements.3New Jersey Legislature. Genetic Privacy Act A generic HIPAA release typically won’t cover genetic test results unless it specifically references them.
Psychotherapy Notes
Federal rules draw a sharp line between ordinary mental health treatment records and psychotherapy notes, meaning the private notes a therapist writes during or after a session and keeps separate from the rest of the chart. Under 45 CFR 164.508(a)(2), a provider must obtain a standalone authorization specifically for psychotherapy notes, and that authorization cannot be combined with any other authorization except another one for psychotherapy notes.1eCFR. 45 CFR 164.508 Standard treatment summaries, diagnoses, medications, and session dates are not psychotherapy notes and can be released under a regular authorization.
Substance Use Disorder Treatment
Records from a federally assisted substance use disorder program fall under 42 CFR Part 2, a separate federal regulation with its own consent requirements on top of HIPAA. A Part 2 consent must name the specific recipient, describe the information to be disclosed, state the purpose, and include a notice that the records may be re-disclosed under HIPAA rules except for use in legal proceedings against the patient.4eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records Since 2024, a single consent can cover treatment, payment, and healthcare operations, but it still has to carry the Part 2-specific elements. A standard HIPAA release alone won’t work.
Mental Health Treatment Records
New Jersey law at N.J.S.A. 30:4-24.3 treats mental health records as confidential, with disclosure permitted only under specified circumstances including patient consent. A properly completed HIPAA authorization generally covers mental health treatment records as distinct from psychotherapy notes, but some New Jersey providers require you to check a separate box or add a line specifically authorizing release of mental health treatment information.
Who Can Sign When the Patient Can’t
Competent adults sign their own authorizations. When the patient can’t sign because of age, incapacity, or death, New Jersey recognizes several people who may act on the patient’s behalf.
- Parents and legal guardians sign for patients under 18. The age of majority is set at 18 under N.J.S.A. 9:17B-1. Minors who independently consented to certain treatments, such as substance use care or reproductive health services, may need to personally authorize release of those specific records.5Justia Law. New Jersey Revised Statutes 9:17B-1 – Legislative Findings
- A healthcare representative named in a Durable Power of Attorney for Health Care (sometimes called an advance directive proxy) can sign once the patient’s physician determines the patient cannot make their own decisions.6New Jersey Department of Health. Proxy Directive – Durable Power of Attorney for Health Care
- The executor or administrator of a deceased patient’s estate may authorize release of that patient’s records. This person is typically appointed through the county surrogate’s office during probate.7Legal Information Institute. New Jersey Administrative Code 10:41-5.4 – Records of Deceased Individuals
When someone other than the patient signs, the form must identify the signer’s relationship to the patient and describe their legal authority. Providers usually ask for a copy of the supporting document — the guardianship order, power of attorney, or letters testamentary from surrogate’s court — before they process the request.
Submitting the Form and How Long the Provider Has
Once the form is signed, get it to the provider’s medical records department. Reliable methods include uploading it through a patient portal, sending it by certified mail with return receipt, faxing it and keeping the confirmation page, or dropping it off in person and asking for a date-stamped copy for your file.
New Jersey’s Uniform Electronic Transactions Act at N.J.S.A. 12A:12-1 and following gives electronic signatures the same legal weight as ink signatures on medical record authorizations, so a typed name in a portal or a click-to-sign confirmation counts as long as both you and the provider have agreed to transact electronically.8New Jersey Legislature. Uniform Electronic Transactions Act You can always refuse and submit paper instead.
Hospitals in New Jersey must provide one copy of the medical record from an individual admission within 30 days of receiving a written request, under N.J.A.C. 8:43G-15.3.9Legal Information Institute. New Jersey Administrative Code 8:43G-15.3 – Medical Record Patient Services Physician offices under N.J.A.C. 13:35-6.5 face the same 30-day deadline.10Legal Information Institute. New Jersey Administrative Code 13:35-6.5 – Preparation of Patient Records A provider may furnish a summary instead of the full record if it adequately reflects your history and treatment, and the summary cannot cost more than a full copy would.
What Copies Cost
New Jersey caps what providers can charge, and the caps depend on who holds the records.
For physician offices and other licensed healthcare professionals, N.J.S.A. 45:9-22.27 sets the fee for a patient’s own record request at no more than $1.00 per page or $50.00 for the entire record, whichever is less, regardless of the storage format.11Justia Law. New Jersey Revised Statutes 45:9-22.27 When an authorized third party such as your attorney or insurer requests the records with your consent, the cap is $1.00 per page, or $1.50 per image for microfilm or microfiche. For records under 10 pages, the office may charge up to $10.00 to cover postage and retrieval.10Legal Information Institute. New Jersey Administrative Code 13:35-6.5 – Preparation of Patient Records
Hospital fees follow N.J.A.C. 8:43G-15.3. For the first copy of records from an individual admission requested by the patient or authorized representative, the charge cannot exceed $1.00 per page or $100.00 for the first 100 pages. Pages beyond 100 are capped at $0.25 each, and the total for the entire record cannot exceed $200.00. When the patient authorizes release to a third party, or requests additional copies, the cap is $1.00 per page plus a search fee of no more than $10.00.9Legal Information Institute. New Jersey Administrative Code 8:43G-15.3 – Medical Record Patient Services X-rays and materials that can’t be photocopied carry separate charges based on actual duplication cost plus a small administrative fee.
Canceling an Authorization You Already Signed
You can revoke any authorization you’ve signed, at any time, for any reason. The revocation has to be in writing; a phone call doesn’t count. Deliver it to the provider’s privacy officer or medical records department, and keep a dated copy.12U.S. Department of Health and Human Services. Can an Individual Revoke His or Her Authorization Once the provider receives the written revocation, no further disclosures can be made under that authorization. A revocation does not undo releases that already happened while the authorization was valid — if the office mailed records to your attorney last week, that disclosure stands.