The NYS HIPAA authorization form, OCA Official Form 960, is New York’s standardized document for telling a healthcare provider to release your protected health information to someone else — an attorney, an insurance adjuster, a new physician, or a government agency. You fill it out by working through numbered boxes that identify you, the provider holding the records, the person receiving them, what categories of information are being released, why, and when the authorization expires. You then sign it and deliver it to the medical records department of the provider named on the form. The blank PDF is available free from the New York State Unified Court System at nycourts.gov/forms.
Filling Out the Boxes
The top section asks for your full legal name, date of birth, the last four digits of your Social Security number, and current mailing address. If you’re incarcerated, use the facility address.
From there, work through the numbered boxes:
- Box 7 — who holds the records. Write the full name of the provider, hospital department, clinic, or facility. Be specific. “Radiology Department, NYU Langone” beats “NYU Langone.”
- Box 8 — who receives them. Full name and mailing address of the recipient. Adding a fax number speeds delivery if you’re not sending a separate cover letter.
- Box 9 — what to release. Check or describe the categories you want disclosed. This box also has separate lines for sensitive categories that need your initials (covered below).
- Box 10 — why. “At the request of the individual” is enough if the records are for you. For a claim or transfer of care, a short phrase like “personal injury claim” or “continuity of care” works.
- Box 11 — expiration. HIPAA requires either a specific date or a triggering event. Common entries: “one year from date of signature,” “conclusion of litigation,” or an exact calendar date. Don’t leave this blank. An authorization without an expiration can be treated as invalid.
- Signature and date. No notary or witness required. If someone signs on the patient’s behalf, boxes 12 and 13 must also be filled in with the signer’s name and relationship or authority.
Sensitive Categories That Need Your Initials
Three types of records carry extra protection in New York, and a signature alone won’t release them. You have to initial the corresponding line in Box 9, or the provider will redact those records from what it sends.
HIV-Related Information
Under New York Public Health Law § 2782, HIV test results, diagnoses, and related treatment records are confidential and require a dated, written authorization naming who may disclose, what will be disclosed, and why. When HIV records are sent, state law requires a written notice — with the disclosure or within ten days after — warning the recipient that further disclosure without your written consent is illegal and can carry fines or jail time.
Mental Health Records
Clinical records from state-operated or state-licensed mental health programs fall under Mental Hygiene Law § 33.13, which bars outside disclosure except in limited circumstances. Written consent is one of them, but the law adds that the recipient must have a “demonstrable need” for the records and the release must not be reasonably expected to harm you or another person. For most litigation or benefits purposes, initialing the mental health line meets that standard.
Alcohol and Drug Treatment Records
Substance use disorder treatment records are protected by 42 CFR Part 2, a federal regulation that runs independently of HIPAA and is stricter in several ways. A Part 2 disclosure must be accompanied by a notice and a copy of the consent, and the recipient generally can’t re-disclose the records without fresh consent. Initialing the alcohol/drug line on Form 960 signals your intent, but some treatment programs will still ask you to sign their own Part 2 consent on top of the OCA form.
Signing on Someone Else’s Behalf
When the patient can’t sign, several categories of people can:
- Parents and legal guardians of an unemancipated minor. Under Public Health Law § 18, that access covers care the parent consented to or emergency care. If the minor lawfully consented to treatment on their own — certain reproductive health or mental health services, for example — the parent may not have automatic access to those records.
- Health care agents named in a valid New York Health Care Proxy, when the patient lacks capacity. Expect the provider to ask for a copy of the proxy.
- Holders of a Power of Attorney that specifically grants authority over healthcare information or legal affairs. A general financial POA without health-related language isn’t enough.
- Personal representatives of a deceased patient — an executor or administrator with Letters Testamentary or Letters of Administration from a Surrogate’s Court.
Whoever signs in a representative capacity fills in Boxes 12 and 13 and attaches a copy of the document that establishes their authority. Providers must treat a properly documented representative as they would the patient, but they won’t process the form without the proof.
Where to Send It and How Long the Provider Has
Send the completed form to the medical records department of the provider named in Box 7. You can hand-deliver, mail, fax, or upload through a secure patient portal if the provider offers one. Certified mail with return receipt is worth the extra cost when the records matter for litigation — it gives you dated proof of delivery if the provider later stalls.
Public Health Law § 18 requires providers to give you the chance to inspect your records within ten days of a written request. For copies going to a third party, the statute uses the phrase “reasonable time,” and the New York State Department of Health treats ten to fourteen days as reasonable. Nursing homes are on a tighter clock: under 10 NYCRR § 415.3, a residential health care facility must make clinical records available for inspection within twenty-four hours and provide photocopies within two working days.
What Copies Cost
New York caps paper copies at seventy-five cents per page, plus postage. Providers can charge for the labor of producing copies, but not above that per-page ceiling. For your own records in electronic format, the federal HIPAA rule applies instead: only a reasonable, cost-based fee covering labor to create and deliver the electronic copy, supplies, and postage. Search, retrieval, and review charges aren’t allowed for patient-directed requests.
Attorney-initiated requests through an authorization, subpoena, or court order are handled under state fee schedules rather than the HIPAA cost-based cap, and providers routinely add search-and-retrieval fees. If your lawyer orders the records instead of you, the bill will usually be higher.
Canceling the Authorization
You can revoke a Form 960 authorization at any time by sending a written revocation to the provider that received the original. There’s no special form. A signed letter withdrawing the authorization, referencing the date you signed it and the recipient named on it, is enough. It takes effect once the provider receives and processes it.
Revocation only stops future disclosures. Anything the provider already sent before receiving the revocation can’t be clawed back. If timing is tight, fax or hand-deliver the revocation so it lands the same day.
If a Provider Refuses or Drags Its Feet
You have two options when a provider ignores a valid Form 960, charges an unreasonable fee, or refuses to release records without a good reason.
Federally, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at ocrportal.hhs.gov. The complaint has to be filed within 180 days of when you learned about the violation. You’ll name the provider, describe what happened, and sign electronically or on paper.
At the state level, the New York State Department of Health handles complaints against providers licensed in New York, including persistent refusals to comply with PHL § 18. When the records are needed for active litigation, your attorney can also ask the court to compel production, which usually moves faster than a regulatory complaint.