The Pennsylvania HIPAA release form, published by the Department of Human Services as form HS 1815, lets you authorize a provider, insurer, or state agency to share your medical records with someone you name. You can download it from the DHS HIPAA privacy page. Hospitals and health plans often use their own versions, and any of them will work as long as the required elements are filled in correctly.1Commonwealth of Pennsylvania Department of Human Services. Pennsylvania HIPAA Authorization Form
Filling Out HS 1815 Section by Section
Section 1 covers patient identification: name, date of birth, phone number, address, and ID number. The form leaves space to label the type of ID number, so you can enter a Medicaid ID, insurance member ID, or medical record number. A Social Security number is not specifically required.
Part A is where you describe the records. Name the specific documents, the time period, and who will receive them. “Therapy records from Dr. Smith’s office, January 2023 through December 2024” is the kind of description a records department can act on. Vague requests like “all my records” tend to come back for clarification and delay the release.
Section A.3 sets when the authorization expires. You can choose “once acted upon” for a one-time release, or write in a date or event such as “one year from the date signed” or “upon resolution of litigation.” Leaving this section blank makes the authorization invalid under federal rules.2U.S. Department of Health and Human Services. Must an Authorization Include an Expiration Date?
Section 2 asks the purpose of the disclosure. If you are requesting records for yourself, say so. If they are for a life insurance application, a disability claim, or a legal proceeding, name that purpose.
The “Understandings” block is pre-printed. It notifies you that you can revoke the authorization in writing, that the provider generally cannot condition treatment on whether you sign, and that once records are disclosed the recipient may re-disclose them and they may lose federal privacy protection. Read it, but there is nothing to fill in.3eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
Sign and date at the bottom. If someone is signing as your personal representative, that person also has to describe the source of their authority.
The Three Special-Category Checkboxes in Part B
Pennsylvania adds extra protection for HIV, mental health, and drug and alcohol records. A general release does not reach them. Part B of HS 1815 handles all three with separate yes-or-no prompts, and you have to answer each one for those records to be included.
HIV and AIDS Records (Part B.3)
Under the Confidentiality of HIV-Related Information Act, a general medical authorization is explicitly not enough. The consent has to identify the discloser, the recipient, the patient, the purpose, the type and amount of information, and an expiration. When HIV records are released, they must go out with a written notice warning the recipient that further disclosure is prohibited without another consent.4Pennsylvania General Assembly. Pennsylvania Code Title 35 P.S. Health and Safety 7607 – Confidentiality of Records
Marking “Yes” in Part B.3 satisfies that specific-consent requirement on this form. If you are using a hospital’s own template, check that it includes an HIV-specific acknowledgment. Many do not, and without it the provider will refuse to release those records.
Mental Health Records (Part B.2)
Facilities covered by the Pennsylvania Mental Health Procedures Act need a consent that includes start and end dates, the recipient’s identity, the specific purpose, a description of the information, and the patient’s signature. The consent must also note the right to revoke in writing.5Pennsylvania Code. 55 Pa. Code 5100.34 – Consensual Release to Third Parties Part B.2 lets you confirm or decline this release. If a provider’s own form has no separate mental health prompt, expect to complete a standalone release.
Drug and Alcohol Treatment Records (Part B.1)
Pennsylvania’s drug and alcohol confidentiality statute bars release of treatment records without patient consent, aside from narrow exceptions like medical emergencies or communications with treating medical personnel.6Pennsylvania General Assembly. Pennsylvania Code Title 71 P.S. State Government 1690.108 – Confidentiality of Records Federal rules under 42 CFR Part 2 add that consent for substance use disorder counseling notes cannot be combined with consent for other records, and that a consent for a legal proceeding must stand alone.7eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
The Part B.1 checkbox is fine for routine disclosures. Litigation or release of counseling notes will need its own consent form.
Who Signs When the Patient Can’t
A parent or legal guardian signs for a child under 14. Pennsylvania’s Minors’ Consent Act lets individuals 14 and older consent to their own inpatient or outpatient mental health treatment, which means they also control the release of those mental health records.8Pennsylvania General Assembly. Pennsylvania Code – Allowing Minors to Consent to Medical Care – Section 1.1 Mental Health Treatment
For an incapacitated adult, a healthcare power of attorney or court-appointed guardian may sign. For a deceased patient, the executor or administrator of the estate signs as personal representative. The Privacy Rule protects a decedent’s health information for 50 years after death, so a personal representative has to authorize disclosures during that window. Where no executor has been appointed, next of kin may have authority depending on Pennsylvania law.9U.S. Department of Health and Human Services. Personal Representatives
Bring documentation of your authority, such as a court appointment letter, power of attorney, or letters testamentary, so the provider can verify it.10U.S. Department of Health and Human Services. Health Information of Deceased Individuals
Where to Send It
Deliver the completed form to the Health Information Management or Medical Records department of the facility holding the records. Common submission methods are the provider’s patient portal, direct fax to medical records, or physical mail. If you mail it, certified mail with a return receipt gives you proof of delivery and a start date for the response clock.
Each provider needs its own authorization. A primary care doctor and a specialist at different practices get separate forms.
How Long the Provider Has and What It Can Charge
Federal law gives a provider 30 days from receiving your request to act on it. One 30-day extension is allowed, but only if the provider sends you a written explanation and a firm date the records will be ready. No second extension is available.11eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
HIPAA caps fees at a reasonable, cost-based amount for labor, supplies, and postage. Pennsylvania sets its own per-page ceilings under 42 Pa. C.S. ยง 6152, adjusted annually. Effective January 1, 2026, the maximum charges are:
- Pages 1 through 20: $2.00 per page
- Pages 21 through 60: $1.48 per page
- Pages 61 and beyond: $0.52 per page
- Microfilm copies: $2.95 per page
- Search and retrieval: $29.61 (not chargeable when you request your own records)
- Social Security or needs-based benefit claims: $37.52 flat fee
- District attorney requests: $29.61 flat fee
Providers may also charge actual postage. These caps apply whether the records are stored on paper or electronically.12Pennsylvania Department of Health. Medical Record Fees
Revoking the Authorization
You can cancel an active authorization at any time by sending a written revocation to the provider that received the original form. Address it to the facility’s privacy officer and include your name, date of birth, and the date of the original authorization so they can find it. Revocation takes effect when the provider receives it, not when you mail it.13U.S. Department of Health and Human Services. Can an Individual Revoke His or Her Authorization?
Revocation does not undo disclosures that already happened. If records went to your attorney on Tuesday and you revoke on Friday, the Tuesday release stands. Only future sharing under that authorization stops.
If a Provider Refuses to Release Records
You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights within 180 days of learning about the problem. OCR can extend that deadline for good cause. Complaints can be filed through the OCR Complaint Portal, by email to OCRComplaint@hhs.gov, or by mail to Centralized Case Management Operations at HHS in Washington, D.C.14U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint
The complaint has to name the provider, describe what happened, and include your contact information. OCR does not investigate anonymous complaints, and providers are prohibited from retaliating against you for filing.