Medical Records Release Form in Florida: Fees and Signatures

A medical records release form in Florida is a written authorization that lets a healthcare provider hand your records to you or to someone you name. Three Florida statutes set the ground rules depending on who holds the records: Section 456.057 for individual practitioners, Section 395.3025 for hospitals and licensed facilities, and Section 400.145 for nursing homes.¹²³ Federal HIPAA rules layer on top, and the form has to satisfy both. Any missing element gives the provider a reason to reject the request, so the specifics matter.

What a Valid Release Form Must Contain

Florida’s main statute requires “written authorization from the patient” before a provider releases records to anyone outside the patient, a legal representative, or another treating provider.¹ The statute itself doesn’t list form elements, so HIPAA fills the gap. A valid release form needs all of the following:

Patient identification: full name, date of birth, and enough detail to locate the correct file.
A description of the records requested. Specifying the type of information (office notes, labs, imaging) and a date range gets a request processed far faster than “all records.”
The name and address of the person or entity receiving the records.
The purpose of the disclosure, such as continuing treatment, an insurance claim, or litigation.
An expiration date or event. An open-ended authorization is invalid under HIPAA. Florida’s Department of Health form defaults to 12 months from signing if the expiration is left blank.⁴⁵
A statement that signing is voluntary and not a condition of treatment.
A notice that you can revoke the authorization in writing at any time.
Your signature (or the signature of your legal representative) and the date.

If you’d rather not draft your own form, the Florida Department of Health publishes a standard template, Form DH-3203, that covers every required element.⁵

Who Can Sign

The default signer is the competent adult patient. When the patient can’t sign, Florida law recognizes several people who can:

A healthcare surrogate named in an advance directive under Chapter 765, once a physician determines the patient lacks capacity. That authority expressly includes access to health information.⁶
An agent under a durable power of attorney, if the document grants healthcare decision-making authority.
A court-appointed guardian with authority over medical decisions.
The personal representative of a deceased patient’s estate. HIPAA gives release authority to the executor, administrator, or another person with legal authority under state law to act for the decedent, and Florida’s hospital statute also allows next of kin to request records from a licensed facility. Expect to provide Letters of Administration or Letters Testamentary.⁷²

Anyone signing in a representative capacity should be ready to hand over documentation. A provider is within its rights to ask for a copy of the advance directive, power of attorney, or guardianship order before releasing anything.

Parents Signing for Minors

Florida’s Parents’ Bill of Rights in Chapter 1014 gives parents and legal guardians the right to access their minor child’s medical records.⁸ That access is broad but carries the qualifier “unless prohibited by law.”

The clearest exception is substance abuse treatment. Under Section 397.501, when a minor voluntarily seeks substance abuse treatment on their own, only the minor can consent to release those records, even for the parent’s own reimbursement purposes. If parental consent was required for the minor to enter treatment, both the parent and the minor must agree to any disclosure.⁹ The rules around minors’ mental health records are less clear-cut; if a provider refuses, ask them to cite the specific statute they’re relying on.

Electronic Signatures

Section 668.50, Florida’s version of the Uniform Electronic Transactions Act, provides that a signature can’t be denied legal effect solely because it’s electronic.¹⁰ A release signed through a patient portal, a PDF with an e-signature, or a secure web form carries the same legal weight as ink on paper.

The practical wrinkle is identity verification. HIPAA doesn’t yet set a final standard for electronic signatures on authorizations, so each provider sets its own policy. Some accept a scanned PDF from a verified email address; others require you to sign through their portal. If a provider rejects your e-signed form, ask which method they do accept rather than assuming you have to appear in person.

What Providers Can Charge

Florida caps copying fees, but the ceiling depends on the type of facility. The rules sit in three separate statutes, which is where most people get tripped up.

Hospitals and Licensed Facilities

Section 395.3025 caps copies of patient records at $1 per page, plus a search fee of up to $1 for each year of records requested. Non-paper records such as X-rays, CDs, and electronic files are capped at $2 per item. Sales tax and actual postage can be added. A patient whose records are being copied for continuing medical care pays no copying or search fee at all.²

Nursing Homes

Section 400.145 uses a tiered rate: up to $1 per page for the first 25 pages, then $0.25 per page after that.³

Individual Practitioners

For doctors, dentists, and other licensed practitioners, Section 456.057 caps charges at “the actual cost of copying, including reasonable staff time, or the amount specified in administrative rule by the appropriate board.”¹ The Florida Department of Health treats the practical ceiling as $1 per page for the first 25 pages and $0.25 for each additional page. A provider cannot condition release on payment of outstanding treatment fees; the statute keeps the two separate.

The Federal $6.50 Option

When you request an electronic copy of your own records that the provider maintains electronically (or direct that copy to a third party you designate), HIPAA lets the provider charge a flat fee of no more than $6.50 covering all labor, supplies, and postage.¹¹ That’s often cheaper than Florida’s per-page rates for a large record set. It applies only to patient-directed requests, not to requests initiated by a third party using your signed authorization.

Your Access Request vs. a Third Party’s Authorization

There’s an important distinction between asking for your own records and authorizing someone else to get them, and understanding it can save real money. When you exercise your personal HIPAA right of access, the provider must produce the records, fees are limited to reasonable cost-based amounts, and the 30-day deadline is mandatory. The same limits apply when you direct the provider to send your records to a specific third party, as long as the request comes from you.¹¹

When a third party initiates the request on its own behalf using your signed HIPAA authorization, the federal fee limits don’t apply. An insurance company or law firm requesting records that way can be charged higher rates. A provider can’t sidestep the lower fee cap by handing you a HIPAA authorization form when you’re actually exercising your own right of access.¹¹

The practical move: if you need records sent to your attorney, write the access request yourself directing the provider to send the records to the attorney’s office. That keeps the transaction under the right-of-access fee limits rather than the uncapped third-party authorization rates.

How Fast Providers Must Respond

Both Florida statutes require records “in a timely manner, without delays for legal review,” without defining “timely.”¹² The hard number comes from federal law: HIPAA requires covered entities to act on an access request within 30 calendar days.¹²

A provider that can’t meet the 30-day window gets one 30-day extension, but only if it notifies you in writing before the original deadline expires. The notice has to explain the reason for the delay and give a specific date by which records will be ready. A provider that runs past 60 days without producing records or a written explanation is violating federal law.

Sensitive Records Need Specific Language

Two categories of records carry protections that go beyond ordinary HIPAA, and a standard Florida release form may not be enough to unlock them.

Psychotherapy Notes

HIPAA gives psychotherapy notes separate, heightened protection. These are a therapist’s private session notes kept apart from the rest of the record. A provider generally can’t disclose them for any purpose without a specific authorization from the patient, even for treatment.¹³ A general authorization to release “all medical records” will not cover psychotherapy notes. You need a separate authorization that names them.

Substance Use Disorder Treatment Records

Records from federally assisted substance use disorder programs are governed by 42 CFR Part 2. A consent form has to include specific elements: the patient’s name, the person authorized to disclose, a meaningful description of the information, each purpose, the right to revoke, and an expiration date or event. Consent for SUD counseling notes can only be combined with other SUD counseling note consents; you can’t bundle it into a general medical records release. Any recipient must be warned that federal law prohibits redisclosure without separate consent or a court order.¹⁴

Revoking a Release

You can revoke a records release at any time. The revocation has to be in writing and delivered to the provider or the records department. Include your name, date of birth, a clear statement that you are revoking the previously signed authorization, and your signature.

Revocation takes effect when the provider receives the written notice, and it is not retroactive. Any records already sent under the original authorization remain lawfully disclosed. If a copy went out the door before the provider received your revocation, the provider did nothing wrong, and you’d need to contact the recipient separately about not using or sharing the information further.

When a Provider Won’t Comply

If a provider ignores your request or blows past 30 days without a written explanation, you have two complaint paths.

For Florida-licensed practitioners, complaints go to the Florida Department of Health. Before filing, send a certified letter to the provider requesting the records and keep the return receipt. If you still haven’t received the records after 30 business days, file a complaint with the Department and include a copy of your letter and the signed return receipt. Outcomes range from a reprimand to license revocation.¹⁵

For federal HIPAA right-of-access violations, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. OCR has brought over 50 enforcement actions through its Right of Access Initiative, including a late-2025 settlement in which a provider paid $112,500 after an individual made six requests over more than a year before finally getting their records.¹⁶ These cases can take years, but the financial consequences for providers are real.

1
Justia. Florida Code 456 – Ownership and Control of Patient Records
2
Florida Senate. Florida Code 395 – Patient and Personnel Records; Copies; Examination
3
The Florida Legislature. Florida Statutes 400.145 – Copies of Records of Care and Treatment of Resident
4
HHS.gov. Must an Authorization Include an Expiration Date
5
Florida Department of Health. Authorization to Disclose Confidential Information
6
The Florida Legislature. Florida Statutes Chapter 765 – Health Care Advance Directives
7
U.S. Department of Health & Human Services (HHS). Health Information of Deceased Individuals
8
The Florida Legislature. Florida Statutes 1014 – Parents’ Bill of Rights
9
Florida Senate. Florida Statutes 397.501 – Rights of Individuals
10
The Florida Legislature. Florida Statutes 668.50 – Uniform Electronic Transaction Act
11
HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information
12
U.S. Department of Health & Human Services (HHS.gov). How Timely Must a Covered Entity Be in Responding to Individuals Requests for Access to Their PHI
13
U.S. Department of Health & Human Services (HHS). Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information
14
eCFR. Part 2 – Confidentiality of Substance Use Disorder Patient Records
15
Florida Department of Health. Complaints and Enforcement
16
HHS.gov. HHS Office for Civil Rights Settles HIPAA Right of Access Investigation With Concentra Inc