If you searched for a release of information form pdf, most of what you found is one hospital's form, written for its records department, or a general template made for medical offices. Neither is built for a therapy practice. Below is a complete release of information form, a HIPAA authorization, that you can copy onto your letterhead and save as a PDF: every core element and required statement from the federal rule, in plain words, one field per line. After the form you'll find the regulation's own list, how to fill in each part, when you need a release and when HIPAA lets you share without one, and the cases that trip therapists up: psychotherapy notes, substance use records, minors, revocation, expiration and keeping a record of what you shared.
What a release of information form is (and isn't)
A release of information form, often shortened to ROI and also called a HIPAA release or a HIPAA authorization, is your client's written permission for you to share their health information with a named person, for a purpose the client agrees to. HIPAA calls it an "authorization," and the rule for it is 45 CFR 164.508.
It gets confused with three other documents:
- Informed consent to treatment.This explains your services, fees, risks and the limits of confidentiality. Our informed consent example covers it. HIPAA doesn't let you combine an authorization with another kind of document, such as a consent form, into a "compound authorization," apart from narrow exceptions (45 CFR 164.508(b)(3)), so the release stays on its own form.
- A general "consent" for treatment, payment and operations.Some practices collect one. HHS is clear that it "is not a valid permission to use or disclose protected health information for a purpose that requires an 'authorization'" (HHS, Uses and Disclosures for Treatment, Payment, and Health Care Operations).
- A client asking for their own records.That's the client's right of access, which has its own rules and deadlines (45 CFR 164.524). A client getting a copy of their own record doesn't need to sign an authorization.
HIPAA applies to you as a covered entity if you, or a billing service for you, send health information electronically for standard transactions such as insurance claims or eligibility checks. If you don't, state confidentiality law and your ethics code still require the client's permission before most disclosures, and a form that meets HIPAA's standard is the safe default.
What 45 CFR 164.508(c) requires on the form
A valid authorization needs six core elements and three required statements. Here is the regulation's list, quoted from 45 CFR 164.508(c). The section hasn't been amended since 2013.
Core elements, 164.508(c)(1): "A valid authorization under this section must contain at least the following elements:"
(i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.
(ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.
(iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure.
(iv) A description of each purpose of the requested use or disclosure. The statement "at the request of the individual" is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.
(v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement "end of the research study," "none," or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository.
(vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided.
Required statements, 164.508(c)(2): "In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following:"
(i) The individual's right to revoke the authorization in writing, and either: (A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by § 164.520, a reference to the covered entity's notice.
(ii) The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating either: (A) The covered entity may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization when the prohibition on conditioning of authorizations in paragraph (b)(4) of this section applies; or (B) The consequences to the individual of a refusal to sign the authorization when, in accordance with paragraph (b)(4) of this section, the covered entity can condition treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization.
(iii) The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this subpart.
The same section adds four rules that shape the form:
- Plain language."The authorization must be written in plain language" (164.508(c)(3)).
- A copy for the client.When you are the one asking for the authorization, you "must provide the individual with a copy of the signed authorization" (164.508(c)(4)).
- Defects make it invalid.An authorization isn't valid if its expiration date has passed, if a core element is left blank, if you know it has been revoked or holds false material information, or if it breaks the rules on combining forms or conditioning care (164.508(b)(2)).
- Marketing and sales of information.Marketing needs an authorization, and when a third party pays for it, the form must say so. A sale of health information must say the disclosure is paid (164.508(a)(3) and (a)(4)). Neither comes up often in a therapy practice.
Release of information form template (copy it)
Copy this into your word processor, add your practice name and logo, delete the lines you don't need, and keep the order. Square brackets are yours to fill in. After the template, a short list shows which part meets which element of the rule.
Which part meets which element of 164.508(c):
- Part 3 is the description of the information, (c)(1)(i). The dates line and the checkboxes make it "specific and meaningful."
- Part 1 names who may disclose, (c)(1)(ii).
- Part 2 names who may receive, (c)(1)(iii). A class of persons is allowed, such as "my treating providers at Lakeside Psychiatry."
- Part 5 is the purpose, (c)(1)(iv). "At my request" works only when the client starts the request.
- Part 6 is the expiration date or event, (c)(1)(v).
- Part 8 is the signature and date, (c)(1)(vi), with the representative's authority when someone signs for the client.
- Part 7, items 1 to 3 are the three required statements, (c)(2)(i) to (iii). Item 5 meets the copy rule, (c)(4).
- Part 4 and the initials lines aren't required by HIPAA. They narrow the scope, and some states require specific permission for categories such as HIV-related information.
Two cases need different wording. If you do an evaluation only to produce a report for someone else, such as a court-ordered or employer-requested evaluation, HIPAA lets you make the evaluation depend on the authorization (45 CFR 164.508(b)(4)(iii)). Item 2 then has to state the consequence instead, for example: "This evaluation is done only to prepare a report for the person named in Part 2. If you do not sign, we cannot do the evaluation." Have your lawyer check that wording. And if your practice is a 42 CFR Part 2 program, substance use records need a Part 2 consent, covered below.
How to save it as a PDF, a fillable form or an online form
- PDF.Paste the template into Word or Google Docs, put your letterhead at the top, and export it as a PDF. Use a readable type size: California requires a release to be handwritten or set in "a typeface no smaller than 14-point type" (Cal. Civil Code 56.11), so 14 point works everywhere.
- Fillable PDF.Add text fields and checkboxes with a PDF editor, and leave the signature as its own field.
- Length.One page is ideal and two is the most you need. Clients read a short form; long ones get signed unread, which is what the plain language rule is trying to prevent.
- Electronic signatures.HIPAA requires a signature and a date, but it doesn't say the signature has to be in ink. Many practices rely on the federal ESIGN Act and their state's electronic signature law. The Part 2 rule for substance use records says it directly: "Electronic signatures are permitted to the extent that they are not prohibited by any applicable law" (42 CFR 2.31(a)(8)). Whatever method you use should show who signed and when. Ask your lawyer whether it holds up in your state.
How to fill in each part: weak and better lines
Most defective releases fail on the same four lines. Here are invented examples of each, with a better version.
What may be shared
- Weak: "Any and all records."
- Better: "Dates of attendance and diagnosis, January 1 to June 30, 2026."
A whole-record release can be valid, and New York's court form offers one. But in therapy it rarely matches the purpose, and it sends a lawyer or an employer far more than they need. Match the information to the purpose.
Who may receive it
- Weak: "My doctor."
- Better: "Dr. Priya Shah, psychiatrist, Lakeside Psychiatry, 200 Main Street, Springfield."
Purpose
- Weak: left blank.
- Better: "To coordinate medication and therapy." When the client starts the request and doesn't want to give a reason, "At my request" is enough.
When it ends
- Weak: "None" or "Never."
- Better: "December 31, 2026," "When my therapy at [practice] ends," or "When my disability claim is decided."
"None" is a valid expiration only for research. For anything else, a blank or "none" makes the form defective.
Signature by someone else
- Weak: a parent's signature with nothing else.
- Better: "Maria Lopez, mother; parent of a minor with authority to consent to treatment under [state] law."
When you need a release, and when HIPAA permits sharing without one
HIPAA lets you share some information without an authorization. State law, your license rules and your own consent form can be stricter, and many state mental health confidentiality laws are. Use this list as the federal starting point, not the final word.
HIPAA generally permits these without an authorization:
- Treatment.Coordinating care with or consulting another provider, including a referral. HHS: "A covered entity may disclose protected health information for the treatment activities of any health care provider (including providers not covered by the Privacy Rule)" (HHS; 45 CFR 164.506). Example: talking with a client's psychiatrist about how a new medication is going.
- Payment.Claims, eligibility checks and medical necessity reviews with the client's insurer.
- Health care operations.Quality review, case review, training and running the practice, including vendors that sign a Business Associate Agreement.
- Family or friends involved in care.Information "directly relevant to such person's involvement" with the client's care, usually after the client has had a chance to agree or object (45 CFR 164.510(b)).
- Required by law and public interest.Abuse and neglect reports, court orders, health oversight, and disclosures to prevent a serious and imminent threat (45 CFR 164.512). A subpoena without a court order isn't enough by itself: HIPAA requires "satisfactory assurance" about notice to the client or a protective order (164.512(e)), and many states add rules for mental health records.
You need an authorization for:
- A client's lawyer, employer, school staff or a life or disability insurer, outside the permissions above.
- Family members who aren't involved in care, or anything beyond what their involvement needs.
- Psychotherapy notes, with narrow exceptions.
- Marketing, sales of health information, and most research.
- Anything else not covered by a specific permission.
In practice, many therapists ask for a signed release before any outside conversation, even one HIPAA would allow for treatment. It keeps the client in charge of their story, and it covers you where state law is stricter. If you do share for treatment without a release, write down who you spoke to and why.
Psychotherapy notes need their own authorization
HIPAA defines psychotherapy notes as notes "documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record" (45 CFR 164.501). The definition leaves out "medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date." Progress notes such as a DAP note are part of the record, not psychotherapy notes.
Three rules follow:
- An authorization is needed for almost any use or disclosure of psychotherapy notes (45 CFR 164.508(a)(2)). The exceptions are narrow: your own use in treating the client, supervised training programs, defending yourself in a legal action the client brings, and a few others: to HHS for a compliance investigation, as required by law, for oversight of the notes' author, to a coroner or medical examiner, or to prevent a serious threat.
- It goes on its own form. An authorization for psychotherapy notes "may only be combined with another authorization for a use or disclosure of psychotherapy notes" (164.508(b)(3)(ii)).
- A health plan can't require it for enrollment or eligibility (164.508(b)(4)(ii)).
Few requests truly need psychotherapy notes. A treatment summary usually meets the purpose and shares far less. If a client does want them sent, use this:
Substance use records and 42 CFR Part 2
Substance use disorder records can carry a second federal rule, 42 CFR Part 2, which is stricter than HIPAA in places. It applies to federally assisted programs, and its coverage includes "private practitioners who hold themselves out as providing, and provide substance use disorder diagnosis, treatment, or referral for treatment" (42 CFR 2.12). Federal assistance includes, for example, being a participating provider in Medicare or holding a federal registration to dispense controlled substances for substance use treatment. Whether a general therapy practice counts depends on how it presents its services and its federal ties, so ask a lawyer before you assume either way.
If you are a Part 2 program, use a Part 2 consent for those records. Its required elements in 42 CFR 2.31 overlap with HIPAA's but aren't identical:
- The patient's name, who may disclose, a specific description of the information, the recipients and each purpose.
- The right to revoke in writing, and how.
- An expiration date or event. For a consent to treatment, payment and health care operations, "end of the treatment," "none," or similar language is enough.
- The patient's signature (with special rules for minors) and the date signed.
- For a treatment, payment and operations consent, statements about redisclosure and "the consequences to the patient of a refusal to sign the consent."
- When the recipient is a HIPAA covered entity or business associate receiving records for treatment, payment or operations, a statement that the record may be redisclosed under HIPAA, except for proceedings against the patient.
Since the 2024 update, one consent can cover all future uses and disclosures for treatment, payment and health care operations. HHS set February 16, 2026 as the compliance date (HHS, Fact Sheet 42 CFR Part 2 Final Rule). Part 2 also gives substance use counseling notes the same separate-consent treatment HIPAA gives psychotherapy notes (2.31(b)).
Even if you aren't a Part 2 program, records you receive from one arrive with a notice that limits what you can do with them. That notice says "A general authorization for the release of medical or other information is NOT sufficient to meet the required elements of written consent to further use or redisclose the record" (42 CFR 2.32). Keep those records apart and don't pass them on under your general release.
Minors and personal representatives
When someone has legal authority to make health care decisions for a client, HIPAA treats that person as the client's "personal representative," and they sign the authorization (45 CFR 164.502(g)). The form must then describe their authority, which is what the representative lines in Part 8 are for.
For minors, a parent or guardian is usually the personal representative, with exceptions that matter in therapy. HHS gives this one: "A State law provides an adolescent the right to obtain mental health treatment without the consent of his or her parent, and the adolescent consents to such treatment without the parent's consent" (HHS, Personal Representatives). In that case the minor, not the parent, controls the information about that care, and the minor signs the release. Other exceptions include a court giving decision-making authority to someone else, and a parent agreeing to a confidential relationship between the minor and the therapist.
Part 2 has its own rule: where state law lets a minor get substance use treatment alone, "any written consent for use or disclosure ... may be given only by the minor patient"; where state law requires a parent's consent to treatment, both the minor and the parent sign (42 CFR 2.14).
Check your state's minor consent law, and for divorced or separated parents, the custody order, before you decide who signs. The same care applies to adults with a guardian and to the personal representative of a client who has died.
Revocation and expiration
Revocation. A client "may revoke an authorization provided under this section at any time, provided that the revocation is in writing, except to the extent that ... the covered entity has taken action in reliance thereon" (45 CFR 164.508(b)(5)). When a revocation arrives:
- Write the date you received it on the revocation and file it with the original authorization.
- Stop sharing under that authorization from that moment.
- Note the revocation in the client's record, and mark the release as revoked wherever you track releases.
- If you share information regularly with the recipient, consider telling them you no longer have permission, without saying more than that.
If a client tells you in session to stop, stop, note it, and ask for it in writing so the record is complete. A short form helps:
Expiration. Every authorization needs an end date or an end event that relates to the client or the purpose, and once that passes, the form is no longer valid (164.508(b)(2)). Practical defaults:
- Ongoing coordination with a psychiatrist or primary care provider: 12 months, or when therapy ends, whichever comes first.
- A single letter for a lawyer, school or employer: one time only, ending when the letter is sent or within 90 days.
- A claim or a case: when the claim is decided or the case ends.
Some state laws and many organizations set their own maximum length. Put a review date in your calendar, not just on the form.
How to document disclosures
Releases are only half the record. The other half is what you actually shared.
- Keep the signed authorization. "A covered entity must document and retain any signed authorization" (164.508(b)(6)), for "six years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.530(j)). State record retention rules for therapy records are often longer; keep the release as long as the record.
- Keep revocations with the release they revoke.
- Log disclosures. Clients have a right to an accounting of certain disclosures from the past six years (45 CFR 164.528). Disclosures under an authorization and for treatment, payment and operations are exempt, but disclosures made under 164.512, such as responses to subpoenas and court orders, abuse reports and health oversight requests, must be listed with "the date of the disclosure," the recipient, "a brief description of the protected health information disclosed," and the purpose. You have 60 days to respond to a request for one. A single log for every disclosure makes that easy.
- Write a contact note in the client's record for each conversation or letter: who, what, and the permission you relied on.
A log entry you can copy:
State forms and stricter state rules (including New York's form)
HIPAA lets a state law that gives clients more privacy protection take priority, so state rules on mental health records, HIV status, substance use and minors often add requirements. Three state examples show the range.
New York. When people search for the "NYS HIPAA form PDF," they usually mean OCA Official Form No. 960, "Authorization for Release of Health Information Pursuant to HIPAA", from the New York State Unified Court System. Its header notes, "This form has been approved by the New York State Department of Health." The instructions say it was designed "to authorize the release of health information needed for litigation in New York State courts," that it "can, however, be used more broadly than this," and that "the form is optional." What's on it:
- Patient name, date of birth, Social Security number and address.
- Initials lines in Item 9(a) to include alcohol and drug treatment, mental health information and HIV-related information. Without initials, those categories aren't released.
- An exclusion for psychotherapy notes, both in the opening statements and in the "Entire Medical Record" checkbox.
- Item 9(b), a separate box that authorizes a named provider to discuss the patient's health information with an attorney or a government agency.
- The reason for release, an expiration date or event, and the signer's authority if the signer isn't the patient.
For HIV-related information, New York's Department of Health also publishes DOH-2557, "Authorization for Release of Health Information and Confidential HIV-Related Information". If a New York client's attorney sends you Form 960, check that every item is complete, including the initials for mental health information, before you send anything. For clinical coordination, your own form works fine.
California. The Confidentiality of Medical Information Act sets its own conditions for a valid authorization, including type no smaller than 14 point, language "clearly separate from any other language present on the same page," and a signature that "serves no other purpose than to execute the authorization" (Cal. Civil Code 56.11).
Texas. The Texas Attorney General publishes a standard form for electronic disclosure of health information under the Texas Medical Records Privacy Act. The form itself says covered entities "may use this form or any other form that complies with HIPAA, the Texas Medical Privacy Act, and other applicable laws" (Texas Attorney General, Patient Privacy).
In other states, look up your mental health confidentiality statute, HIV and genetic information rules, and minor consent law, or ask your professional association or liability insurer whether it publishes a state version.
Common release of information mistakes
- "Any and all records" when the purpose needs one letter.
- No end date, or "none" on a release that isn't for research.
- Missing required statements: revocation, conditioning or redisclosure.
- The release buried in the intake packet under one signature with consent and policies.
- Psychotherapy notes in a general release. They need their own form.
- Using an expired or revoked release. Check the date before every disclosure, not only the first.
- Sending more than the form lists, such as full progress notes when the form says "summary of progress."
- Not giving the client a copy of a release you asked for.
- Treating a subpoena as permission. It isn't an authorization; call your lawyer or your liability insurer's risk line.
- A parent signing for information the minor controls under state law.
How this works in TranqBay
TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and a form library in one place.
- A release of information template is in the form library.The library has ready-made templates you send to a client for a session, including a therapy intake form, consent to treat, telehealth consent and release of information. The client fills them in online, and the answers wait with the session.
- What the release template asks.The client names the person or organization, gives their role (a psychiatrist, for example) and their phone number or email, chooses what can be shared (attendance, diagnosis, treatment plan, progress updates, risk information), says how long the permission should last, and answers yes or no to giving permission. The form tells the client they can withdraw permission at any time.
- Know what it is and isn't.It is a yes or no permission the client fills in, not the signed authorization above: it has no signature line, no purpose field and none of the required statements. It suits coordinating care with another professional, the case where HIPAA already permits treatment disclosures but you want the client's choice on record. For a lawyer, an employer, a school, an insurer or psychotherapy notes, use the full form above with a signature. Ask your lawyer whether the online permission meets your state's rules for coordination.
- A Business Associate Agreement.TranqBay signs one with you; you can read TranqBay's Business Associate Agreement before you store any client information.
You can see the booking page and client portal your clients would use, at your own web address, on practice.tranqbay.health, before you set anything up.
Frequently asked questions about release of information forms
Do I need a release to talk to my client's psychiatrist?
HIPAA permits sharing for treatment without an authorization, and talking with a client's psychiatrist about their care is treatment. Your state's mental health confidentiality law may be stricter, and most clients expect to be asked, so many therapists get a release anyway.
How long is a release of information valid?
Until the date or event written on it. HIPAA doesn't set a maximum, but some states and organizations do. "None" is allowed only for research, so a therapy release always needs a real end date or event.
Can a client revoke a release?
Yes, at any time, in writing. Revoking stops future sharing but doesn't undo what you already shared while relying on it.
Can a client sign a release electronically?
HIPAA requires a signature and a date but not ink. Electronic signatures are widely used under the federal ESIGN Act and state law, and Part 2 permits them where no law prohibits them. Check your method with your lawyer.
Does a general release cover psychotherapy notes?
No. Psychotherapy notes need their own authorization, which can be combined only with another psychotherapy notes authorization.
Can I use New York's OCA Form 960 in my practice?
It's an optional form built for litigation, and its instructions say it can be used more broadly, so you'll often see it from attorneys. For your own releases, a form written for therapy, like the template above, usually fits better. Have a New York lawyer check your choice.
What if a lawyer sends their own release form?
Check it against the six core elements and three statements before you rely on it, along with any state requirements. If anything is missing, ask for a corrected form or have the client fill in yours.
Do I need a separate release for each person?
Not always: HIPAA lets you name a class of persons, such as "my treatment team at Lakeside Psychiatry." But a separate release for each recipient is easier to track, revoke and explain to the client.
Before you send the next release
Copy the template, add your letterhead, have a lawyer in your state check it once, and save it as a PDF. Then keep the habit that makes it work: check the release before each disclosure, share only what it lists, and log what you sent.
If you'd like booking, video sessions, notes and client forms in one place, see how TranqBay works for private practice: you can look at the practice website templates and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.
Sources
Regulations 10HHS 4States 4
Laws and regulations10
- 145 CFR 164.508: uses and disclosures for which an authorization is required (eCFR)ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
- 245 CFR 164.501: definitions, including psychotherapy notes (eCFR)ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.501
- 345 CFR 164.502(g): personal representatives (eCFR)ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
- 445 CFR 164.506: treatment, payment and health care operations (eCFR)ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506
- 545 CFR 164.510: family and others involved in care (eCFR)ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.510
- 645 CFR 164.512: disclosures without authorization (eCFR)ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512
- 745 CFR 164.524: right of access (eCFR)ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524
- 845 CFR 164.528: accounting of disclosures (eCFR)ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.528
- 945 CFR 164.530(j): documentation and retention (eCFR)ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530
- 1042 CFR Part 2: confidentiality of substance use disorder patient records (eCFR)ecfr.govhttps://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2
U.S. Department of Health and Human Services4
- 11Uses and Disclosures for Treatment, Payment, and Health Care Operationshhs.govhttps://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html
- 12Personal Representativeshhs.govhttps://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html
- 13Information Related to Mental and Behavioral Healthhhs.govhttps://www.hhs.gov/hipaa/for-professionals/special-topics/mental-health/index.html
- 14Fact Sheet 42 CFR Part 2 Final Rulehhs.govhttps://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
State boards and laws4
- 15New York State Unified Court System, OCA Official Form No. 960ww2.nycourts.govhttps://ww2.nycourts.gov/forms/Hipaa_fillable.pdf
- 16New York State Department of Health, DOH-2557health.ny.govhttps://www.health.ny.gov/forms/doh-2557.pdf
- 17California Civil Code 56.11leginfo.legislature.ca.govhttps://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.11
- 18Texas Attorney General, Patient Privacytexasattorneygeneral.govhttps://www.texasattorneygeneral.gov/consumer-protection/health-care/patient-privacy