Release of Information Form: What to Include

Your medical history, employment records, school transcripts, and financial statements are protected. An organization that holds them generally cannot hand them to a third party until you say so in writing. A release of information form is how you say so.

This guide explains what a release of information form is, when you need one, which fields every version must contain, and the mistakes that get a form bounced back to you unsigned.

What Is a Release of Information Form?

A release of information form is a signed document that authorizes one party to disclose specified records to a named person or organization. It goes by several names: authorization to release information, records release form, or authorization for release of records.

Three parties appear on every form:

• The subject whose records are being released (usually the person signing)
• The holder of the records (a hospital, employer, school, or bank)
• The recipient who is allowed to receive them (a new provider, a background-check firm, a lender)

The form gives the holder legal cover to share information that is otherwise confidential. It also protects you: because the authorization names specific records and a specific recipient, the holder cannot release more than you agreed to.

When You Need a Release of Information Form

You sign one of these forms more often than you might think. Common situations include:

• Switching doctors or specialists, when your new provider needs your history from the old one
• Applying for a job, when an employer runs a background check or verifies past employment
• Enrolling in a new school and transferring transcripts or disciplinary records
• Applying for a loan or mortgage, when the lender pulls tax returns or bank statements
• Filing an insurance or disability claim, when the insurer needs medical evidence
• Settling a legal dispute, when an attorney gathers records to build or defend a case

In each case, the records holder needs written permission before it can lawfully hand anything over. A phone call or verbal okay is not enough, and a holder that releases records without a valid signed authorization can face penalties of its own. That is why front-desk staff so often refuse to move until the form is filled in correctly.

Types of Release of Information Forms

The core structure is the same, but the governing law and required language change depending on what kind of record you are releasing.

Medical Records (HIPAA)

Health information held by doctors, hospitals, pharmacies, and insurers is protected by the HIPAA Privacy Rule. A release for these records is a HIPAA authorization, and it must include specific elements: a description of the information, who is disclosing it, who receives it, the purpose, an expiration date or event, and a statement of your right to revoke. If any required element is missing, the authorization is invalid and the provider should refuse it. For a deeper walkthrough of the medical version, including how it works when you are switching providers or filing an insurance claim, see our HIPAA authorization form guide.

Employment Records

When you apply for a job, the employer often needs to verify past positions, dates, and sometimes salary. Background-check companies operate under the Fair Credit Reporting Act (FCRA), which requires a separate, standalone disclosure and your written authorization before a report can be pulled. Employment verification is a close cousin here; if you are on the requesting side, our employment verification letter template explains what a good verification looks like.

Education Records

Student records are protected by the Family Educational Rights and Privacy Act (FERPA). Once a student turns 18 or enters college, they, not the parent, control the release. A FERPA release names the records, the recipient, and the purpose, and it lets a school send transcripts or share information with a third party such as a scholarship committee.

Financial Records

Bank statements, tax returns, and credit information are governed by laws such as the Gramm-Leach-Bliley Act and IRS rules. Lenders and financial advisors ask you to authorize the release before they pull anything. These forms often carry a shorter validity window because financial data goes stale quickly.

Key Elements Every Release of Information Form Should Include

Whatever the record type, a complete form contains the same building blocks. Leaving one out is the most common reason a form gets rejected.

1. Subject's full identifying information. Legal name, date of birth, and any account, patient, or student ID that helps the holder locate the right file.
2. The records holder. The name of the organization that currently has the records and, where useful, a department or contact.
3. The recipient. The full name and address of the person or organization allowed to receive the information. "Anyone who asks" is not a valid recipient.
4. A specific description of the information released. Name the records precisely: "office visit notes from January 2025 to present," not "my file." Broad descriptions invite over-disclosure and often get the form kicked back.
5. The purpose. State why the records are being shared, such as "continuity of care" or "employment verification." The purpose limits how the recipient may use the information.
6. An expiration date or event. A calendar date ("expires December 31, 2026") or a triggering event ("when treatment concludes"). Open-ended authorizations are disfavored and, for HIPAA, invalid without one.
7. A statement of your right to revoke. Confirm that you can withdraw the authorization in writing and explain how.
8. A redisclosure notice. A line noting that once the recipient has the records, they may not be protected by the same privacy laws, so the subject understands the risk.
9. Signature and date. The subject signs and dates. If a personal representative signs, the form should describe their authority (parent, guardian, or agent under a power of attorney).

How to Write a Release of Information Form: Step-by-Step

Step 1: Identify the subject. Enter the full legal name and enough identifiers for the holder to find the exact records without guessing.

Step 2: Name the holder and the recipient. Be specific on both ends. If you want records sent to one clinic, name that clinic, not the whole health system.

Step 3: Describe the records. List categories and, where possible, date ranges. Call out anything sensitive that needs extra handling, such as mental health, substance use, or HIV-related records, which often require a separate, explicit authorization.

Step 4: State the purpose and expiration. Tie the release to a reason and give it an end point. A form built for one loan application should not stay live indefinitely.

Step 5: Add the revocation and redisclosure language. Include how to revoke and a note that redisclosed information may lose its protection.

Step 6: Sign and date. The subject signs. Confirm the receiving organization does not also require a witness or notarization before you finalize it.

Who Signs When the Subject Can't

The subject signs their own form whenever they can. When they can't, the question is who has the legal authority to sign in their place, and it varies by situation.

Minors. For a child, a parent or legal guardian usually signs. The rules shift once a minor can consent to certain care on their own, such as reproductive or mental health services in some states, where the minor may control that specific release. Once a student turns 18, they take over their own education records under FERPA even if a parent is still paying tuition.

Incapacitated adults. If someone cannot make decisions because of illness or injury, an agent named in a durable power of attorney or a court-appointed guardian can sign for them. The scope of what they can release depends on the powers granted in the document. If you expect to handle records for an aging parent, our guide to power of attorney for contract signing explains how signing authority works and where it stops.

Deceased individuals. After death, the executor or personal representative of the estate typically holds the authority to request records. HIPAA protections continue for 50 years after death, so a hospital will still ask for proof of the signer's role before releasing a file.

Whoever signs in the subject's place should note their authority on the form itself, for example "signed by Jane Doe, agent under power of attorney," and be ready to attach a copy of the document that grants it.

Common Mistakes to Avoid

Describing the records too broadly. "All my records" gives the holder no way to limit disclosure and often triggers a rejection. Name what you actually need shared.

Leaving the expiration blank. A form with no end date is treated as suspect. Many organizations default to a short window or refuse it outright, and a missing expiration makes a HIPAA authorization invalid.

Naming the wrong recipient. Sending records to a general address or an outdated contact means your information can end up in the wrong hands. Verify the recipient's current details first.

Forgetting sensitive-record rules. Substance use treatment records fall under a separate federal rule (42 CFR Part 2) and need their own specific authorization. A general form does not release them.

Skipping the revocation clause. If the form does not tell you how to withdraw consent, you may struggle to stop an ongoing disclosure later.

Signing without reading the purpose. The purpose defines how the recipient may use your data. A vague or missing purpose lets the recipient use it more freely than you intended.

Release of Information vs. Related Documents

A release of information is easy to confuse with a few neighboring forms, and using the wrong one causes delays.

A power of attorney gives another person authority to act on your behalf across many matters, including requesting records. A release of information is narrower: it authorizes a single disclosure, not ongoing decision-making. If you want someone to request records for you over time, a power of attorney fits better.

A media release form authorizes the use of your photo, video, or likeness rather than your records. If your question is about images or footage, our media release form guide is the right starting point.

A subpoena compels disclosure through a court and does not need your consent. A release of information is voluntary and signed by you.

Related guides

• General Release Form Template: How to Write
• Liability Waiver Template: How to Write a Release of Liability Form
• Waxing Consent Form: What to Include
• Podcast Guest Release Form: What to Include
• Media Release Form Template (Photo & Video)

Generate Your Release of Information Form with Contractable

A release of information form is short, but the details decide whether it works: the right recipient, a precise records description, an expiration date, and the revocation and redisclosure language a holder expects to see. Miss one and the form comes back unsigned.

Contractable builds a customized release of information form in seconds, with the correct fields for medical, employment, education, or financial records and the language holders look for before they release anything. No lawyers or legal knowledge required.