Build a medical-records authorization that a records department cannot bounce. The generator writes every core element and required statement of 45 C.F.R. § 164.508, then adds the state-specific lines your state demands before a provider will release mental-health, HIV, substance-use (42 C.F.R. Part 2) or genetic information, with the statute cited next to each. Psychotherapy notes get their own form, because federal law says they must. Fill in the patient, the provider, the records, the recipient, the purpose and the expiration; copy, download or print the result. The patient details stay in your browser; only the state and the boxes you tick are counted. For attorneys, paralegals, legal nurse consultants, claims professionals and patients.
A HIPAA authorization is valid only if it contains six core elements: a specific description of the information, who may disclose it, who may receive it, each purpose, an expiration date or event, and the patient's (or representative's) dated signature with a description of the representative's authority. It must also carry three required statements: the right to revoke in writing and how, whether treatment or payment is conditioned on signing, and the warning that the recipient may redisclose the information outside HIPAA. It must be in plain language, and the patient gets a copy. Miss any one of these and the provider is right to refuse. The generator writes all nine, in that order.
"Psychotherapy notes" are the therapist's own session notes kept apart from the chart. They do not include diagnoses, medications, test results, treatment plans, session times or progress summaries; all of that is ordinary mental-health record and comes with the main authorization. The notes themselves need an authorization that covers nothing else (45 C.F.R. § 164.508(b)(3)(ii)), and a provider may refuse to release them at all. In most cases you do not need them; ask for the clinical record first.
Records from a federally assisted substance use disorder program (most treatment programs) are covered by 42 C.F.R. Part 2 on top of HIPAA. A Part 2 consent must name the patient, the program, how much and what kind of SUD information may be released, the recipient, the purpose, the right to revoke, an expiration, and a dated signature, and the disclosure must travel with a notice that the records may not be redisclosed and may not be used in any civil, criminal, administrative or legislative proceeding against the patient without consent or a special court order. A subpoena alone does not get Part 2 records; without the patient's consent you need a court order under § 2.64 as well. The 2024 Part 2 final rule (compliance date February 16, 2026) aligned the consent with HIPAA and allows a single consent for treatment, payment and operations, but the litigation protections stayed.
HIPAA sets a floor. States add rules for records they consider more sensitive, and a general release often does not reach them. New York, Pennsylvania, Illinois, Florida, Ohio, Connecticut, Washington and others require an HIV-specific line; Illinois, Pennsylvania, the District of Columbia, Texas, Washington and others set specific content requirements for mental-health consents; Pennsylvania limits what a drug and alcohol program may release even with consent; and more than twenty states require written consent before genetic test results are disclosed. The state table below is the index of those rules.
Federal rules link to the eCFR. Each state entry shows the statute for every category, the date it was compiled and a confidence flag: "high" means read from the statute or an official state page; "medium" from a secondary compilation; "low" means verify before use.