Therapist Release of Information Template: What to Include

A release of information is not a permission slip for “anything in the chart.” Use the filled fields above as a practical starting point, then narrow each line to the disclosure you actually need to make. The authorization belongs in the practice’s secure record with the date received, the scope you relied on, and any later revocation.

For example, if a new psychiatrist’s office sends a signed request for “the complete file,” pause before sending it. Compare the request with the authorization, narrow the disclosure to the records and date range the client actually approved, and document that decision before using your secure release workflow.

This therapist release of information template is for US mental-health clinicians and practice staff. It is educational guidance, not legal advice and not a substitute for the law that applies to your license, client, recipient, and disclosure. The HIPAA authorization elements summarized here come from 45 CFR 164.508. Have practice counsel review the final form before you put it into circulation.

What the authorization needs to identify

Before you sign or send a release, check that a reviewer can answer five questions without guessing: whose information is involved, who may receive it, what may be disclosed, why it may be disclosed, and when the permission ends. The federal authorization rule also requires the client’s signature and date, a statement about revocation, and the required notices about conditioning and redisclosure. Use the current regulation as the controlling source, not a form copied from another practice.

Client and practice

Name the client clearly. If a personal representative signs, identify the representative and the authority they rely on. Name the practice or covered entity making the disclosure and give the contact route the client can use to ask questions or revoke the authorization.

Recipient

Name the person or organization that will receive the information. A phrase such as “any provider” may be too broad for the disclosure you are planning. If a care team needs the information, define the team or organization and use a secure contact path.

Information and purpose

Describe the information to be disclosed with enough precision for the client and your reviewer to understand the boundary. You might identify a date range, a treatment episode, a treatment plan, or a progress summary. State the purpose in ordinary language, such as care coordination, a disability-accommodation request, or a defined legal matter. Do not make the authorization broader than the purpose requires.

Expiration

Use a date or an event. A date works when the disclosure is tied to a short project. An event can work when the end is naturally linked to care coordination, but name the event precisely enough that staff can recognize it. Avoid an open-ended line that leaves the practice guessing about whether the authorization is still active.

Keep psychotherapy notes separate

Psychotherapy notes are a special category under HIPAA. A general authorization for the clinical record does not automatically authorize disclosure of psychotherapy notes. 45 CFR 164.508 sets the separate authorization boundary. If you intend to disclose them, use a separate, specific authorization and confirm that the requested disclosure fits the applicable rule. If you do not intend to disclose them, say so plainly in the form and in the disclosure review.

Keep the psychotherapy-notes choice separate from the ordinary record fields so a client can see what they are and are not authorizing. Do not use the label as a substitute for deciding what your practice actually stores as psychotherapy notes. Ask counsel or your compliance lead to review the boundary for your record system and workflow.

Explain revocation before you rely on the form

The client should be able to tell you how to revoke the authorization in writing. Put the practice contact in the form, explain that revocation does not undo actions already taken in reliance on the authorization, and route received revocations to the person who controls disclosures. Record when the revocation arrived, what future disclosures it stops, and whether a disclosure had already been sent.

A revocation process should not depend on a staff member remembering a verbal request from a hallway conversation. Tell the client where to send the written request, use the practice’s secure channel, and document the review in the client’s record.

Store the authorization with the disclosure trail

Save the signed authorization where the staff member completing the release can find it without searching an untracked inbox. Documentation that stays in the client record can help your team keep the version date, the date the authorization was received, the recipient, and the scope used for the disclosure together. If the recipient asks for more information than the authorization names, stop and obtain a new authorization or a documented review from the person responsible for privacy decisions. A clean disclosure log lets the practice answer what was sent, when it was sent, and why the team believed the release supported that action.

A quick release review before disclosure

Use this six-step check before sending anything:

1. Match the client. Confirm the authorization belongs to the client and was signed by the client or a representative with authority.
2. Match the recipient. Confirm the person or organization in the request is the same recipient named in the authorization.
3. Match the scope. Pull only the records and dates the authorization describes.
4. Match the purpose. Confirm the planned disclosure serves the stated purpose and does not silently expand it.
5. Check status. Confirm the expiration has not occurred and no written revocation has been received.
6. Record the action. Note what was disclosed, to whom, when, by which secure method, and which authorization supported it.

If the request involves substance use disorder records, review 42 CFR Part 2 before sending anything. Minors, a personal representative, a subpoena, or a disclosure that does not fit the form also require the rule and counsel path that applies. Do not treat a general therapist release of information template as permission to skip a specialized review.

Adapt the form without weakening it

Keep the required elements visible when you adapt the therapist release of information template. Add your practice’s secure contact route, the record categories your system actually uses, and the representative-authority choices that occur in your work. Remove fields that invite a broad disclosure you do not need. Keep a version date so staff can tell which form the client signed. If you cannot name the recipient and the end point, you have a request to clarify, not an authorization to use.

Use the counselor forms collection to map the rest of your practice forms, and use the HIPAA compliance checklist to place authorization review inside your privacy workflow.

Download the therapy intake forms pack

The free Therapy Intake Forms Pack is a separate starting point for adult, adolescent, couples and family, and telehealth intake workflows. It does not replace the release authorization above, but it can help you keep intake, consent, and practice-form versions organized in one implementation pass.

References

• Legal Information Institute. (n.d.). 45 C.F.R. § 164.508: Uses and disclosures for which an authorization is required.
• Legal Information Institute. (n.d.). 42 C.F.R. Part 2: Confidentiality of substance use disorder patient records.