Where this comes from
You can check the original sources
We checked these original sources on August 25, 2026. Each link opens the source so you can read it for yourself.
Original links
Sources and what they explain
- Where it applies
- United States; HIPAA-covered entities
- What it helps explain
- Explains the federal right to inspect and obtain copies of protected health information in a designated record set.
- Date checked
- Live federal guidance; retrieved August 25, 2026
- Where it applies
- United States; HIPAA-covered uses and disclosures
- What it helps explain
- The federal regulation listing required authorization elements, statements, expiration and revocation rules.
- Date checked
- Current Electronic Code of Federal Regulations; retrieved August 25, 2026
- Where it applies
- All U.S. states and territories
- What it helps explain
- Identifies the state office that regulates insurer conduct and complaints.
- Date checked
- Live regulator directory; retrieved August 25, 2026
Keep the request and every page of the form
Do not review only the signature page. Save the insurer’s cover letter, email or portal message with the complete authorization. Record the claim number and date received.
Read the scope line by line
Identify:
- every person or company allowed to request records;
- every provider or category of provider covered;
- the beginning and ending dates;
- medical, billing, pharmacy, mental-health or other record types;
- whether repeat requests are allowed;
- the stated purpose and expiration;
- how revocation works and what it cannot undo.
Federal guidance explains that an authorization must contain required elements and statements, including a description, authorized recipients, purpose and expiration.2 State law may add protections or rules.
Know that you can request many records yourself
HIPAA gives many people a right to inspect and obtain copies of health information held in a designated record set.1 That does not answer whether you should sign this form. It means the insurer’s form is not the only possible route to many of your own records.
Save questions instead of guessing
Write down any provider, date range, category or recipient you do not understand. A licensed attorney can review the actual form in light of the claim and state law. If the problem concerns insurer conduct, the regulator directory identifies the state department.3
A quick reality check
What this page can and cannot tell you
This page cannot decide fault, medical cause, insurance coverage, legal deadlines, case value or whether you have a claim. Those questions depend on the full facts, records, state law and a licensed attorney's review.
Ready to ask about your own facts?
Tell us what happened. We will ask the rest.
In English or in Spanish. Free to start. No obligation.
Where this comes from
Federal health-record rules explain access and authorization basics. State insurance and privacy rules may add requirements.
- 1
Individuals' right under HIPAA to access health information
Explains the federal right to inspect and obtain copies of protected health information in a designated record set.
U.S. Department of Health and Human Services - 2
45 CFR 164.508, uses and disclosures requiring authorization
The federal regulation listing required authorization elements, statements, expiration and revocation rules.
Electronic Code of Federal Regulations - 3
State insurance departments
Identifies the state office that regulates insurer conduct and complaints.
National Association of Insurance Commissioners
Last updated
August 25, 2026
Added a plain-language checklist for reading the full authorization before signing it.