Before signing a medical-information release, ask who will receive the records, which records are included, why they are needed and when the permission ends. If the request relates to a clergy abuse claim, ask your own lawyer to explain its scope and consequences. A form’s title alone does not tell you everything it permits.
A release may arrive from a health provider, law office, insurer or organization offering assistance. You can ask for a readable copy and an explanation before deciding. If someone gives you a deadline, ask what it is based on and tell your lawyer promptly; this guide does not determine whether a particular request must be answered.
This article concerns the federal HIPAA framework, checked November 12, 2026. Other laws and court procedures may also matter, including in Texas.
Identify the document and the person asking
A medical authorization is different from consent to treatment. HHS explains that an authorization gives a covered entity permission for specified uses or disclosures that HIPAA does not otherwise allow. Some information sharing is permitted without one. HHS’s explanation of consent and authorization describes that distinction.
Ask: “Is this permission to release records, a request for my own copy, or something else?” A document may also contain terms about an assistance program or settlement. Ask about each part separately rather than assuming that signing one page has only one effect.
If your goal is to obtain your own files, our guide to requesting medical records addresses that different process.
Read the scope as a concrete set of questions
Under 45 CFR 164.508, a valid authorization must identify the information, who may disclose it, who may receive it, its purpose, an expiration date or event, and a signature and date. It must be written in plain language.
Use those fields to ask specific questions:
- Does “all records” include unrelated care or many years of treatment?
- Is the recipient a named person, an organization or a broader category?
- Could the stated purpose include something beyond the assistance I requested?
- Does the expiration refer to a date I can identify or an event someone must explain?
- Are there blank spaces or attachments I have not seen?
For example, if you expected a recent attendance record but the form requests your entire history, ask the requester to explain the difference. Ask your lawyer whether a narrower request is appropriate. This is a discussion about the actual form, not a recommendation to change or withhold records on your own.
Ask specifically about therapy records
“Therapy records” and “psychotherapy notes” are not interchangeable legal categories. HHS describes psychotherapy notes as a mental health professional’s separately maintained notes about counseling conversations. They do not include ordinary summaries of diagnosis, treatment plans or progress kept in the medical record.
Those separate notes generally need authorization for disclosure, with exceptions. Ask the provider what records it actually maintains and which category the form covers. The HHS mental-health privacy explanation is a useful starting point; it does not establish what is protected from discovery in your case.
Understand what revocation can and cannot do
The federal rule allows written revocation, subject to exceptions, including action already taken in reliance on the authorization. It also requires notice that a recipient may redisclose information that is no longer protected by that HIPAA rule. Signing is therefore not something to evaluate on the assumption that every copy can later be recalled.
Ask where a revocation should be sent and how receipt will be confirmed. Keep the completed signed form and related correspondence somewhere you can access safely. If records have already been sent, ask what was sent, when and to whom; discuss any concern with the provider’s privacy contact and your lawyer.
Keep court requests on a separate track
An authorization is not the same document as a subpoena or court order. If you receive legal papers, send the complete papers and the date received to your lawyer promptly. Do not assume that declining a release resolves a legal demand. Our document-request guide explains questions to raise about civil discovery.
You can ask for an explanation without giving a detailed account of the abuse in an ordinary email. If you would like legal guidance about a specific request, contact the firm to ask how to provide it securely.
Sources checked November 12, 2026
- eCFR: 45 CFR 164.508, federal authorization requirements; displayed current through November 9, 2026.
- HHS: Consent and authorization.
- HHS: Protections for mental health information.
General information, not legal or clinical advice. Reading this page does not create an attorney-client relationship. Legal options and deadlines depend on the facts and jurisdiction.