Form No. 960 – Authorization for Release of Health Information Pursuant to HIPAA

Jurisdiction: Country: United States | Province or State: New York

What is a Form No. 960 – Authorization for Release of Health Information Pursuant to HIPAA?

Form No. 960 is a standardized authorization that lets you direct a healthcare provider to share your medical records with someone you name. It is designed to meet HIPAA’s content requirements and New York confidentiality rules. It is a New York State Department of Health form used across medical, insurance, and legal settings in New York.

This form does one thing: it documents your permission to release your health information. You choose who will disclose, who will receive, what records to share, why to share them, and when the authorization expires. Without your signed authorization, most providers cannot release protected health information unless a specific exception applies.

Who typically uses this form?

Patients, parents or legal guardians, health care agents, attorneys, insurers, and healthcare providers. You may also see it used by schools, disability agencies, employers, and courts to collect records with your consent.

You would use this form when someone needs your medical records for a legitimate purpose, and there is no separate legal authority to obtain them. For example, you may need to share records to transfer care to a new doctor. You may need them for an insurance claim, a workers’ compensation case, a personal injury lawsuit, or a disability application. You may also use it to send records to an employer’s occupational health vendor, a school nurse, or a specialized treatment program.

Typical usage scenarios

• You are switching primary care doctors and want your chart sent to the new office.
• Your attorney needs complete treatment records to evaluate a claim.
• An insurer is processing a claim and requests recent records for review.
• You are applying for disability benefits and must submit medical evidence.
• Your child is moving schools, and the new school needs immunization records.
• A specialist requires lab results and imaging from your prior provider.
• You consent to release records to a research registry that you choose to join.

Form No. 960 gives you control. You set the scope. You set the duration. You can revoke your permission later. It also highlights categories of sensitive records that need special, explicit consent. That includes mental health treatment notes, alcohol and substance use treatment information, HIV-related information, and reproductive health information. You can include or exclude those categories by checking or not checking specific boxes.

When Would You Use a Form No. 960 – Authorization for Release of Health Information Pursuant to HIPAA?

You use this form when you want a provider or facility to disclose protected health information to a specific recipient. You can use it at any point in your care or case. The timing depends on your needs.

If you are receiving ongoing care, you might authorize your primary care provider to send labs and imaging to a specialist before your appointment. If you are dealing with a claim, you might authorize each treating provider to send records to your insurer or attorney. If you are changing jobs, you might authorize a release to an occupational health contractor for a fitness-for-duty review.

Patients use it to coordinate care or manage personal records. Parents or guardians use it to obtain or share records for minors. Attorneys use it to collect documentation for litigation or settlement. Insurers use it to validate claims or arrange prior authorizations. Employers may request it for accommodation reviews or leave administration, but you decide whether to authorize.

Here are common, practical situations:

• Continuity of care: You are referred to a cardiologist. The cardiologist needs your last two years of records, echocardiogram results, and medication lists. You authorize your primary care office to send exactly those items.
• Insurance claims: Your auto insurer asks for emergency room records after a crash. You sign a release naming the hospital and limiting the date range to the day of the accident.
• Disability or leave: You apply for short-term disability. Your benefits administrator needs documentation from the last six months. You authorize your treating provider to send progress notes and functional capacity assessments only.
• School and camp: Your teen needs sports clearance. The school requests immunizations and the last physical. You authorize the release of those items, not the entire chart.
• Legal matters: You hire a lawyer after a workplace injury. The law firm needs full records from all providers who treated the injury. You sign separate releases naming each provider to reduce delays.
• Family support: You want a family member to help manage appointments and billing. You authorize your provider to discuss your care with that person and share visit summaries.
• Pickup or delivery of records to you: You want copies for your files. You authorize your provider to release them to you directly by secure email.

In each scenario, you keep control by tailoring the records, time period, and recipients. You can also choose an expiration date that matches your purpose, such as the end of treatment, the end of litigation, or a set calendar date.

Legal Characteristics of the Form No. 960 – Authorization for Release of Health Information Pursuant to HIPAA

This form is legally binding once you sign and date it, as long as it contains all required elements. HIPAA sets the content rules for valid authorizations. New York law adds safeguards for certain kinds of information. The form prompts you to make specific choices and gives you notices about your rights.

What makes it enforceable?

It identifies you, the disclosing provider, and the recipient. It describes the information to be released, the purpose of the disclosure, and an expiration date or event. It includes your signature and date. It also contains required statements about your right to revoke, your right to receive a copy, potential for redisclosure, and whether treatment can be conditioned on signing.

HIPAA allows you to revoke an authorization at any time in writing. Your revocation stops future disclosures. It does not affect information already released in reliance on your prior consent. The form explains how to revoke and where to send your revocation.

New York has extra protections for sensitive categories, including mental health treatment information, HIV-related information, genetic testing information, and alcohol and substance use disorder treatment records. The form requires you to actively authorize the release of those categories, usually by checking specific boxes. If you do not check a box, that category should not be disclosed. Some federal rules impose special wording for substance use disorder records. The form addresses this with tailored consent language and warnings.

Providers may charge reasonable fees for copies. They must comply with timelines and format requests where feasible. Many accept electronic signatures, though some will ask for a wet signature before releasing highly sensitive records. The form itself does not require notarization. A witness is not usually required unless a specific provider policy demands it.

This authorization is voluntary in most contexts. Providers cannot refuse treatment because you do not sign, with narrow exceptions. For example, a plan may require records to enroll you, or a provider may require consent to use or disclose for research that you choose to join. The form tells you whether signing is a condition in your situation.

This form does not replace a subpoena, court order, or other compulsory process. It is your consent for a voluntary disclosure. If you are in litigation, your attorney may use this form to collect records efficiently. A court order can still compel disclosure, but this form is often faster and reduces disputes about scope.

Finally, psychotherapy notes are different from general mental health records. They have special protection. If you want those notes released, you must authorize that disclosure specifically. The form guides you to make a clear, separate choice for that category.

How to Fill Out a Form No. 960 – Authorization for Release of Health Information Pursuant to HIPAA

Follow these steps. Work line by line. Keep your scope as narrow as your purpose allows.

1) Identify yourself clearly

• Enter your full legal name. Include middle initial if used in records.
• Add your date of birth and last four digits of your Social Security number if requested. Many providers use these for matching.
• Provide your current address and a reliable phone number. This helps with questions and delivery.

2) Name the disclosing provider or facility

• List the name of the provider, practice, hospital, lab, pharmacy, or clinic that holds the records.
• Include full addresses and, if you have it, a fax number or secure email. Accurate details speed processing.
• If you want multiple providers to disclose, complete a separate form for each. Some recipients will accept one form that lists several providers, but many facilities require a unique form per provider.

3) Name the recipient

• Enter the person, practice, law firm, insurer, school, agency, or other recipient who will receive the records.
• Include mailing address, fax, and secure email if known.
• Be specific. Avoid vague entries like “anyone who asks.” For legal matters, list the law firm name and the assigned contact.

4) State the purpose of the disclosure

• Check or write the purpose. Examples: “continuity of care,” “insurance claim,” “disability benefits,” “legal review,” or “at my request.”
• If you select “at my request,” you do not need to explain further. That option is valid under HIPAA.

5) Define the information to be released

• Choose the record types: office notes, operative reports, imaging, labs, immunizations, medication lists, billing records, and other categories offered.
• Limit the date range when possible. For example: “From 01/01/2022 to 12/31/2023.”
• If you need the “entire record,” understand that this may include sensitive items. Use it only when necessary.

6) Address sensitive categories with care

• The form lists categories that need explicit consent, often with separate checkboxes. These include:
• Alcohol and substance use disorder treatment records.
• Mental health treatment information.
• Psychotherapy notes (often require a separate, specific authorization).
• HIV-related information and sexually transmitted infection information.
• Reproductive health information, family planning, and prenatal records.
• Genetic testing information.
• Check each box only if you intend to authorize the release of that category. If you do not check the box, that category should not be released.
• For substance use disorder records, name the recipient specifically. Avoid broad descriptions if possible. This reduces the risk of oversharing.
• If you only want the non-sensitive portions, do not check those boxes.

7) Choose the expiration date or event

• Enter a clear expiration date, such as “12/31/2025.”
• Or use a concrete event, like “end of treatment for current condition” or “end of litigation in Index No. [number].”
• Avoid open-ended entries like “none.” Most recipients will accept a one-year period as a practical maximum.

8) Understand your rights and limits

• Read the notices on revocation, redisclosure, and your right to refuse to sign.
• Redisclosure means that once records leave your provider, the recipient may share them again unless laws prohibit it. For certain categories, laws restrict redisclosure without new consent. The form explains this.
• If you plan to send records to an employer or school, consider whether you can limit the scope to only what is needed.

9) Delivery instructions

• Select how the records should be sent: mail, fax, secure email, patient portal, or pickup. Some options may not be available for certain sensitive records.
• Provide specific instructions, such as “PDF via secure email,” “fax only,” or “two copies, one attention to [name].”
• If you want a copy sent to you as well, list yourself as an additional recipient or ask the provider to send you a duplicate set.

10) Sign and date

• Sign your name as it appears in the identification section. Print your name underneath if requested.
• Date the form on the day you sign it. Do not pre-date or post-date.
• Electronic signatures are often accepted. If the provider requires a wet signature, print and sign in ink.

11) If a personal representative signs, show authority

• If you are signing for someone else, state your relationship and authority. Examples: parent of minor child, legal guardian, health care agent, or executor of estate.
• Attach proof of authority, such as a court order, health care proxy, or letters testamentary.
• If partial authority applies, limit the request to what your authority covers.

12) Special rules for minors

• In New York, minors have the right to consent to certain services. Records for those services often cannot be released without the minor’s consent, even to a parent.
• If the records include services the minor consented to independently, follow the form’s instructions. You may need the minor’s signature for those portions.
• If you are unsure, ask the provider how to segment the record to respect those rules.

13) Keep copies and track submissions

• Make a copy of the signed form for your files.
• Note the date you delivered it and the method used.
• If you do not receive records within a reasonable time, follow up with the provider’s records department or privacy office. Confirm they have everything they need.

14) Revoking the authorization

• You can revoke at any time before disclosure occurs. Send a written revocation to the provider’s privacy officer or records department.
• Include your name, date of birth, the date of your authorization, and a clear statement that you revoke it.
• Keep proof of delivery. Remember that revocation does not undo disclosures already made.

15) Practical tips to reduce delay

• Use legible handwriting or fill the form electronically if allowed.
• Match your name and date of birth exactly as the provider’s system lists them. Include former names if relevant.
• Limit your scope to speed review. A request for two years of records is processed faster than “all records since birth.”
• If you need imaging, ask for both the radiology report and the images on CD or via secure link.
• For legal matters, align the expiration with the expected case timeline. Add the court index number or claim number in the purpose field to help the provider route it properly.
• If fees apply, ask for an estimate and preferred payment method. Some providers waive fees when records go to another treating provider.

16) Common mistakes to avoid

• Leaving the recipient blank or writing “any provider.” Be specific to avoid rejection.
• Failing to set an expiration. Add a date or event to avoid delays.
• Overbroad requests that trigger extra review. Tailor your request to what you need.
• Forgetting to check boxes for sensitive categories that you do want released. If unchecked, those records may be withheld.
• Not including authority documents when you sign for another person.

If you complete each section carefully, the form works as intended. It gives your provider a clear, lawful direction. It also protects you by limiting the release to what you authorize, to whom you authorize, and for the time you authorize.

Legal Terms You Might Encounter

• HIPAA means the federal privacy rules that protect your health information. On Form No. 960, HIPAA explains your right to control who sees your records and for what purpose. When you sign, you permit a release that fits those rules.
• Protected Health Information, or PHI, means any data that can identify you and relates to your health. This includes diagnoses, treatments, test results, billing details, and more. The form lets you choose exactly which PHI can be shared.
• Authorization means your written permission to share PHI. Form No. 960 is an authorization. It tells the holder of your records who can get them, what can be sent, and why.
• Personal representative means someone who can act for you regarding health records. This could be a parent, guardian, executor, or someone with written authority. If a representative signs for you, the form needs a description of their authority and supporting proof.
• Revocation means you can take back your permission later. The form explains your right to revoke in writing. Revoking stops new releases going forward. It does not pull back records already sent.
• Expiration date or event means the point at which your authorization ends. You can set a date, a time period, or an event, such as “end of case.” If you leave this blank, your authorization may last only a default period, or it may be rejected.
• Redisclosure means that once your records are sent, the recipient might share them again. Those records may not have the same protections anymore. The form warns you about this risk. You should send only what is needed.
• Minimum necessary means the least amount of information needed for the purpose. The form helps you limit scope by type of record or date range. Use it to avoid broad “any and all” releases unless you truly need them.
• Psychotherapy notes mean a therapist’s private notes about counseling sessions. These notes have extra protection beyond general mental health information. If you want those notes released, the form must say so clearly and separately.
• Substance use treatment records are records of alcohol or drug treatment services. These records have strong protections under federal rules. If you want them shared, you must say so clearly on the form. Some providers may require extra steps.
• HIV-related information includes HIV test results, status, and related care. New York treats this information as highly sensitive. The form has specific checkboxes for this. If you want it released, you must check the correct box.
• Genetic information means test results and data about your genetic traits. This information often needs special consent. If you want it shared, you must say so on the form. Do not assume it is covered by general language.
• Marketing and sale of information are uses that need clear, specific consent. The form will not allow these uses unless you explicitly agree. If you do not want marketing or sales, do not authorize those uses.

FAQs

Do you need this form to get your own records?

Usually no. You have a right to access your own records. Many providers have a separate request process for that. Use Form No. 960 when you want your provider to send your records to someone else.

Do you need a separate form for each provider?

Yes. Each provider or facility that holds your records needs its own authorization. List the exact provider name and location. Do not assume one form covers multiple institutions.

Do you have to allow “any and all” records?

No. You can limit by date range, condition, or document type. Narrow your request if you only need certain records. Target the scope to reduce cost, delay, and privacy risks.

Do you need to check the boxes for HIV, mental health, or substance use?

Yes, if you want those records released. Those categories are extra sensitive. If you do not check the relevant boxes, those records will not be sent. Many denials occur for this reason.

Do you need to notarize the form?

Usually no. Notarization is not a standard requirement for this authorization. Some facilities may ask for a witness or ID verification. Call ahead if you are unsure.

Do you need an expiration date?

Yes. Set a clear end date or event. Without an end, your authorization might be rejected or limited by policy. A common choice is six to twelve months.

Do you need to explain the purpose of the release?

Yes. Give a clear reason, like “continuity of care,” “legal review,” or “insurance appeal.” A brief, plain purpose helps the records department process your request quickly.

Do you have to accept paper copies only?

No. You can request electronic copies if available. Say “electronic format” and the format you prefer, like PDF. Some older systems may only produce paper. Ask what the provider can do.

Can you allow verbal discussion between providers?

Yes. You can authorize discussion as part of the release. Add “verbal communication permitted” and list limitations if you want them. State the timeframe for those discussions.

Can you revoke after you sign?

Yes. You can revoke in writing at any time. Send the revocation to the provider you authorized to release records. Revocation does not affect records already disclosed.

Do you need to pay a fee?

You may pay reasonable fees for copies. Fees can vary by format and volume. Ask for an estimate and consider limiting the scope to manage cost.

Can a parent or guardian sign for a minor?

Sometimes, depending on the type of record and circumstances. Some services allow minors to control access to those records. If you are signing for a minor, include proof of authority.

Do you need separate forms for updates?

If you need to add recipients or extend the time, submit a new authorization. Do not alter an already processed form. Fresh forms reduce confusion and delays.

Checklist: Before, During, and After the Form No. 960

Before signing: gather information and documents

• Your full legal name, date of birth, and contact details.
• A government-issued ID for identity checks, if asked.
• Exact provider or facility names and locations holding the records.
• Recipient name, organization, address, phone, and fax or secure email.
• Clear purpose of release, like “treatment” or “legal review.”
• Date range of records, such as “01/01/2023 to 12/31/2023.”
• Specific record types needed, like “operative report,” “lab results,” or “billing.”
• Decision on electronic or paper format; list your preference.
• Special categories: HIV, mental health, psychotherapy notes, genetic data, substance use.
• Expiration date or event for the authorization.
• Your plan for revocation, if you might need it.
• Proof of authority if you sign for someone else.
• Instructions for the delivery method and deadline, if any.

During signing: verify every section

• Confirm your name and date of birth match your ID.
• Confirm provider and facility names are accurate and complete.
• Confirm the recipient’s details are correct and legible.
• State the purpose in plain language.
• Limit the scope to the minimum necessary.
• Check boxes for any special sensitive categories you want released.
• Include a clear date range for records.
• Request your preferred format: paper or electronic.
• Set a firm expiration date or event.
• Read the revocation and redisclosure statements.
• Sign and date in ink or an accepted electronic method.
• If you are a representative, describe your authority and attach proof.
• Initial any corrections, cross-outs, or added comments.
• Keep handwriting clear and block printed where possible.

After signing: filing, notifying, storing

• Submit the form to the provider that holds the records.
• Use the provider’s medical records or health information office.
• Ask about preferred submission: portal, mail, fax, or in person.
• Keep a copy of the signed form and any attachments.
• Record the date you sent the form and how you sent it.
• Note any confirmation number or contact name.
• Calendar the expected response date based on the provider’s policy.
• Follow up if you hear nothing by your calendar date.
• Confirm the provider sent the records to the correct recipient.
• Ask the recipient to confirm receipt and completeness.
• Review the records for scope and quality.
• Store your copy of the authorization and records securely.
• Calendar the expiration date for your own tracking.
• If needed, send a written revocation and keep proof of delivery.

Common Mistakes to Avoid

Not checking sensitive category boxes

• Consequence: HIV, mental health, substance use, or genetic records are not released.
• Don’t forget: Check only the categories you want disclosed.

Leaving the expiration blank

• Consequence: The provider may reject the form or limit its duration.
• Don’t forget: Set a clear date or event, like “six months from today.”

Using vague provider or recipient names

• Consequence: Processing delays or misrouted records.
• Don’t forget: Spell out full legal names and locations.

Overbroad “any and all records.”

• Consequence: Higher fees, longer processing, and increased privacy risk.
• Don’t forget: Limit by date range and specific record types.

Forgetting to sign and date

• Consequence: Automatic rejection and lost time.
• Don’t forget: Sign and date in the correct signature field.

Missing authority proof for representatives

• Consequence: Denial until proper documents are provided.
• Don’t forget: Attach guardianship, healthcare proxy, or other authority proof.

Illegible handwriting and unclear edits

• Consequence: Staff cannot process or must seek clarification.
• Don’t forget: Print clearly and initial any corrections.

Requesting psychotherapy notes without specific consent

• Consequence: Provider declines to release those notes.
• Don’t forget: Authorize psychotherapy notes separately if needed.

What to Do After Filling Out the Form

Submit to the records holder

• Send the signed Form No. 960 to the provider or facility that has the records.
• Use the medical records or the health information department.
• Ask about the fastest accepted method and any cover page details.
• If you set a deadline, include it and explain why.

Confirm receipt and processing

• Request confirmation that your authorization has been received and is valid.
• Ask for the expected completion date and any fees.
• If fees apply, ask for an invoice or estimate before production.
• Provide any missing details promptly to avoid delays.

Track the release

• Calendar five to ten business days for a routine request.
• Complex requests or older archives may take longer.
• If you need urgent release for care, say so clearly and ask for priority.
• Follow up by phone or secure message if the deadline slips.

Coordinate format and delivery

• Confirm paper or electronic format and delivery address.
• For electronic delivery, specify the format and security method.
• If sending to a third party, confirm they can accept the format.
• Ask the provider to label the package or file with your name and DOB.

Verify what was sent

• Ask the recipient to confirm receipt and completeness.
• If you also receive a copy, review it for the date range and types requested.
• If something is missing, request a supplemental release using the same form.
• If the wrong records were sent, ask the provider to correct the issue.

Handle denials or partial releases

• If the provider declines some items, ask for the specific reason.
• Many denials relate to unchecked sensitive categories or unclear scope.
• Submit a corrected authorization if needed.
• Keep a record of all communications and revised forms.

Manage revocation or changes

• If you need to revoke, send a written revocation to the provider.
• Keep proof of delivery and note the date.
• Revocation stops future releases under that authorization.
• To extend or change recipients, sign a new authorization.

Share records with care

• Only share records with people who need them.
• Remind recipients not to forward your records without approval.
• If a recipient needs ongoing updates, limit your authorization to that purpose.
• Calendar the expiration to reassess access at the right time.

Store securely

• Keep a copy of your signed authorization and correspondence.
• Store records in a secure digital folder or locked file.
• Restrict access to trusted people only.
• Shred paper copies when no longer needed.

Plan for future requests

• Keep a list of providers who hold your records.
• Maintain a template list of the records you commonly need.
• Reuse this list to complete new authorizations faster.
• Update your preferences for format and delivery as needed.

Handle representatives and special cases

• If you act for someone else, include your authority each time.
• If the person regains capacity, they may need to sign themselves.
• For minors, check which records require the minor’s own consent.
• When in doubt, ask the records department how they process those cases.

Align the release with your goal

• For care transitions, target recent and key clinical records.
• For legal review, include the full date range and billing.
• For insurance appeals, add explanation of benefits and denial letters if available.
• Avoid extra data that does not serve your goal.

Keep communication open

• Be clear, polite, and concise in all requests.
• Provide direct contact information for quick questions.
• Thank the staff for confirmations. It helps the process.
• Document every call and email with dates and names.