CBP Form 3400 – Medical Records Release Privacy Act Form

Jurisdiction: Country: USA | Province or State: Federal

What is a CBP Form 3400 – Medical Records Release Privacy Act Form?

CBP Form 3400 is a written authorization that allows U.S. Customs and Border Protection to obtain or release your medical records. It is designed to meet federal Privacy Act and health privacy standards. You use it to tell healthcare providers, CBP, or both exactly what records may be shared, with whom, and for what purpose.

The form centers on your consent. Without it, CBP generally cannot access or share your protected health information held by medical providers. It also gives CBP a clear basis to share any medical information that CBP holds about you with a person you name. The form typically covers diagnoses, treatments, lab results, hospitalization records, and similar data. It may also include sensitive categories if you authorize them. These include mental health notes, substance use disorder records, genetic information, or HIV/AIDS-related information.

Who typically uses this form?

Individuals who interacted with CBP and need records verified use it. That includes travelers, individuals in CBP custody, applicants or employees who had CBP medical evaluations, and claimants in incidents involving CBP. Attorneys use it to represent clients. Parents and legal guardians use it for minors. Personal representatives use it for an incapacitated or deceased person. Healthcare providers also rely on it to confirm they can send records to CBP or a recipient you name.

Why would you need this form?

You may need to support an injury claim, confirm past treatment in custody, or answer employment medical questions. You may want CBP to share your medical information with your doctor, your lawyer, or a family member. You may want CBP to collect your records from a hospital after an incident. The form lets you direct that flow in a precise, time-limited way.

Common scenarios include an injury during inspection where CBP requests hospital records for a claim review. Another is an attorney seeking a client’s CBP-held medical notes after a detention. CBP may also need your authorization to confirm medical restrictions or accommodations as part of hiring or employment. In each case, the form clarifies who can share what, for how long, and for what purpose.

When Would You Use a CBP Form 3400 – Medical Records Release Privacy Act Form?

Use this form when you want CBP to get your medical records from a provider. You also use it when you want CBP to give your medical information to someone else. The form is often part of a larger process. Think claims, investigations, employment screening, or continuity of care.

For example, you were treated at a hospital after an encounter at a port of entry. You later file a claim or grievance. CBP asks for medical records to confirm diagnosis and costs. The form authorizes the hospital to send those records to CBP. Without your consent, the hospital will not release them.

Another example is when you need records about care while in CBP custody. You want to give those records to a new doctor. You can authorize CBP to send your CBP-held medical information to that provider. This avoids delays and ensures continuity.

Attorneys also use this form with a signed client authorization. An attorney representing you in a claim or inquiry may need quick access to your records. The form lets CBP talk directly with the attorney and share the specified information.

Applicants or employees sometimes need it, too. CBP may ask for medical records to evaluate job-related fitness or accommodations. You can authorize your provider to release details to CBP’s medical unit. You can also authorize CBP to share its medical assessment with your personal physician for follow-up.

Parents and legal guardians use it for minors. If your child had medical care related to a CBP matter, you can authorize release to a pediatrician or school. For a deceased or incapacitated person, a court-appointed personal representative uses the form with proof of authority.

You also use this form if you want a third party to discuss your case with CBP. For example, you live abroad and want a family member to handle a medical inquiry with CBP. The form allows CBP to share details with that family member.

The form is helpful when privacy laws would otherwise block disclosure. It is not a shortcut around records request procedures. But it removes the consent barrier that stops providers or CBP from sharing medical details.

Legal Characteristics of the CBP Form 3400 – Medical Records Release Privacy Act Form

This form is legally binding once properly completed and signed by the right person. It functions as your explicit authorization to disclose protected health information. Health care providers rely on it to release records to CBP. CBP also relies on it to give your medical information to a named person.

Enforceability rests on clear, specific terms. The authorization must identify you. It must name the disclosing party and the recipient. It needs a clear description of what information may be shared. It should define the purpose of release. It should include an expiration date or event. These elements help ensure your consent is informed and valid.

You retain rights over the authorization. You can revoke it in writing at any time. Revocation stops future disclosures. It will not undo disclosures already made in reliance on your prior consent. If you set an expiration, the authorization ends automatically at that date or event.

Sensitive categories often require extra consent. Expect checkboxes or initials for mental health, substance use disorder treatment records, genetic testing results, and HIV-related data. If you do not initial those, providers may withhold those portions. Some records may also be protected by stricter federal or state rules. Those rules can require even more specific consent language. If the form does not meet those rules, certain records will not be released.

The form does not force providers or CBP to create new records. It only permits disclosure of existing records. It also does not override records retention rules or legal holds. Nor does it require CBP to release records that are restricted by law. Some CBP records may be exempt from release under specific statutes. Consent does not erase those legal limits.

Authority to sign depends on your status. You sign for yourself if competent. A parent or legal guardian may sign for a minor. A court-appointed personal representative may sign for a deceased or incapacitated person. Proof of authority is required. If multiple people share authority, CBP may ask for all relevant consents.

Identity verification helps protect you. CBP may require a copy of your government ID. Providers may do the same. A witness or notary may be required in some cases, especially when records include sensitive categories. Follow the form’s instructions on verification to avoid delays.

How to Fill Out a CBP Form 3400 – Medical Records Release Privacy Act Form

Work through the form carefully. Use black ink or type. Keep names consistent with your ID. If a field does not apply, write “N/A.” Do not leave key areas blank.

1) Gather what you need

• Your legal name and any prior names.
• Date of birth and other identifiers the form requests.
• Contact information.
• Case, incident, claim, or employee number, if known.
• Names and addresses of providers or facilities.
• Dates of treatment and types of records.
• Name and contact of the person or organization that should receive records.
• Proof of authority if you sign for someone else.

2) Identify the subject of the records

Complete the section for the person whose records are involved. Enter the full legal name. Add any aliases. Provide date of birth. If the form asks, include an A-Number, employee ID, or the last four digits of your SSN. Use the exact details providers use. Accuracy helps match records.

3) Provide your contact information

List your mailing address, phone number, and email. This is how CBP or a provider will reach you. If you have a representative, add their contact details in the designated section.

4) Name the parties who may disclose and receive

Specify the disclosing party. This may be “All treating providers” or a specific hospital or clinic. Add addresses or fax numbers if requested. Then name who may receive the records. That may be CBP, a CBP component, a specific officer, your attorney, or another party. If you want two-way sharing between CBP and a provider, state both directions clearly if the form allows it.

5) Describe the information to be disclosed

Be precise. You can authorize “all medical records” for a date range. Or you can limit it to specific items, like “ER records and imaging from June 1–15, 2024.” Include billing records if you need cost information. If the form lists categories, check only what you agree to share.

6) Address sensitive categories

Look for special checkboxes or initial lines for:

• Mental health or psychotherapy notes.
• Substance use disorder treatment records.
• HIV/AIDS-related information or STD records.
• Genetic information or testing results.

Initial each category you agree to include. If you do not initial a sensitive category, those records will be excluded. Psychotherapy notes often require a separate, more specific authorization. Confirm what the provider requires.

7) State the purpose of the disclosure

Explain why the records may be shared. Common reasons include claims review, legal representation, investigation, employment fitness, accommodation, or personal use. If the form permits “at the request of the individual,” that works for personal copies.

8) Set an expiration date or event

Choose a clear end date or event, such as “one year from signature” or “upon resolution of claim number X.” If you do not set an expiration, some providers will limit disclosure. Setting a date avoids confusion.

9) Acknowledge your rights and risks

Read the statements about your rights. You can revoke your authorization in writing. Disclosures made before revocation remain valid. Note the warning about re-disclosure. Once released to a non-health entity, records may not keep the same protections. Acknowledge that treatment or benefits should not depend on signing, except where needed for employment assessment or similar processes. Only sign if you understand and agree.

10) Choose delivery method and format

Indicate how records should be sent. Options often include mail, secure fax, secure email, or pick-up. Provide full addresses and numbers. If you prefer electronic copies, say so. Note any encryption needs. If you request originals or radiology films, expect provider policies to apply.

11) Address fees and scope limits

Providers may charge copy fees. Say whether you agree to reasonable fees. You can limit the number of pages or set a dollar cap if the form allows it. That helps avoid surprise costs.

12) Add case or claim identifiers

If this relates to a specific incident, include claim numbers or case references. If a CBP office asked you to complete the form, add the officer’s name or unit if the form provides a field. This speeds routing.

13) Representative or attorney information

If someone will receive records on your behalf, list them here. Include name, firm, address, phone, and email. Attach a signed representation letter or power of attorney if required. Make sure names match across documents.

14) Special situations: minors, incapacitated, deceased

If you sign for a minor, enter your name and relationship. Some states require the minor’s signature for certain services. If applicable, have the minor sign too. For an incapacitated or deceased person, attach proof of authority. Examples include a court order, letters of administration, or healthcare power of attorney. If multiple guardians share authority, include all required signatures.

15) Identity verification

Attach a copy of a government-issued ID if requested. If the form requires a witness or notary, complete that section. The witness must be an adult who is not the recipient of the records. Follow any specific instructions on notarization.

16) Sign and date

Sign your full name. Print your name below the signature if asked. Date the form. An undated signature can delay processing. If you initialed any sensitive categories, make sure those initials are present.

17) Keep copies

Make a full copy for your records. Keep proof of submission. Save fax confirmations, email receipts, or mail tracking. You may need to show what you authorized and when.

18) Submit the form

Send the form to the CBP office or officer who requested it, or to the CBP unit that holds the records. If you are authorizing a provider to send records to CBP, give the provider a copy. Confirm the correct address or secure transmission method with the recipient in advance.

19) Track and follow up

Ask for an estimated processing timeline. If time-sensitive, note your deadline in the cover letter. Follow up if you do not receive confirmation or if records do not arrive.

Tips to avoid delays

• Write clearly and use consistent identifiers.
• Specify a date range and the exact types of records.
• Initial all sensitive categories you wish to include.
• Include accurate provider names and addresses.
• Attach authority documents if you sign for someone else.
• Provide an expiration date and a clear purpose.
• Use one form per person. Do not mix family members.
• Keep your contact information current.

What the form does not do

It does not request non-medical CBP records. It does not replace standard records request processes. It does not guarantee release of records restricted by law. It does not force providers to create summaries or new analyses. It authorizes only the disclosure of existing medical information that you specify.

When to submit a new form

Submit a new form if you want to change recipients, expand scope, or extend the expiration. Submit a new form if you revoked a prior authorization. Use a new form if you had a name change or need different provider records.

By completing CBP Form 3400 carefully, you control how your medical information moves. You set scope, purpose, and time limits. That precision helps CBP, providers, and your representatives act quickly and correctly. It also protects your privacy while allowing the records flow you need.

Legal Terms You Might Encounter

You will see the Privacy Act referenced throughout. This federal law governs how agencies handle personal records. On this form, it explains why CBP needs your permission before releasing your medical information.

Authorization to Release means you give CBP written permission to disclose your medical records. Your signature activates this permission. Without it, CBP generally will not share your records with others.

Protected Health Information refers to your identifiable health details. This includes diagnoses, treatments, test results, and provider notes. On this form, you decide which protected health information CBP can share.

Minimum Necessary is a privacy rule that limits disclosures to what is needed. Even if you give broad consent, CBP usually releases only the minimum necessary records. You can make that scope narrower by being specific.

Records Custodian is the person or office that maintains your records. CBP’s records custodian will process your authorization. They ensure your request meets legal and policy requirements.

Revocation means you cancel your authorization. You can revoke in writing at any time. After CBP receives your revocation, it stops further disclosures under this authorization.

Expiration Date or Event is when your authorization ends. You can set a calendar date or event, like “after my case ends.” If you leave this blank, CBP may apply a standard limit.

Third-Party Recipient is the person or entity you name to receive your records. This might be a lawyer, doctor, insurer, or family member. You must identify the recipient clearly and completely.

Identity Verification is the process CBP uses to confirm who you are. You may need to provide a copy of a government ID. This helps protect your records from unauthorized release.

Routine Use is a Privacy Act term for expected disclosures related to agency functions. This form focuses on your specific authorization for release. Routine uses operate separately under agency rules.

System of Records means the organized files where CBP stores your records. Your authorization tells CBP which records in that system to search and release.

Sensitive Diagnoses are health topics that need extra clarity. Examples include mental health, substance use, or HIV status. Use the form to say if you allow release of any sensitive categories.

FAQs

Do you need CBP Form 3400 to get your medical records?

Use this form when you want CBP to release your medical records to you or someone you choose. You can also use it to control what is shared and how it is sent. If you only want to view records in person, ask the office how to proceed. The form may still be required to document your consent.

Do you have to include ID with the form?

Yes. You should include a clear copy of a government-issued photo ID. Make sure your name matches the form exactly. If you sign as a parent or representative, include documents showing your authority.

Can you limit what CBP releases?

Yes. You can limit by date range, type of record, or provider. You can also exclude sensitive topics you do not want released. Being specific speeds processing and protects your privacy.

Does your authorization expire?

Your authorization lasts until the expiration you set. If you do not list one, the office may apply a standard limit. You can revoke at any time by sending a written revocation. Revocation stops future disclosures, not past releases.

Do you need a witness or notarization?

Usually, no. A standard signature and date are enough. If you sign for someone else, proof of authority may be required. If you cannot sign, ask the office about acceptable alternatives.

Will you be charged a fee?

You may be charged reasonable copying or delivery costs. Many offices notify you before applying fees. You can ask for electronic copies to reduce costs. Fee policies vary by office and format.

How long will processing take?

Processing times vary. Plan for several weeks from receipt. Complex requests or broad scopes can take longer. Clear, narrow requests often move faster.

Can you revoke the authorization after submission?

Yes. Send a dated, signed revocation to the office handling your request. Keep proof of delivery. Revocation takes effect when received and processed.

Checklist: Before, During, and After

Before signing

• Identify the recipient. Get full name, organization, and contact details.
• Decide the scope. List dates, providers, and specific records needed.
• Consider sensitive topics. Decide what to include or exclude.
• Choose delivery method. Mail, secure email, fax, or in-person pickup.
• Set an expiration date or event. Use a clear, realistic end point.
• Gather ID. Copy a government-issued photo ID, front and back if needed.
• Gather authority documents if applicable. Power of attorney, guardianship, or proof of relationship.
• Confirm your contact details. Phone and email you check daily.
• Plan for fees. Ask about costs for copying and delivery.

During signing

• Verify your legal name matches your ID.
• Confirm date of birth and other identifiers are accurate.
• Spell out the recipient’s full details and correct address.
• State the specific records to release. Avoid vague phrases.
• Mark any sensitive categories you consent to release.
• Select the delivery method and any security preferences.
• Enter a clear expiration date or event.
• Sign and date in ink or per electronic instructions.
• Review every field for completeness and legibility.

After signing

• Make a complete copy for your records.
• Submit the form to the office listed on the form.
• Use a trackable delivery method when possible.
• Calendar key dates. Follow-up date and expiration date.
• Notify the recipient to expect records and how they will arrive.
• Watch for confirmation, fee notices, or requests for clarification.
• Save all emails, letters, and receipts in one place.
• When records arrive, confirm the scope matches your authorization.
• Securely store or shred any unneeded copies.

Common Mistakes to Avoid

Leaving the scope too broad. Broad requests can slow processing and overexpose your data. Don’t forget to name dates, providers, or record types.

Missing proof of authority. If you sign for someone else, missing documents cause rejection. Don’t forget to attach power of attorney or guardianship orders.

Unclear recipient information. Incomplete names or addresses lead to misdelivery. Don’t forget to list full recipient details and delivery method.

No expiration date. Open-ended authorizations increase risk. Don’t forget to set a date or event when it ends.

Not addressing sensitive topics. Silence can cause unintended disclosure. Don’t forget to state if sensitive categories should be included or excluded.

Illegible handwriting or incomplete fields. Hard-to-read forms trigger delays. Don’t forget to print clearly and review every field.

What to Do After Filling Out the Form

Submit the form to the designated office listed on the form. Use the contact and delivery instructions printed on the form. If in doubt, call the number provided on the form to confirm submission details.

Track delivery. If you mailed it, use tracking. If you sent it electronically, save the confirmation. Note the date the office received it.

Respond to follow-ups. The office may request ID, authority proof, or clarification. Reply quickly. Delays often occur when responses sit unanswered.

Handle any fee notice. If you receive a fee letter, pay as instructed. Ask for an electronic copy if you want to reduce costs. Keep payment proof.

Monitor timelines. If you hear nothing by your follow-up date, check in. Provide your name, submission date, and any tracking number. Ask if anything else is needed.

Receive and review records. Confirm the records match the scope you authorized. If something is missing, request a supplemental release. If something exceeds your scope, note it and contact the office.

Make corrections if needed. If you set the scope too narrow, send a new authorization with the added details. If you need to add a new recipient, submit a separate authorization.

Revoke when appropriate. If your purpose is complete, consider revoking any unused authorization. Send a dated, signed revocation to the same office.

Protect your copies. Store records in a secure location. Avoid emailing unencrypted files. If you must share, use secure methods and limit recipients.

Update your files. Keep the final authorization, correspondence, tracking proof, and receipt of records. Note the expiration date and the date you revoked, if applicable.